We are looking for information on your software tool “name” This is what we are looking to do: We are looking to capture the relationships of servers within a network. We need to know how the servers are related. Relationship means that the servers had communications(Db call, backup,…) between them. Any kind of communication would need to be captured. We were thinking of the following and wanted to know if your SW can do what we need: • Monitor/scan the network over a period of time (1 week … 1 week +) based on a range of IP addresses. • We are looking to do this without an agent. • We are looking to capture and track the server relationships. By track, we mean keep a count of the number of times an interaction took place • We want the relationship to be captured as follows: Primary Server Machine Name Primary Server IP Address Related Server Machine Name Related Server IP address Count Server 1 IP1 Server 2 IP2 8700 Server 7 IP7 500 Server 12 IP12 300000 Server 2 IP2 Server 1 IP1 8700 Server 9 IP9 6722 Server 3 IP3 998866 Server 12 IP12 2220 Server 11 IP11 7 Server 3 IP3 . . . . . . . . . . . . . . . . . . . . . . . Can your sw provide us this information? If so, how? If not, do you know of any sw that can provide it? Bonus – Nice to have if it could also capture the type of communication and the application that made the call. asked 13 Nov '14, 11:26  Browndog801 |
One Answer:
It's possible to do this with Wireshark (or more correctly tshark) but you have to use something to summarise the output - we've used SAS to do this in the past. However, you have to deploy capture units all over your network. It's easier to use a flow-based tool; one that collects and processes netflow, jflow, etc. Riverbed Steelcentral AppMapper could do it for you. You could probably also write a Powershell script that executes netstat -aob remotely on each Windows server say every minute and saves the results for later summarising. The -aob will give you conversation and executable information. Best rdgards...Paul answered 15 Nov '14, 15:12  PaulOfford |
