Wireshark-users: Re: [Wireshark-users] Sniffing ASP web traffic

Date: Mon, 24 Jul 2006 18:00:31 +0200
I guess IIS logs HTTP requests regardless of how the request is
performed, at least it should.

On 7/24/06, John Turpin <jturpin@xxxxxxxxxxxxxxxxxxxxx> wrote:
Will that get compiled .asp pages too?

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of LEGO
Sent: Monday, July 24, 2006 10:49 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Sniffing ASP web traffic

You should use the server logs for that, unless you are experiencing a
large packet loss you will be able to aproximate the bandwidth usage of
every virtual host. The logs should contain the timestamp, the request,
and the bytes served.

Statistics->HTTP->LoadDistriution gives you the number of HTTP
requests but it does not give you the packet/byte count.

Luis.

On 7/24/06, John Turpin <jturpin@xxxxxxxxxxxxxxxxxxxxx> wrote:
>
>
> We run .asp apps on IIS web servers, with different sites on the same
> IP address.  We would like to be able to tell how much bandwidth each
> site uses.  (we have about 300) Since the pages are .aspx and a
> dynamically compiled and share the same IP address it is hard to split
them up.
>
> I have the following setup:
>
> (firewall) -----(TAP)---------(Switch)-----------(IIS
> Server)
>                      |
>                      |
>                   (wireshark)
>
>
> How can I tell from the TCP/IP packets (capture) what files and pages
> come from what site and how large they are to determine bandwith usage

> from 5 minute samples of data in wireshark?
>
>
>
>
>
> *************************
> John Turpin
> Senior Network Administrator
> iModules
> 7201 W. 129th St.
> Overland Park, KS. 66213
> jturpin@xxxxxxxxxxxx
> 913.888.0772 Toll Free 1.800.734.3853
> www.imodules.com
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
>
>
>


--
This information is top security. When you have read it, destroy
yourself.
-- Marshall McLuhan
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users



--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan