It's an interesting display - a circle of "connections"
with lines of varying thickness showing the volume of
traffic and exactly where the traffic is going. You will
see most everything alive on your local network (no,
switches won't hide it). This app can be an informative
tool.

LATEST version is just a .tar of the source code, but
the Deb package archives have the ALMOST latest version
which WILL install in Buster/Bullseye/Bookworm.

Connect to a new web site and you'll see a momentary
"white out" as all the new data gets exchanged. You
can click on any of the connections for a lot more
detail.

In short, it does something nmap/wireshark really
doesn't - it's a LOT better visualization of the
current situation, better presented. The others
have their place of course, but it's often HARD
to read what's going on from their text reports.
Something dragging down your network - EtherApe
will make that extremely obvious instantly.

36J.955 wrote:

> You will see most everything alive on your local network (no,
> switches won't hide it).
Actually switches *will* prevent it seeing most traffic, unless you run
etherape on a machine acting as a router, or being fed from a mirror port.

"Why I see only the traffic to/from the EtherApe machine ?
Probably you have a switched network. Unless all traffic goes thru the
etherape machine (or you have an hub), etherape sees local traffic.
Etherape can "see" only the traffic physically passing on the netcard wire."

On 12/07/2023 10:53, Andy Burns wrote:
>
> 36J.955 wrote:
>
>> You will see most everything alive on your local network (no, switches
>> won't hide it).
> Actually switches *will* prevent it seeing most traffic, unless you run
> etherape on a machine acting as a router, or being fed from a mirror port.
>
>
> "Why I see only the traffic to/from the EtherApe machine ?
> Probably you have a switched network.  Unless all traffic goes thru the
> etherape machine (or you have an hub), etherape sees local traffic.
> Etherape can "see" only the traffic physically passing on the netcard
> wire."
The days of 'seeing everything on the network' ended with the demise of
coaxial Ethernet.

--
"The most difficult subjects can be explained to the most slow witted
man if he has not formed any idea of them already; but the simplest
thing cannot be made clear to the most intelligent man if he is firmly
persuaded that he knows already, without a shadow of doubt, what is laid
before him."

- Leo Tolstoy

Am 12.07.2023 um 01:05:27 Uhr schrieb 36J.955:

> It's an interesting display - a circle of "connections"
> with lines of varying thickness showing the volume of
> traffic and exactly where the traffic is going. You will
> see most everything alive on your local network (no,
> switches won't hide it). This app can be an informative
> tool.

I've tried it with transmission-bt running and many connections.
You couldn't see anything, too much.

Am 12.07.2023 um 11:50:47 Uhr schrieb The Natural Philosopher:

> On 12/07/2023 10:53, Andy Burns wrote:
> >
> > 36J.955 wrote:
> >
> >> You will see most everything alive on your local network (no,
> >> switches won't hide it).
> > Actually switches *will* prevent it seeing most traffic, unless you
> > run etherape on a machine acting as a router, or being fed from a
> > mirror port.
> >
> >
> > "Why I see only the traffic to/from the EtherApe machine ?
> > Probably you have a switched network.  Unless all traffic goes thru
> > the etherape machine (or you have an hub), etherape sees local
> > traffic. Etherape can "see" only the traffic physically passing on
> > the netcard wire."
> The days of 'seeing everything on the network' ended with the demise
> of coaxial Ethernet.

It still existed with Hubs for 10/100 MBit/s via copper.
I dunno about fiber.

Andy Burns <usenet@andyburns.uk> wrote:
> 36J.955 wrote:
>
>> You will see most everything alive on your local network (no,
>> switches won't hide it).
> Actually switches *will* prevent it seeing most traffic, unless you run
> etherape on a machine acting as a router, or being fed from a mirror port.

It's a shame it doesn't seem to have a client/server system where
the client/display runs on a separate computer to the router
without needing to install GTK3 and X libs on the router to display
remotely via X.

--
__ __
#_ < |\| |< _#

On 7/12/23 9:52 AM, Marco Moock wrote:
> Am 12.07.2023 um 11:50:47 Uhr schrieb The Natural Philosopher:
>
>> On 12/07/2023 10:53, Andy Burns wrote:
>>>
>>> 36J.955 wrote:
>>>
>>>> You will see most everything alive on your local network (no,
>>>> switches won't hide it).
>>> Actually switches *will* prevent it seeing most traffic, unless you
>>> run etherape on a machine acting as a router, or being fed from a
>>> mirror port.
>>>
>>>
>>> "Why I see only the traffic to/from the EtherApe machine ?
>>> Probably you have a switched network.  Unless all traffic goes thru
>>> the etherape machine (or you have an hub), etherape sees local
>>> traffic. Etherape can "see" only the traffic physically passing on
>>> the netcard wire."
>> The days of 'seeing everything on the network' ended with the demise
>> of coaxial Ethernet.
>
> It still existed with Hubs for 10/100 MBit/s via copper.
> I dunno about fiber.

