AANTS - Find a Workstation That's Abusing Your Server
You must have the IP or MAC address of your server.
Using NetWatch, pull up the traffic graph for the port that your server is on:
- Select "ALL" devices.
- Enter the hostname (DNS), IP, or MAC address of the server.
- Do nothing (leave w/dates select).
- Submit query.
Use the Port column to see "Bits", "Pkts", and "Errs" rate graphs. The "Pkts" graph can be insightful if the server is overwhelmed by packets, as many small packets wouldn't be visible in the "Bits" rate graph.
Use the Port Stats Search "Report Most Active" form to find other access ports in your building(s) with similar levels of activity.
If you can't find the identity of the source (MAC or IP) of the packets with the servers' operating system or tools, it would be best to use a packet capture utility (such as ethereal under Windows or Linux) on the same switchport as the server to capture sample packets. The capture can expose the MAC address (and possibly IP address) of the misbehaving source host.
Enter the MAC or IP in NetWatch, and it will tell you where that machine has been connected.