Slashdot Mirror
What Network Sniffing Tools Do You Use?
network-nose asks: "I work as a Network Administrator in a 500 user manufacturing facility in southeastern Wisconsin. My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software. As of late, we have been having quite a few network problems that can only really be resolved by sniffing packets. I am wondering what tools the rest of you network guys and gals out there use in a corporate environment for analyzing packets. Of course, the more reasonbly priced the better, but I know you usually get what you pay for."
That's it.
and on Windows, never mind.
ethereal, tcpdump
I tend to use tcpdump when I am watching a box using a specific filter and expecting very little traffic, i.e. when I want to know if a certain host is communicating on some arbitrary port or protocol. Ethereal I use when I want to capture tons of data and sift through it later (although you can do this with tcpdump and import it into ethereal as well).
Tcpdump is generally considered the superior learning tool, while ethereal is considered the more refined choice. In other words, ethereal does a lot of the work for you, while you are getting pretty raw stuff when you use tcpdump.
In general, tcpdump and ethereal are the tools of choice if you don't have tons of money to spend. Fancy looking enterprise applications essentially do the same thing as the apps mentioned above -- they just add a nice GUI to the mix.
dmiessler.com -- grep understanding knowledge
I've used Sniffer Pro, Observer Pro, and Ethereal, and I always, ALWAYS prefer Ethereal. It's free, it's open source, and it's hands down the best of the lot. Sniffer Pro may have the pretty gauges and the map that shows what's talking to what (utterly useless, IMHO), and Observer Pro comes with buttloads of tools for things like SNMP configuration and whatnot, but as a sniffer, nothing has ever beated Ethereal in ease of use, capability, or packet decodes.
For your security, this post has been encrypted with ROT-13, twice.
Ethereal! It's a very high-end multi-platform sniffer with numerous features, as well as excellent GUI and command-line interfaces that are a joy to use. It has all the features you'd expect in high-end commercial network sniffers, and it's free!
I made a PHP/MySQL library that prevents SQL injection & makes coding easier!
Two college kids wrote an interesting interpretive packet sniffer called ZAsniffer (I gather the Z and A are from their respective last names).
I found it to be quite nice for monitoring telnet usage and I use it a lot.
Personally I prefer Solaris's snoop. Linux has built in sniffers as well. And they are free (as in GPL).
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
Hands down, Fluke.
http://www.flukenetworks.com/us/default.htm
Alcohol & calculus don't mix. Never drink & derive.
- Ethereal
- hping
- tcpdump
- tcpflow
Ahh, the staples of my diet. What my roommates don't know won't hurt 'em"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
From their website:
Cool Features: Characters injection in an established connection : you can inject character to server (emulating commands) or to client (emulating replies) maintaining the connection alive !!
SSH1 support : you can sniff User and Pass, and even the data of an SSH1 connection. ettercap is the first software capable to sniff an SSH connection in FULL-DUPLEX
HTTPS support : you can sniff http SSL secured data... and even if the connection is made through a PROXY
Remote traffic through GRE tunnel: you can sniff remote traffic through a GRE tunnel from a remote cisco router and make mitm attack on it
PPTP broker: you can perform man in the middle attack against PPTP tunnels
Plug-ins support : You can create your own plugin using the ettercap's API. List of available plugins
Password collector for : TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE, QUAKE 3, MSN, YMSG (other protocols coming soon...)
Paket filtering/dropping: You can set up a filter that search for a particular string (even hex) in the TCP or UDP payload and replace it with yours or drop the entire packet.
OS fingerprint: you can fingerprint the OS of the victim host and even its network adapter
Kill a connection: from the connections list you can kill all the connections you want
Passive scanning of the LAN: you can retrive infos about: hosts in the lan, open ports, services version, type of the host (gateway, router or simple host) and extimated distance in hop.
Check for other poisoners: ettercap has the ability to actively or passively find other poisoners on the LAN
Bind sniffed data to a local port: you can connect to that port with a client and decode unknown portocols or inject data to it (only in arp based mode)
Port Stealing: a new method to sniff on switched LAN without ARP poisoning...
http://ettercap.sourceforge.net/
Activists United
we have been having quite a few network problems that can only really be resolved by sniffing packets.