Switches hide SOME of it ... however if you run EtherApe
you'll see a LOT more than what's JUST directed to your
personal machine.

I still keep an actual "hub" - just in case - with a
big label saying "NEVER Throw Away !". It can be put
between the router and the local network switch and
you can see everything. Not gigabit of course, but
enough for detective uses.

Hmmm ... seems there'd now be a MARKET for gigabit+
"hubs" for just this sort of thing. Just one 'in' and
two "outs" would do. Routers range from WalMart to
software-based to expensive Cisco type things that
can be hacked to the max (read SpeedGuide port notes).
The Solution is that intermediate "hub" - cheap and
effective.

Computer Nerd Kev wrote:

> It's a shame it doesn't seem to have a client/server system where
> the client/display runs on a separate computer to the router

Sounds like remote pcap, all the pieces are there in wireshark if
etherape wants them.

Similar request, but doesn't sound high up the todo list
<https://sourceforge.net/p/etherape/feature-requests/7/>

On 7/12/23 9:51 AM, Marco Moock wrote:
> Am 12.07.2023 um 01:05:27 Uhr schrieb 36J.955:
>
>> It's an interesting display - a circle of "connections"
>> with lines of varying thickness showing the volume of
>> traffic and exactly where the traffic is going. You will
>> see most everything alive on your local network (no,
>> switches won't hide it). This app can be an informative
>> tool.
>
> I've tried it with transmission-bt running and many connections.
> You couldn't see anything, too much.

Depends on what you mean by "anything".
I can see a LOT of stuff going on in my
subnet.

The IDEAL would be a 3-port modern 'hub' you
could plug a laptop or whatever into between
the router and local switch. Don't SEE those
however ... (hey StarTech or whomever !)

Alas routers sophisticated enough to do the
kind of looking we want also tend to be very
vulnerable to hackers - see 'SpeedGuide'
port notes. Cisco's are the prime target.

36J.955 wrote:

>   The IDEAL would be a 3-port modern 'hub' you
>   could plug a laptop or whatever into between
>   the router and local switch.

That sort of thing does exist

<https://www.cyberdata.net/products/011259>

36J.955 wrote:

>   Switches hide SOME of it ... however if you run EtherApe
>   you'll see a LOT more than what's JUST directed to your
>   personal machine.

well, yes you'll see broadcast and multicast traffic

On 13.7.2023 8.30, 36J.955 wrote:
> On 7/12/23 9:51 AM, Marco Moock wrote:
>> Am 12.07.2023 um 01:05:27 Uhr schrieb 36J.955:
>>
>>> It's an interesting display - a circle of "connections"
>>> with lines of varying thickness showing the volume of
>>> traffic and exactly where the traffic is going. You will
>>> see most everything alive on your local network (no,
>>> switches won't hide it). This app can be an informative
>>> tool.
>>
>> I've tried it with transmission-bt running and many connections.
>> You couldn't see anything, too much.
>
>   Depends on what you mean by "anything".
>   I can see a LOT of stuff going on in my
>   subnet.
>
>   The IDEAL would be a 3-port modern 'hub' you
>   could plug a laptop or whatever into between
>   the router and local switch. Don't SEE those
>   however ... (hey StarTech or whomever !)
>
>   Alas routers sophisticated enough to do the
>   kind of looking we want also tend to be very
>   vulnerable to hackers - see 'SpeedGuide'
>   port notes. Cisco's are the prime target.

Most managed switches have the possibility to configure
one port to monitor traffic on the other ports. It is
possible to select the target ports and data direction
(transmit, receive or both).

The thing does not need to be expensive. I paid some
tens of Euros for the Zyxel GS1200 -series switches.

--

-TV

Am 13.07.2023 um 01:21:04 Uhr schrieb 36J.955:

> Hmmm ... seems there'd now be a MARKET for gigabit+
> "hubs" for just this sort of thing.

Some switches have a mirror option to do exactly that.

On 7/13/23 2:29 AM, Andy Burns wrote:
> 36J.955 wrote:
>
>>    Switches hide SOME of it ... however if you run EtherApe
>>    you'll see a LOT more than what's JUST directed to your
>>    personal machine.
>
> well, yes you'll see broadcast and multicast traffic

Which can tell you a lot - esp if some machine is
overloading things or the target of some kind of DOS
attack.

But you should STILL have one of those old "hubs".

On 7/13/23 3:34 PM, Marco Moock wrote:
> Am 13.07.2023 um 01:21:04 Uhr schrieb 36J.955:
>
>> Hmmm ... seems there'd now be a MARKET for gigabit+
>> "hubs" for just this sort of thing.
>
> Some switches have a mirror option to do exactly that.

