Pinpointing a 'bad apple' on a network...

Hello all--

Recently I have been having problems with my network here and I was just wondering if anyone could give me some tips.

Heres what my current setup looks like:

I have a

Comcast Cable Modem Connection

that goes to a

Linksys Router

which splits off into

two 15-port switches

All in all, there are about 25-30 computers connected to this network.

The recent problem has been a slow or nonexistant internet connection due to some computers having spyware/adware/viruses/etc... on them. I have given each computer Spybot S&D, run HijackThis! on each computer, and installed Norton Anti-Virus on each box. The problem is that I dont really have control as to how each computer is being used (since these are other people's PCs) and some mess them up within a few days (sad but very common around here).

Is there some way I can pinpoint that 'bad apple' who is bogging down the network connection?

Everyone has a static IP right now. Is it possible to give everyone unique IP's so I can tell how much traffic is coming from which computer?

Thank you for your help in advance it is much appreciated.

--Dave

Monitor the network traffic, and use DHCP to see what computer is using what address.

If you are responsible for the network, you need to be able to control access. Go with the DHCP idea, but even now I would just monitor the network as is & work toward restricting users accounts to prevent access to things that will kill the network.

Thanks for the input, but I dont think restricting PCs would work in this situation. The only reason Im in charge of the network is because the other 20+ users know jack squat about computers, let alone how a network works.

Basically I want to pinpoint what computer(s) are the problem and just disconnect them from the network and snip their CAT5 so they can never plague the network again.

Now by using DHCP Im assuming I can track what box is using what IP. Now how do I go about tracking the traffic of these IPs?

Some routers have a stutus page, that reports where recent requests for remote sites came from. Try typing in the ip of your router (a common one for such a device is 192.168.0.1) into a web browser and see if you get anything. Better yet, check the Linksys site. That's the easiet way of identifying the problem comps that I can think of, and probably the only way that I can fully undersand. Rather than killing their connection, which with what info you gave sounds a bit harsh, you might want to consider a firewall computer. Doesn't have to be very fast, and I'm sure that there are plenty of free apps out there for such a device. Alternatively, you could by a business firewall apartus for around $500-$2000 US.

I only put thse out as solutions that come to mind. I have no idea how do imlement any of those systems, if they are even a viable option for your situation.

Google for look@lan, download & install. It's freeware that will give you a little insight to what's sitting on your network

imDAtek said:

Google for look@lan, download & install. It's freeware that will give you a little insight to what's sitting on your network

Click to expand...

Yes, look@lan is good, you can also try browsing
SourceForge.

just make sure you are browsing windows software, there, you will find many network utilities under the gnu/gpl (free open source). Just try finding a good network monitor that works for you.

use net monitor in conjuction with time frames that IP's were logged in. net monitor will let you know when traffice starts to spike. to freak the individual out, net send to the person when you pin point him to let him know you're on to him.

killians45 said:

use net monitor in conjuction with time frames that IP's were logged in. net monitor will let you know when traffice starts to spike. to freak the individual out, net send to the person when you pin point him to let him know you're on to him.

Click to expand...

LOL. brings back memories of school, and when the techs didn't know that net send could work (or even existed). Don't ask me, the school that I went to must have been poor, and way too stoopid... they hired normal people. not nerds....

haha! Too funny...

I remember netsending comps "Internal Windows Error: The computer will restart in 5 seconds."

"3"

"2"

"1"

"Goodbye"

and then use a remote connection prog to shut down their computer.

Those were the days...

Back on subject: Thank you for all the help. Ill try some of these progs and get back to you with some results (Im sure you guys are dying to know )

Thanks again!