Packet analyzer: Difference between revisions
| Line 43: | Line 43: | ||
*[[Network Instruments]] Observer |
*[[Network Instruments]] Observer |
||
*[[OPNET |OPNET Technologies]] ACE Analyst |
*[[OPNET |OPNET Technologies]] ACE Analyst |
||
*[http://www.packeteditor.com PacketEditor] |
|||
*[[SkyGrabber]] |
*[[SkyGrabber]] |
||
*WildPackets [[OmniPeek]] (old name AiroPeek, EtherPeek) |
*WildPackets [[OmniPeek]] (old name AiroPeek, EtherPeek) |
||
Revision as of 23:20, 11 August 2010
 | This article needs additional citations for verification. (November 2008) |
A packet analyzer (also known as a network analyzer, protocol analyzer or sniffer, or for particular types of networks, an Ethernet sniffer or wireless sniffer) is computer software or computer hardware that can intercept and log traffic passing over a digital network or part of a network.[1] As data streams flow across the network, the sniffer captures each packet and, if needed, decodes and analyzes its content according to the appropriate RFC or other specifications.
Capabilities
On wired broadcast LANs, depending on the network structure (hub or switch), one can capture traffic on all or just parts of the network from a single machine within the network; however, there are some methods to avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g. ARP spoofing). For network monitoring purposes it may also be desirable to monitor all data packets in a LAN by using a network switch with a so-called monitoring port, whose purpose is to mirror all packets passing through all ports of the switch when systems (computers) are connected to a switch port.
On wireless LANs, one can capture traffic on a particular channel.
On wired broadcast and wireless LANs, to capture traffic other than unicast traffic sent to the machine running the sniffer software, multicast traffic sent to a multicast group to which that machine is listening, and broadcast traffic, the network adapter being used to capture the traffic must be put into promiscuous mode; some sniffers support this, others don't. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the service set for which the adapter is configured will usually be ignored. To see those packets, the adapter must be in monitor mode.
Uses
The versatility of packet sniffers means they can be used to:
- Analyze network problems
- Detect network intrusion attempts
- Gain information for effecting a network intrusion
- Monitor network usage
- Gather and report network statistics
- Filter suspect content from network traffic
- Spy on other network users and collect sensitive information such as passwords (depending on any content encryption methods which may be in use)
- Reverse engineer proprietary protocols used over the network
- Debug client/server communications
- Debug network protocol implementations
Notable freeware packet analyzers
- Capsa Free
- Cain and Abel
- dSniff
- ettercap
- Microsoft Network Monitor
- ngrep Network Grep
- snoop
- tcpdump
- wireshark(formerly known as Ethereal)
Notable commercial packet analyzers
- Capsa Enterprise
- Carnivore
- Clarified Analyzer
- Fluke Lanmeter
- NetScout Sniffer Global Analyzer
- NetScout Sniffer Portable Professional Analyzer
- Network Instruments Observer
- OPNET Technologies ACE Analyst
- PacketEditor
- SkyGrabber
- WildPackets OmniPeek (old name AiroPeek, EtherPeek)
See also
- Lanmeter
- Logic analyzer
- Network detector
- Network Security Toolkit
- Network tap
- Packet generation model
- Packet capture
References
- ^ Kevin J. Connolly (2003). Law of Internet Security and Privacy. Aspen Publishers. p. 131. ISBN 978-0735542730.
External links
- How-to Packet Sniff
- The Making of a Professional cTrace Packet Analyzer
- Packet Sniffing FAQ by Robert Graham
- Video Tutorials on Sniffer Programming using Raw Sockets
- A Quick Intro to Sniffers
- Multi-Tap Network Packet Capture
- How to Deploy a Packet Analyzer under Different Network Environment
- The best of Top Ten Packet Sniffer 2010