Remember a good brand/model ? Something proven ?

On 7/13/23 2:28 AM, Andy Burns wrote:
> 36J.955 wrote:
>
>>    The IDEAL would be a 3-port modern 'hub' you
>>    could plug a laptop or whatever into between
>>    the router and local switch.
>
> That sort of thing does exist
>
> <https://www.cyberdata.net/products/011259>

Ah ! VERY useful info !!!

On 7/13/23 9:05 AM, Tauno Voipio wrote:
> On 13.7.2023 8.30, 36J.955 wrote:
>> On 7/12/23 9:51 AM, Marco Moock wrote:
>>> Am 12.07.2023 um 01:05:27 Uhr schrieb 36J.955:
>>>
>>>> It's an interesting display - a circle of "connections"
>>>> with lines of varying thickness showing the volume of
>>>> traffic and exactly where the traffic is going. You will
>>>> see most everything alive on your local network (no,
>>>> switches won't hide it). This app can be an informative
>>>> tool.
>>>
>>> I've tried it with transmission-bt running and many connections.
>>> You couldn't see anything, too much.
>>
>>    Depends on what you mean by "anything".
>>    I can see a LOT of stuff going on in my
>>    subnet.
>>
>>    The IDEAL would be a 3-port modern 'hub' you
>>    could plug a laptop or whatever into between
>>    the router and local switch. Don't SEE those
>>    however ... (hey StarTech or whomever !)
>>
>>    Alas routers sophisticated enough to do the
>>    kind of looking we want also tend to be very
>>    vulnerable to hackers - see 'SpeedGuide'
>>    port notes. Cisco's are the prime target.
>
>
> Most managed switches have the possibility to configure
> one port to monitor traffic on the other ports. It is
> possible to select the target ports and data direction
> (transmit, receive or both).
>
> The thing does not need to be expensive. I paid some
> tens of Euros for the Zyxel GS1200 -series switches.

Also very useful info ! I have ONE "managed" hub
(NetGear) bought by accident but I don't remember
seeing that particular capability. Maybe I didn't
read far enough into the docs ....

In any case, this capability IS still needed given
the kinds of attacks, and malfunctions, we can see
in today's overly-complicated situation. Use a laptop,
a gen-4 old PC, maybe a PI, but having SOMETHING that
can monitor *everything* conveniently is needed for
even the smaller-biz sector. Most routers KINDA do
it, but they rarely organize the info in a useful way
so you can SEE weird stuff happening. Something
like EtherApe DOES let you see it pretty clearly.

On 14/07/2023 03:46, 36J.955 wrote:
> On 7/13/23 3:34 PM, Marco Moock wrote:
>> Am 13.07.2023 um 01:21:04 Uhr schrieb 36J.955:
>>
>>> Hmmm ... seems there'd now be a MARKET for gigabit+
>>> "hubs" for just this sort of thing.
>>
>> Some switches have a mirror option to do exactly that.
>
>   Remember a good brand/model ? Something proven ?

Pretty much all "managed" switches.

On 13/07/2023 06:30, 36J.955 wrote:
>   The IDEAL would be a 3-port modern 'hub' you
>   could plug a laptop or whatever into between
>   the router and local switch. Don't SEE those
>   however ... (hey StarTech or whomever !)

My own hub seems to have fallen victim to a clearout at some point.

However, the BSD's (or at least, FreeBSD; I don't know about linux) can
bridge two network ports, and I have an old PI3 I've used for network
monitoring using this feature. Don't forget you might need a spare
wireless AP as well.

--
Mike Scott
Harlow, England

Andy Burns <usenet@andyburns.uk> writes:

> Pretty much all "managed" switches.

Even my fairly ancient SMCGS8P has a mirroring option. Shame it has only
eight ports.

On 7/14/23 6:50 AM, Anssi Saari wrote:
> Andy Burns <usenet@andyburns.uk> writes:
>
>> Pretty much all "managed" switches.
>
> Even my fairly ancient SMCGS8P has a mirroring option. Shame it has only
> eight ports.

Well, attach dumb switches to the other seven ports
and you're cookin' :-)

And the one smart port - use that for detailed
monitoring. I've got something similar, running
on a Pi, that keeps track of most traffic and
can, crudely, pick "interesting" stuff to watch
extra-careful. Run EtherApe THERE and you'll get
a very visually comprehensible overview of
What's Going On.

But I'm retiring soon ... so it'll be up to the
as-yet-undetermined New Nerd. I fear they won't
be able to find anyone as "broad" as myself alas,
started with punch-cards - all my old work gone
and ruined - probably replaced by M$ crap/cloud/$$$
"solutions". Oh well ... not my problem. They WILL
crash and burn, often. My only reward will be those
who say "Remember how it worked SO much better when
good old "xxxxxx" was here ?" :-)