Wireshark

To be fair, Wireshark was mentioned in the original article as one of those tools that's so popular that including it in the original top 10 network tools would be essentially repeating old news. Some readers believed, however, that Wireshark is so good it deserved a mention.

Wireshark is a network protocol analyzer or sniffer and is the continuation of the well-known Ethereal project . A protocol analyzer "listens" to a network, records all of the packets seen on the connection and presents a detailed analysis of those captured packets. Properly placed, a good sniffer can provide reams of data invaluable for network troubleshooting and monitoring.

The problem is in the presentation of the information. Simply producing a text file of raw packet output is difficult to analyze. A good protocol analyzer needs to be able to take that information and present it to a network administrator in a summary format, and Wireshark does that.

Wireshark can provide deep inspection of hundreds of protocols, and more are added with each release. It can also import traces from other programs (tcpdump, Cisco IDS, Microsoft Network Monitor and Network General to name a few) so analyzing information from other sources is a breeze. It runs on Windows, Linux, Mac OS and other operating systems.

If you are going to administer a network, big or small, a protocol analyzer is a necessary tool. Wireshark fits the bill.

The Dude

Knowing that services are available on your network is a good thing, but knowing when services go down as soon as (or better yet before) your users and customers do is essential. The Dude is a network management package that excels in so many facets it must be tried to be believed that so much can be offered by a freeware tool.

After installation, like many network management packages, The Dude begins with a network discovery process. You input the IP address range or network to discover plus the type of discovery (such as ping or services). This produces a basic network map from which you may customize types of monitoring. The color of the network device's model changes from green to orange if a service goes down and red if all connectivity is lost.

Monitoring includes simple pings, services based on TCP port number, SNMP probes and the ability to log into machines to acquire more specific data. The Dude comes with a preconfigured services set so as to not overwhelm monitoring, but it's trivial to add user-customized services. While it can do so, The Dude isn't designed for discovering services offered by machines on your network. For that you'll want Nmap, which is discussed later.

Without decent notification attributes though, network management packages lose usefulness. This isn't a problem for The Dude. In addition to the map, you can configure a variety of notification modes, from pop-up windows to e-mail messages. In one test, I manually shut off access to MySQL on my Linux Snort IDS box. The Dude popped up a flag and sent me a customized e-mail within a few seconds. You may wish to tweak probe intervals because a lot of false positives would be a distraction.