Is there a program to detect what ports being used in traffic on the network?

[duragezic]

I would like to detect the port being used for certain traffic on the network here at home. I have Cain & Abel right now which is able to use APR poisoning to sniff all traffic coming through the router. But it only designates traffic by IP and not by port. I thought I read somewhere that Ethereal would be able to tell me this so I downloaded it, but as far as I can tell, it can only capture network traffic to/from my IP. I need to get the port numbers of traffic to someone else, who is connected wirelessly to my router.

The traffic on Cain & Abel seems very much like torrent traffic especially compared to web and other traffic appearing on the list. It seems the default port of the torrent client I put to block worked for a while but the person must've changed that port (the router is old and doesn't offer advanced features like QoS, only deny by IP or MAC addr, and port).

Anyone know how I can do this, if it is possible? Cain would do it if only it showed the ports. Would something in the NetTools package do this?

 

[jlazzaro]

Ethereal, now known as Wireshark, should do the trick. Are you on a switched network? If not, be sure to turn on promiscuous mode. If so, the reason you only see traffic to/from you is because thats how switches work!

Unicast traffic between two ports will not necessarily appear on other ports - only broadcast and multicast traffic will be sent to all ports. You either need to setup a mirror port (a port all traffic on the switch is sent to), or connect both to a hub so that all packets are broadcasted.