The K Desktop Environment

Next Previous Table of Contents

3. Features and Details

KSniffer currently has 3 sections for collection statistics about the network. 1) General interfaces. 2) Detailed Interface stats and 3) Port Specific Statistics for a particular Interface.

3.1 General Interface Statistics

The most basic of all KSniffer's statistics collections is the General Interface Statistics section. It allows you to monitor all network interfaces that are active on the machine. It counts the number of packets that each interface sees, as well as any bad packets (crc errors). It also gives a bandwidth usage listing for each interface.

3.2 Detailed Interface Statistics

This option is available for a more detailed listing of what network traffic is going on over a specific interface. It allows you to monitor several network protocols and their specific packet count, and amount of bytes being sent. The supported protocols are: IP, TCP, UDP, ICMP, ARP, RARP, IPX, and other. All other protocols not listed will still have data collected for them, but all of their statistics will be clumped into one section called "NON-IP". This section also shows total bandwidth usage per second as well as total packets per second usage and are updated once a second.

3.3 Port Specific Statistics

This section is the newest feature in KSniffer. It allows the user to monitor port specific traffic on a particular interface. For example, the user can watch http, telnet, ftp, irc, quake, half-life, etc. specific traffic. This is a very useful feature for ppl that are worried about being hacked, since they can monitor most user level apps network traffic this way.

The default for KSniffer is to only watch ports less then 1024. They are the normal system ports, which can be listed in /etc/services . For some reason Red Hat installs don't list port 22 (ssh) in /etc/services, so if you want KSniffer to list the name for port 22 then, just edit your /etc/services and add an entry for port 22.

If you want to list more ports above port 1024, then use the Filter Menu to add any wanted ports or ranges of ports to watch. This is typical for apps like irc (6667), quake (27500), half-life (27015), icq (4000), etc.

Next Previous Table of Contents