By "packets" I hope you mean "Ethernet frames". Looking only at layer 3+ information can be useless for many network problems. Anyhow, brain dump:
Do your switches and LAN router(s) have statistic counters (# of frames of various sizes, undersided/oversized frames, flooded frames, deferred frames, etc)?
If you don't have a LAN router for 500 users: why?
What's the most amount of hops (switches) your packets will travel from one end of the LAN to the other? Any more than 3 and you should be putting a LAN router in there (ideally)
Do you have hubs? If so, destroy them all right now. Hubs are pure, unadulterated evil.
My point of that is simple: not all LAN problems are computer problems. Looking at the IP traffic doesn't always cut it. Re: the subject: At my workplace we have a nice LAN meter from Fluke. They aren't cheap but if you have that many users your company should damn well pay for the right tools for you to do your job.
Trolling is a art,
Don't forget the eternally useful.
I was recently clued-in to the existence of Argus.
It's really good for summarizing flow information in quasi-realtime, so it fills the niche of being more detailed than NetFlow, but more big-picture than tcpdump or ethereal.
-------
Create a WAP server
I use tcpdump UNIX-side, and Ethereal Windows-side. Personally? I find Ethereal hard to use, but it gets the job done. I've traced down bugs in OpenBSD TCP stacks with it on my production servers. I've tried half a dozen other packages but they didn't add enough value to make them worth trying to hit my boss up for cash.
To install Ethereal, you will need to download and install the low-level WinPcap driver.
And you may find the Ethereal packet analysis plug-in Packetyzer helpful; sometimes reading raw logs gets a bit annoying.
--LP
While it probably does suit the poster, I have to say for network diagnostics, Sniffer Pro is awesome. With the right network cards, it goes right down to the network layer, pulling out collision stats etc, and can even go and setup your switches for monitoring using rmon.
Got wan problems, Sniffer can work with a Y cable and hardware decoder to watch your WAN.
They even have long term trending and reporting tools. Its maybe the one tool that Network Associates does right.
Ethereal and TCPDump are good for protocol analysis, but most network problems I've delt with are not really at the application layer, but more the pysical layer. (Dodgy Network Cards, Flat network designs with hundreds of hosts, causing your collision rate to go through the roof etc)
The other thing that I like about sniffer, is its made for people that might not have degree's in network analysis. Its got that Expert System. It will throw at you all the errors it finds, and is good enough to tell you what those errors means.
Lastly, The export feature is great. Does my boss want to know what is the biggest talker on the network, Let sniffer run for a few hours, export to excell, and I can give him the top 10/20/50, I can break it down further by protocol or application, and can even tell him who the partners are.
I know there are other tools out there that can do all this, (ntop, ethereal, tcpdump, rrd's) but thats exactly my point. They are different tools, they don't work together, and imho, none of them are true network diagnostic tools.
I'm Ex NAI employee btw, so maybe a bit biased, but I still use Sniffer (legit copies) to this day. There are only a few reasons why I still have a windows drive for my laptop, and Sniffer is no. 1)
dsniff and ethereal. If you're talking windows, just install cygwin and you'll be able to build all your own tools from source. doesn't get cheaper than Free.
FreeBSD for the impatient.
If you just want to see what sort of porn people are perusing (saving you the trouble of hunting for it yourself) EtherPEG is a neat hack.
Seriously? Sniffing is most useful to see where a bunch of traffic is coming from (or going to). But there are a million uses, far too many to list in response to your post. You know it when you need it.
For windows get winpcap
then get ethereal for windows
and get windump
SANS.org has all the info: Packet capture apps
analyzer is a native win32 app that is directly associated with winpcap, the packet capture architecture on which most win32 sniffing-type freeware depends.
What about driftnet?! Who are YOU to point fingers if you don't even mention driftnet?
