Re: comparing sniffer tools (tcpdump, ethereal, etherape, ethercap, drifnet)

From: Robert Nichols (SEE_SIGNATURE_at_localhost.localdomain.invalid)
Date: 05/02/05 

Date: Sun, 1 May 2005 23:53:56 +0000 (UTC)

In article <d53d34$slv$1@antonio.escomposlinux.org>,
Kunael <kunael4@yahoo.es> wrote:
:> I think tcpdump is very useful to have a look at the traffic in
:> real time, but the king of sniffers, if you want to study the
:> traffic deeply is ethereal.
:
:Until the present day, I've used tcpdump and iptraf in my boxes.
:Is possible to run ethereal in a system without X? I hate install de X
:system in a server-machines.

You can run tcpdump to do the capture and save the raw data ("-w"
option), and then use ethereal to display the result. Both ethereal and
tcpdump use libpcap to perform the capture, so there's almost no
difference in capability there. The libpcap file format produced by
tcpdump is also ethereal's native file format. 

-- 
Bob Nichols         AT comcast.net I am "rnichols42"

Relevant Pages

  • Re: packet capture
    ... >Subject: Re: packet capture ... >I agree tcpdump -w somefile is great. ... >format, so you can process it later with tcpdump, snort, ngrep, or ... >Then snort for analyzing the packets (okay tcpdump does this too, ...
    (Security-Basics)
  • Re: No packet loss, just incorrect sequence...
    ... As others have mentioned you should definitely use tcpdump to capture some traffic while downloading something. ... Not only will this clearly diagnose the TCP performance problem but it will irrefutably demonstrate it to your ISP. ...
    (uk.comp.sys.mac)
  • Some problems in capturing traffic with tcpdump at ~ 1 Gbps
    ... hyperthreading and 2 Gbytes RAM size) ... Mbps (we have some traffic samples acquired with tcpdump). ... improvement in the packet capture process. ... With this configuration we can capture 1 Gbyte of traffic, ...
    (comp.os.linux.networking)
  • Re: Network traffic capture, and rotating files with compression
    ... > I am trying to capture traffic on my network - really the Source IP, ... > writing to make it log to file, stop, compress then carry on in a new file. ... First write a script that wraps up the starting and stopping of tcpdump. ...
    (comp.os.linux.networking)
  • Re: [opensuse] why does "tcpdump -i any" not work on opensuse?
    ... tcpdump: verbose output suppressed, use -v or -vv for full protocol decode ... and the capture follows. ... To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx ... For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx ...
    (SuSE)