1

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable.

I have had a go with Wireshark and I am sure that it could tell me what I need to know via it's "Statistics" menu by looking at the bytes sent to each physical address.

The problem is I need to leave this running for many days, and wireshark (by default at least) is logging every single packet and it's contents leading to absolutely enormous and numerous log files.

I simply need to know how many bytes were sent to/from each device on our network per hour/day. I don't care about any of the other information at this stage.

2
  • I just had a look at capture filters, but I dont think there is a way in wireshark to achieve what you want. Most network equipment that is managed supports getting the interface counter status via SNMP. You could use a SNMP client like PRTG (free verison) to collect the counters on an interface. Or you can read out this information from the operating system that us causing the traffic? With Windows, there is a WMI query that gives you interface counters.
    – Mario Jost
    Mar 2 '20 at 11:10
  • Yes, Wireshark captures everything that comes through the interface. That is what it does. There are tools made for what you want, such as NetFlow, or you could clear the counters on your switch interfaces and later look at the statistics to see which switch interface has an unusual numberr of frames.
    – Ron Maupin
    Mar 2 '20 at 15:07
2

You can limit the size of the captured frames to just the header. That will drastically reduce the size of your capture files.

From ask.wireshark.org:

From the Capture menu select "Options..." (or press Ctrl + K), and then click on the Snaplen column item for the interface you which to set the capture length on. This gives you an edit\spin box which allows you to set the value required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.