;)
Ettercap
Steal This Sig
http://www.snort.org/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I use tcpdump on Mac OS X and Linux/Unix, but when I'm at a client site and all I have is my WinXP laptop, Packetyzer is my sniffer of choice. One of my cow-orkers swears by Ethereal, but it's all good.
k.
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
Ethereal to pick up the packets and look at the fine details. But if you need graphs and treds (packets/sec... bytes/sec) source destination... ntop is great.
Plus you can use ethereal for fibrechannel/iscsi as well as traditional networking protocols (tcpip/eth)..
I'm sure you are going to get plenty of responses like 'Snoop', 'Tcpdump', 'Ethereal', etc. The problem is that those tools are sniffers, and you have to perform quite extensive analysis to figure out what's wrong with network, just from the packet trace. Been there, done that.
...). It does some interesting analysis, if you can get it - get it!
A classic 'Sniffer' from Network General (which is currently 'Network Associates' attempts to perform some rudimentary analysis (which is called 'Expert whatever
If you are interested in pin-pointing the reason why some distributed applicaiton doesn't run well on your network, by all means get OPNET Application Doctor. it is fairly expensive tool, but this is probably the best you can get. Used it and love it.
Here's a link.
I haven't used it for a while (College) but it was the most impressive tool I've ever used for Network Sniffing. It's available for pretty much every major platform.
infested with jello like fishes no melotron wishes
I would advise you to get a LanScaper from Test-Um Inc. Retail is $419, shopping on Froogle will save you $70 or so. Anyway, the benefit of this device is that it will tell you all sorts of things about your infrastructure that any OS based tool will not. A defective cable, for instance, might work 80% of the time, maybe even more, but will lead to corrupt data (which is messy when you're dealing with some big database or something). This tool will weed out bad cables and links pretty quick. You can also find out length of runs, do pings, and many many other things. Totally worth its' weight in gold. (Which is about what it costs)
Often in Error, Never in Doubt.
It has something to do with Native Americans and Potlatch dinners and stuff, but to be honest it was years ago when he explained it to me and I was half-drunk at the time and utterly distracted by how stereotypically Linux geek-y he was, with the hair and the beard and the flannel shirt and the GLAVIN! Um... oh yeah, Ethereal is free too.
--All your stolen base are belong to Rickey Henderson
SmokePing, which uses rrdtool as a backend, is a great tool for graphically displaying ping informaiton.
Netsaint is very good for monitoring systems and networks and letting you know ASAP when there's a problem. It can also use rrdtool to generate graphs of packet loss and ping latency.
All of the above are things that will give you current as well as historic information. Current information is good, but historic information is incredibly important. Trending is the obvious thing, allowing you to predict future use to some extent. More importantly, it lets you examine things that happened recently but aren't currently happening, and to see recurring issues.
Recently, our local Internet cooperative was having problems where one of the upstream connections was going into very high packet loss and dropping it's BGP peer. We keep fairly high resolution traffic statistics through ganglia, another rrdtool based network system. That along with the RRD CGI grapher allowed us to create custom graphs of traffic with very high resolution, for days and weeks past, overlaying multiple sources.
Once we did that, it became obvious that every time we ran into these problems, one of our members was hitting the line somewhat hard. It wasn't hard enough that it pegged the line from a bandwidth standpoint, but it apparently was hard enough that it caused some part of the network to experience extremely high packet loss.
That was definitely a case where having the right tool allowed us to track down a fairly hard to see problem. Because our line was not at all saturated, we spent a lot of time looking for things like bad cables, ports with lots of accumulating errors, etc...
Sean
Capsa works awesome for Winblows.
www.colasoft.com/products/capsa
hunt (sniffer, spoofer, ... perhaps more handy in blackhat situations or to sniff ascii services)
tcpdump (simple packet dumper)
netwatch (console tool to monitor connections etc)
ethereal (graphical traffic analyser - pretty easy to use)
snort (IDS, probably better for aimed searching)
These are the programs I have used in the past (and some others like netcat and netgrep, but these probably don't come in handy for what you want to do). Be careful that whatever daemon you run, doesn't get you into trouble - although these are security-programs, they occasionally have security bugs themselves. It would feel stupid to be compromised because of the very program that's supposed to aid in fighting hackers.
