is there a free (cheap) SW that can do something?
Wireshark in promiscuous mode (in the capture options dialog) is a good start, I believe. I don't use Windows myself, so can't help much there.
In Linux, I just use a dedicated Ethernet port, bring it up (using
ifconfig), and use
tcpdump to examine all traffic going through that port. Despite its name,
tcpdump can do link-level (Ethernet protocol) stuff, and does promiscuous mode automatically, but requires superuser privileges to do so.
Next step is to fire up
nmap and do a portscan on the device. Because port scanning is frowned upon, it is important (to me, at least) to do this on an otherwise unconnected network. Typically, I'll also have to set up a DHCP server on my machine, to respond to "please give me an IP address" requests by the target device. For that, I typically use
dnsmasq. For some single-board computers and appliances, BOOTP and TFTP servers are also useful.
This is such a common scenario, that the aforementioned utilities are either installed by default, or available via the package manager, in all Linux distributions. (Careful organizations run
nmap portscanners on their own machines, to detect suspicious network activity, for example.)
So, the free tools definitely do exist; it's just that most people who do this kind of stuff tend to eventually migrate to the Unixy side (Linux, mac OS, FreeBSD, OpenBSD) where these tools are widely used and developed; most servers on the net do not run Windows. Some of the software like Wireshark, have been ported to Windows and given a nice user interface, too; but not all.
(Note: I am not saying "X is better than Windows for this". I am only describing why I believe it is somewhat harder to find these tools on Windows than on the other systems, and that it is not that they don't exist, it is that most of the users wanting these kinds of tools tend to drift to other OSes. Even though Tux the penguin is my mascot, I'm no zealot; there is nothing wrong in using Windows – or any other OS – if it works for you.)