<a href=”http://www.ntop.org/news.html”>ntop</a> is an excellent tool for this purpose. However, you will need to properly configure the network for ntop to capture traffic on a switched network. A network switch will only send broadcast traffic to all ports. To “hear” all traffic, a switch port has to be configured as a mirror, span or monitor port. You can then connect your network monitor to this port to listen to all traffic on the network. Another option would be to get a network tap and place it between the edge router & the LAN switch. This will permit you to see all traffic entering and exiting the local network. It would not show you host to host traffic on the local LAN though. Take a look at some of my blog postings on this topic. Start on this <a href=”http://itknowledgeexchange.techtarget.com/it-trenches/tag/monitoring/”>page</a> and the first part of the series starts <a href=”http://itknowledgeexchange.techtarget.com/it-trenches/tag/monitoring/page/5/”>here</a>. The ntop mailing list is a great place to get additional assistance on this excellent application. This <a href=”http://www.youtube.com/watch?v=vZFMpsFKg2A”>video</a> or this <a href=”http://www.youtube.com/watch?v=glNZA9vpy8Y&feature=related”>one</a> may also give you some education into using ntop. You can find some liveCD’s with ntop on it. Check out the <a href=”http://www.networksecuritytoolkit.org/nst/index.html”>Network Security Toolkit</a>.
See this <a href=”http://itknowledgeexchange.techtarget.com/itanswers/network-bottelknecking/”>similar question</a>.