Also remember some of these tools can fill up your drives in seconds, if you're not careful. I once had that problem, due to a typo, and it took a few days before I realised. Ofcourse, you miss anything you would want to have logged during that time...
I don't really know any commercial tools. And I don't think I'll ever need one... Unix/Linux systems have lots of net tools, it's probably one of the best represented categories.
Cause its fun!
Red Hat / Fedora packages at Dag's apt repository
The Fluke NetTool does all that plus stuff like it can hook up inbetween a workstation and a switch and tell you why it's not connected (crossover cable instead of a patch cable, wrong subnet, cut wire, etc.)
$1200, but well worth it.
They have an 802.11x version too.
tbdean
I use:
tcpdump, whenever possible.
I grab packets with that, and view them in ethereal.
For debugging application level problems with tcp stuff, sometimes sniffit is more convenient.
Now.. for situations where I don't have a suitable machine in the right place to sniff what I want... and don't want to start re-cabling things... ettercap can be handy, specifically the arp poisoning stuff, so you can sniff traffic off a switched network. Make sure you have clear in your head the ramifications of how it works, though, or you might end up with a bit of a mess.
The best too by far, though, is your own head.. having a really clear idea of what it is you are SUPPOSED to see makes it a lot easier to find out what's wrong.
A comprehensive listing, that has been some years in the making, can be found at Insecure.org.
I found this page, created by the famous and brilliant Fyodor (of nmap fame), to be a truly indispensible resource when I first began to be interested in computer security.
Hope this helps!
-pararox-
backspace :)
I guess I'm oldschool, but I still use tcpdump for most day-to-day things. It's handy, it's fast, and it runs on just about every OS (including Windows (google for windump)). The output is ugly, but once you get used to it, you hardly notice.
:) ), but couldn't/didn't want to install all kinds of GUI tools, etc. This is where tcpdump really shines. You can capture to a binary file and read the file with tcpdump, ethereal, Etherpeek, and many other packages. As long as you can get the file off the machine, you can analyze the data.
:)
When I really need to analyze a stream or set of streams, or I'm going to be staring at packets for more than about 10 minutes, I switch to ethereal. Again, it's free, runs on most OS's (including Windows, again), and the GUI is a little clunky, but quite usable. As several people have mentioned, the capture filter syntax is identical to tcpdump. The display filter syntax is different and I find is a little tricky to get right, so I try to prefilter (or filter with tcpdump beforehand) as much as possible.
One handy feature is the ability to analyze certain types of streams, such as a TCP session (filter out the whole session and see all the data in one window) and SIP (analyze jitter, loss, extract audio session, etc.). It's also open-source, so if it doesn't understand some kind of traffic, you can write your own extension. I haven't had to do this yet, but I know people who have, and it seems easy enough for a compitent programmer.
My employer has a site license for WildPackets Etherpeek (it comes in several versions... I think we have one of the higher-end ones). Frankly, it's prettier than ethereal, but, at least for the debugging I do, provides very little extra functionality. The capture filters are embedded in a GUI which I find makes it hard to see how they're configured.
Etherpeek is pretty and may be easier for novices to use. But I wouldn't waste the money unless it has some quirky feature you just can't live without.
Something to keep in mind: often, the place where you capture packets is not where you'd like to analyze them. For example, I've had situations where I needed to sniff traffic on a remote server -- I had ssh access to the server (and root, of course
There are also handy tools for managing and analyzing tcpdump files, such as tcpslice, which breaks up large dumps by time, date, etc.; there is a tool that "anonomizes" (sp?) packets so that you can analyze streams without violating anyone's privacy (this is largely for academic use, but if, for example, you wanted to do some kind of traffic analysis on your uplink, you could do so without ruffling as many feathers).
Finally, note that tcpdump will sniff on pretty much any interface that supports libpcap. Tools like Etherpeek only talk to certain (ethernet) adapters, for example. Caveat emptor.
