Introduction

This tutorial will guide you through the installation process and your first use of netAnalyzer.

Installation

Currently the programm have been successfully installed and running on

• Fedora core 6
• Ubuntu 7.10
• OSX 10.5

The BSD build should work but haven't been through fully tested.

Dependencies

netAnalyzer requires two libraries to work:

• The libpcap : to capture packets
• The libpcre : for the payload pattern matching

These two libraries are fairly common therefore if they are not installed on your system you can find them in your distribution repository.

Debian/Ubuntu

Here is how to install them on a Debian/Ubuntu system:

• To install the libpcap: sudo apt-get install libpcap-dev
• To install the libpcre: sudo apt-get install libpcre3-dev

OSX

libpcap and pcre can be installed on OSX thanks to macport (http://www.macports.org/)

• To install the libpcap:sudo port install libpcap
• To install the libpcre:sudo port install pcre

Once the libpcap and the libpcre are installed you can proceed to the installation itself.

Installing netAnalyzer

You can install netAnalyzer by doing the following:

• Download its sources
• Unpack them: tar vxzf netananalyzer-vx.x.x.tgz
• Change directory to the extract directory : cd netanalyzer-vx.xx.xx
• Compile it: make
• Install it (as root): make install

First use

A quick summary of the set of available option is always available through the -h option.

netAnalyzer need as least one option: which type of data to report. The three most used type of data reported are:

• Network flows: -F
• Host information: -H
• Sofware information: -S

If you want to know which flows (also called session) currently occur in your network you use the following command:

netAnalyzer -F

This will report all the flows that the analyzer see.It does include application layer information. By default they are turned on, if you wish to turn them off by default you can modify the configuration file located in /etc/netAnalyzer/. When they are turned off by default you can enable dynamically by adding the "-A" command line switch:

netAnalyzer -F -A

If you wish to limit the number of flows reported you can add the option -f. For each data reported an independent limiting option exist: it is the lowercaps letter. Hence to limit host (-H) number you use -h. Reporting 20 flows with advanced information is done by using the command:

netAnalyzer -F -A -f 20 which can be abreviated as netAnalyzer -f20 -A

You can see UsageExamples for more common uses of netAnalyzer or read a more detailed guide of possible option by looking at netAnalyzerOptions.