Monitoring IP traffic to and from a NAS server?

tvout · 14-05-2007, 21:56

Hi all,

I've been wondering if the DOS nbtstat command would work for this purpose but not sure as it doesn't really appear to.

I have a NAS server which is basically an external hard disk that has a basic web interface that allows you to set up FTP accounts to access it.

Having at set times opened FTP ports on my router to allow access I have heard the disk start up (set to sleep after 5 minutes of activity) but nothing shows on the inbound traffic at that point on the logs on my WRT54G router (DD-WRT firmware) what is incoming on that port. It will though if I switch the LANdisk off and refresh the incoming log and check the incoming IP on FTP on www.dnsstuff.com to find it's in Saudi Arabia or the US or something...

I'd like some sort of utility that could show me at any point any activity on that IP address (my Landisk) either inbound or outbound?

Does anyone know any kind of tool or utility that could do that?

Cheers

Wicked_and_Crazy · 14-05-2007, 22:06

Have you set up CHAP secrets on the router for accounts to the NAS drive?

If you set up accounts they wont be able to connect to the drive

brundles · 14-05-2007, 23:10

There's two ways of doing it can think of off the top of my head.

The first is to put a hub between the router and everything else. i.e a single connection from the router to the hub then plug the NAS drive and PC into the hub. Not ideal, but it will ensure that all packets get broadcast rather than switched so you can leave ethereal or similar running on the PC and check what's happening.

The other more complicated approach is that I seem to remember that it was possible to get some form of packet sniffer running on DD-WRT - but for it to work you'd need it to spool the results directly to another device using the samba client too because of the memory constraints.

The DD-WRT Wiki has the instructions for setting up Samba - I'll try and find the stuff I thought I had on packet sniffing from DD-WRT and re-edit this post if I find it.

Edit: This thread on the old forum before DD-WRT went mainstream should cover what you need. It will depend what build you're running though.

tvout · 15-05-2007, 00:12

Great ideas, many thanks.
I'll have a look at CHAP accounts, that's new to me. I thought about things like restricting IP access to a port or something but that wouldn't work as I wouldn't know the IP addresses of the few people I want to have access.
I don't have a hub I could use (sold it when I went to wifi) but do have a switch (Netgear Wifi router - I ditched it when I discovered Linksys was so much more reliable!) although not sure how well it'd work. The PC I use is on Wifi so it could maybe work through the Netgear router if that's plugged into the main linksys router possibly?
Otherwise the packet sniffer idea might be good...
Cheers again for the ideas. :o)