Who Is Talking on My LAN?
Identifying Traffic Hogs
Now that we've learned about the protocols, we may want to learn about the top talkers by looking at the LAN Hosts (MAC) tab. If your computer is not a part of a LAN, you won't see much useful information in this table, but if you monitor a LAN segment being connected to the monitoring port of a switch (or a good old hub), you can quickly identify traffic hogs or the stations responsible for "broadcast storms."
As you probably know, a network analyzer puts your card in so-called "promiscuous mode," which allows you to capture not only the packets addressed to your machine, but also all other packets being sent or received in your LAN segment.
Note that some of the entries in the first column are MAC addresses, while others are user-friendly names. Remember how we assigned aliases to IP addresses in one of the previous chapters? You can do the same with MAC addresses, just right-click on any of them and select Aliases to assign or edit an alias.
Another way of looking at the nodes that are active in your LAN segment is through the Matrix tab. This tab is a peer map that displays the traffic flow between different hosts. Using the matrix, you can immediately see who is talking to whom:
