The network scanner, EtherApe, is another tool you might want to have installed on your hackbox. It shows a graphic display of the protocols in use on the network. In the images below, 10.0.0.4 is the Kali hackbox. All of the other endpoints are internal and external hosts. The protocol list runs up the left side:
When you are running EtherApe, you can really see how noisy a port scan can be. You can also see other surprises, such as people downloading large files, such as music and movies. The lines are larger when the data being moved is larger. The large solar object in the image below is the source of a file download, and the triangular flight-path to the hackbox shows the destination machine:
