1 Download and Decompress IMMonitor
As in Figure1.1, after download IMMonitor and decompress it with WinZip, you will find three files.
Figure 1.1
Double click IMMonitor.exe to install it.
- 1). Before you install IMMonitor Software, please make sure you remove all other network sniffing programs or earlier version of IMMonitor from your computer.
- 2). IMMonitor requires a web browser to use its web interface. A browser version like IE 5.5 or higher is recommended. Using older browser may cause IMMonitor web interface display incorrectly.
- 3). IMMonitor software requires the running computer to open TCP port 9120 and 9121. Many firewall program prevents another program open a local port. Therefore it is recommended you shall adjust your firewall settings before installing IMMonitor.
2 Launching IMMonitor Console
You can launch IMMonitor console by clicking the IMMonitor shortcut on desktop, or run it from "Start" -> "Programs" -> "IMMonitor" -> "IMMonitor Console". If you choose not to create shortcut during installation, you need to type "http://localhost:9120" in your browser address field to visit IMMonitor console.
As in Figure2.1, Input "admin" in "USER ID" and default password "123456" in "PASS", and then click "Login".
Figure 2.1
As in Figure2.2, after successful login, you can see all monitored online computers.
Figure 2.2
If the location of IMMonitor in your network is incorrect or configuration error, IMMonitor will have problem to monitor other computers.
If no computer presents in "Online Computers", the "Monitoring Adaptor" setting may be incorrect. Please refer to Monitor Settings.
If only the computer with IMMonitor installed on exists in "Online Computers", this means IMMonitor is not deployed at the correct place. Please refer to "How to deploy IMMonitor?".
3 Configure IMMonitor
3.1 Monitor Settings
If no computer presents in "Online Computers", there are two possibilities:
1. You haven't have any network activity yet. Please visit some websites and refresh "Online Computers".
2. The listening device is configured incorrectly. As in Figure3.1, click "Monitor Setting" and check whether current listening device is correct.
Figure 3.1
3.2 How to specify computers need to be monitored?
As in Figure3.2, click the "User-computer Table". Check the "Enable Monitor" checkbox before the computer you want to monitor and save.
Figure 3.2
If your licensed monitoring number is smaller than total number of choosed computers, IMMonitor will only monitor first found licensed number computers.
4 How to deploy IMMonitor?
4.1 Introduction
IMMonitor can be installed on a single Windows machine for a small network(1-500 Users).
IMMonitor analyses network traffics to do monitoring. So IMMonitor should be deployed at a location where it can see all Internet traffics.
Basically, a computer connected to a switch or a route can only receive its own traffic.
A broadcasted hub is a data packet repeater commonly used in broadcast networks. In a broadcast network, a node will send a packet that traverses through every other node until the recipient accepts the packet. Every node in the network will conceivably receive this packet of data until the recipient processes the packet. In a broadcast network, all packets are sent in this manner.So each computer connected to a broadcasted hub can monitor other computers.
In a switched network, packets are not broadcasted. This was overcome by configuring a switch to replicate the data from all ports or VLAN's onto a single port. This function has a multitude of names including: Port Mirroring, Monitoring Port, Spanning Port, SPAN port and Link Mode port.
As described above,to monitor all Internet traffic,should consider two conditions:
1. The machine with IMMonitor installed on shall be connected to a broadcasted hub or the mirror port of a switch supports port mirroring.
2. All Internet traffic passes through this broadcasted hub or switch.
The detailed deployment depends on different network topology. Here we take a typical small network environment as an example.
4.2 A Typical Small Network
As in Figure5.1, local computers use a wireness router to connect to the Internet. Under this type network, it requires a broadcasted hub or a port mirroring switch between gateway and switch. And the machine with IMMonitor installed shall connect to the hub or the monitor port of the port mirroring switch.
As most broadcasted hub only works in 10Mb speed, we recommend you use a port mirroring switch if your internet bandwidth larger than 4Mb.
Figure 4.1
4.3 Broadcasted Hub's Usage
A broadcasted hub is a data packet repeater commonly used in broadcast networks.
Most broadcasted hubs provide an uplink port. As in Figure4.2, you shall connect the switch to the uplink port of the hub (Note: Do not use the nearby port with the uplink). And connect the computer with IMMonitor installed on to the hub.
Figure 4.2
4.4 Switch's Usage and Port Mirroring
The machine with IMMonitor installed on shall be connected to the mirror port of a switch. As in Figure4.3.
Figure 4.3
If you want to monitor all Internet traffic, you should configure port J as the target mirror port, and configure port A as the source mirror port. So the port J can receive all the data transfered through the router.
If you also want to monitor local servers, as local mail servers, proxy servers and file servers. Suppose a local email server is connected to port H, you should also mirror port H's traffics to port J.
5 Using IMMonitor with ARPSpoof?
5.1 Introduction
ARP spoofing, also called ARP Cache poisoning, is one of the hacking methods to spoof the contents of an ARP table on a remote computer on the LAN.
Always do not spoof more than 30 computers and keep your computer stable. If your computer hangs or power off when spoofing, the computers being spoofed will lose connections.
5.2 Using IMMonitor with ARPSpoof
As in Figure5.1, if this is the first time running ARPSpoof, you will be asked to restart your computer.
Figure 5.1
After the computer restart, please use the ARPSpoof according to the following steps.
1. As in Figure5.2, choose machines you want to monitor and click "Start ARP Spoof" in "Full Duplex" mode.
Figure 5.2
2. As in Figure5.3, open IMMonitor console with ARPSpoof running, set "Mode" to "By IP Address" in "Monitor settings".
Figure 5.3
3. As in Figure5.4, you can monitor all spoofed computers.
Figure 5.4