Bottom line: pick the right tool for the job
Pikachu is a free JPEG sniffer for windows. It sniffs emails too :)
My vote (as many have also stated) is for Ethereal when you know EXACTLY what you're looking for, or you know HOW to look for what is wrong.
e ts eeker.cfm
However, to understand my network like I've never done before, I've recently gotten my hands on Packeteer's PacketSeeker:
http://www.packeteer.com/prod-sol/products/pack
While Ethereal is free, the PacketSeeker is a commercial product.
You may also be interested in Driftnet
I personally think that snort is one of the top 10-20 most usefull tools to come out of the open source movement and recommend it highly. It, in addition, falls into that mantra of using your resources wisely.
Good luck, and consider asking your company to pay for some classes. Having them equip you with some additional knowledge will end up saving them money in the long run.
More information can be found here.
RandomAndInteresting.comdefending the world from stupidity since 1979
Snort can be used to sniff packets on a only-get-what-you-want level. For the admins like myself who do most of their admining from a remote box, Snort can be very useful. With custom rules, you can configure snort to report packets which have relavence, rather then capturing all packets and looking through afterwards. Hope that helps.
Hi there
Agree with the above. Sniffing will also not get you anywhere if you are trying to see what happening on a https stream as all you'll see is the encrypted traffic.
If you are stuck with IE as a browser for whatever reasons there are two tool comparable to live http headers plugin for Mozilla.
Not tried these payware tools but an excellent free one for Windows is the evergreen "Proxomitron". Beautifully formatted and color-coded HTTP output.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
Ethereal is a really nice application. However, it has it's limits.
c harter. htmli ntwk/i to_doc/rmon.htm
RMON (see RFC 3577) or Remote Monitoring is a set of SNMP MIBs which you allow you to gather traffic information (including packet captures) from network elements itself. You do not need to have a computer to run ethereal, snoop or tcpdump.
The switch/router/probe will collect the info for you, automatically.
Virtually all switches support (mini-)RMON. Furthermore you have (full) RMON probes which you can install at various places in the network.
The flexibility of RMON probes is much larger then ethereal. However, I often use ethereal to look at the packet captured using RMON.
Some info:
http://www.ietf.org/html.charters/rmonmib-
http://www.cisco.com/univercd/cc/td/doc/cis
my 2 cents
Rik
http://www.cs.columbia.edu/~hgs/internet/tools.
iftop - ncurses
iptraf - ncurses
tcpflow - reconstruct into file per tcp conn
ettercap - ncurses, kill conn, drill down on connection, ssh 1 attack, etc
ssldump - http://www.rtfm.com/ssldump/
etherape - graphical view of net
ntop - web based network monitoring
ethereal - GUI - based sniffer, gets all protocols.
mtr - monitor hops
trafshow - nice ncurses sorted list of top bandwith hogs
http://www.mirrors.wiretapped.net/security/networ
2 years and no mod points. Join reddit. Because openness is good.
A very impressive tool is Network Intercept from Sandstorm. http://www.sandstorm.com.
It makes most tools look like looking at a raw byte stream.
All the technology in the world won't hide your lack of vision, talent, or understanding.
A favorite security tools survey was conducted at the Nmap-hackers mailling list. Many of the mentioned tools are listed in order of popularity (with links and a short description)
see http://www.insecure.org/tools.html
Paul
snoopy
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
I use:
:) regexs and the like all good, i love this tool just for its simplicity
:/
ngrep - nice libpcap using tool, network grep
dsniff is good, some interesting things in there,
driftnet is amazing - shows images as they fly by on the network!
ettercap - for those switched network situations - using arp instead
ethereal - usually i use this for browsing pcap dumps but of course its a powerful sniffer in its own right.
CommView is a very nice packet viewer for windows with a complicated ruleset and lots of colour-coding, stats, etc. Alarms, packet searching, dns and also a neat Remote Agent feature. It'll cost ya, but its fun :)
dowload the ISO from here it's got most of the tools mentioned here and you don't even need to install it onto your hard disk. It runs a full Linux system from CD.
