network analysis software

does anyone know of a program that i can install on one pc and then use to gather the network protocols and ip's used by the rest of the network. all the pc's are running win 95/98 and there's a nt server.

thanks in advance

You'll need administrator level access to the server for most of these :-

If all the clients log onto the NT server for user level security, you can use event viewer (admin tools on server) to catch their machine names.

If the server is running DHCP then you could find which IPs have been allocated from the server.

There may be a utility in the NT server RESkit that could do that for you, but you'd need to be using an NT client or running it off the server itself.

Depending on the administrator and if the network uses static addresses, you could look for an LMHosts file on the server or the clients, that would provide machine names and IP addresses for all the servers on the network (those sharing resources).

As for protocols, you would need a protocol analyser, NT4 sever reskit comes with one, but you must run it off the server and have a fairly good understanding of how to use it to get results.

There's a great utility called IP Sniff that finds all of the in-use IP addresses on your subnet. All you do is put in the Network address and the Subnet Mask, and it pings all the available addresses and finds which ones are in use and which ones are not. The only problem is that it does not report in-use IP addresses of PCs that are turned off. Still, it's a cool little ut that I never leave home without. I believe I got it in the Network utilities section here on WinDrivers.

------------------
R. Bret Walker, CNE

Thanks for the suggestions, but our UNIX server keeps track of the IP addresses. What I'd really like is something that can tell me when someone starts peeing about with their network settings and puts IPX or NetBEUI.

Nobody is allowed to touch the NT server except me, so I can run what I like on it.

Get hold of the windows 95/98 resource kit, it will tell you how to set up remote registry / administration for them as clients. With remote registry and admin, you can check out a workstation config without leaving the comfort of your office/server room.

If you want to catch people doing bad things, then you'll need to track down a protocol analyser that can monitor net traffic in the background and issue alerts (I don't know of any, maybe someone else can help with that).

The other option is to enable user policies on the client machines and disable access to the network properties applet (the policy editor is on the Win98 and 95 CD in the admin folder). When a user logs on, have a login script load the policy from the server and apply it.
Policies are great for control enthusiasts, you can pretty much restrict someone to a blank screen with no options other than 'login' and 'shut down' available unless they provide a valid username and password.

Thanks again for the reply, cordon. I think I'm going to have to let this one go.

Everyone in our company who is capable of formatting a floppy disk is allowed to have access to the root password to all five of our servers. Thanks anyhow

There are packet analyzers available on the market. Lanalyzer from Novell is my personal preferrence. It will tell you what protocols are in use on the LAN and which nodes are using them based on their hardware address. Through network discovery, you can put a computer name to a hardware address and thus sniff out people who are putting the dreaded NetBEUI network virus on the wire (-:
By the way, good packet analyzers are not cheap. Lanalyzer lists for $1495, but you can get it for less at someplace like CDW. Consider the cost vs. what you want to use it for, and you may find it is well worth the price if you can speed up your network performance considerably.

------------------
R. Bret Walker, CNE

$1495 for a piece of software? we don't even spend that on our hardware! :-)

Is there some reason for the lack of security? You can prevent people from booting from floppy by changing the boot order to 'C: / A:' in BIOS and passwording the bios. Add profiles and you have pretty much prevented 90% of undocumented user 'enhancements'. Profiles can be stored locally on the clients, so you don't need to run login scripts if you don't want to.

Another option would be to remove the source files for netbui and ipx/spx from the computers. If anyone tries to change / add protocols, they get a crash that you have to fix.

I would tend to lock down everything that can cause me grief later on. If someone needs to make changes then you can make the changes for them (by putting an administrator account + profile on each client).