^H (ctrl+H) is backspace typically used while working with UNIX. ^W (ctrl+W) is used to delete the previous word.
120 chars of filth!
Sorry for the shameless plug but I find ipaudit and ipstrings useful. Available from sourceforge.
ipaudit similar to netflow, it summarizes network traffic byte count for every host pair, protocol, and port pair.ipstrings reads string data off the wire similar to unix utility strings. It's included in the ipaudit package.
What SysAdmin worth his/her salt hasn't heard of and used Ethereal, or can't use GOOGLE to find something similar? Man, I must be getting bitter and cynical in my old age. Or maybe I just don't like idiots. I should start posting as an AC.
No wonder companies are outsourcing techs.
Snort as a recommendation is a rather good pun but, as a network sniffer (packet capture/protocol analyzer) Snort is not the answer.
Snort is an Intrusion Detection System(IDS) that monitors network traffic and performs an action when it sees a matching pattern. That action could be a log entry or it might be configured to save the packet to a file. Other actions are possible using external programs. Snort uses libpcap of TCPDump fame to monitor or capture the network traffic. Snort is useless for displaying or analyzing network traffic but, this is not a function that it was designed for.
Ethereal is a graphical protocol analyzer although it does include a command line version as well called Tethereal. Ethereal also relies on libpcap for actually capturing the network packets but, it goes much further than simply capturing network packets. Ethereal displays a break down of the packets themselves separating categorizing and displaying the various fields and data in a packet. It goes further by also decoding a long list of higher level protocols that may be included in the packet.
Ethereal is also capable of reading and decoding network traffic that has been captured and saved in other formats. Ethereal can read and save packet capture files in MS Network Monitor, NAI Sniffer Pro, and many other formats. Ethereal is increasingly recommended by companies such as Novell who actually has had their own protocol analyzer for years called Lanalyzer. Cisco support engineers are also increasingly recommending the use of Ethereal for capture and analysis of network traffic when troubleshooting potential problems with their equipment.
TCPDump has also been recommended by many people here on Slashdot.. TCPDump is a command line based protocol analyzer. It also relies on libpcap for actual packet capture but, it then displays a break down of the actual packets. Its display is not as attractive or as configurable as the graphical Ethereal and it is more limited in the number of protocols that it can interpret and disassemble but, it is still a very powerful and capable program. Further more, its output can be saved for further examination by ethereal.
**or** if you are doing application development that in any way uses TCP/IP. It is extremely useful to be able to see what you are actually sending out over the wire vs. what you *think* you are sending out.
Buy one linux server, and then discover the wonders that are ping and SNMP. Simple tools such as Nagios and MRTG (or NRG or Cricket) can do wonders for helping spot problem switches/routers and congestion spots.
For example, every device we have is pinged 3 times every minute, and queried for bandwidth usage every 5 minutes. This has helped in finding bottlenecks, and the occasional switch that reboots every few minutes. (MRTG alone convinced the higher ups to buy new gear for our Datacenter and give it a dedicated link to the Core).
Also, setting up a wonderful SNMP trap server can be very useful. It allowed us to find a switch that likes to reboot at random intervals (the switch is 5 years old and being replaced this weekend). Of course, having it send a trap whenever a switch reboots is just the start of what certain switches/routers can do.
Also the use of Snort to sniff traffic that can be potentially malicious can be very helpful in tuning firewalls and finding those script kiddies. (use ACID for a pretty front end)
Another nice tool is NTOP Does almost everything NetFlow does and has a pretty graphical frontend built in. (I recently used this to find out that one of our firewalls was sending gigs of syslog data to the wrong server.)
And with the mention of syslog, might as well throw out a link for syslog-ng. yet another useful tool.
Basically the point of this is to say that sometimes it's best to let your equipment do that talking. They'll usually tell you what's wrong, just as long as you've set them up to do so. I found that once we put a lot of these tools into full production, we were able to cut down on our need to sniff the line whenever problems came up. This isn't to say that Ethereal isn't needed. That's hardly the case. Its use is still huge and shown all the time.