Slashdot Mirror
What Network Sniffing Tools Do You Use?
network-nose asks: "I work as a Network Administrator in a 500 user manufacturing facility in southeastern Wisconsin. My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software. As of late, we have been having quite a few network problems that can only really be resolved by sniffing packets. I am wondering what tools the rest of you network guys and gals out there use in a corporate environment for analyzing packets. Of course, the more reasonbly priced the better, but I know you usually get what you pay for."
That's it.
and on Windows, never mind.
ethereal, tcpdump
My job is to keep the company running as close to 100% of the time as possible while trying not to spend any money on up to date hardware and software
Are you trying to steal my job?I tend to use tcpdump when I am watching a box using a specific filter and expecting very little traffic, i.e. when I want to know if a certain host is communicating on some arbitrary port or protocol. Ethereal I use when I want to capture tons of data and sift through it later (although you can do this with tcpdump and import it into ethereal as well).
Tcpdump is generally considered the superior learning tool, while ethereal is considered the more refined choice. In other words, ethereal does a lot of the work for you, while you are getting pretty raw stuff when you use tcpdump.
In general, tcpdump and ethereal are the tools of choice if you don't have tons of money to spend. Fancy looking enterprise applications essentially do the same thing as the apps mentioned above -- they just add a nice GUI to the mix.
dmiessler.com -- grep understanding knowledge
I've used Sniffer Pro, Observer Pro, and Ethereal, and I always, ALWAYS prefer Ethereal. It's free, it's open source, and it's hands down the best of the lot. Sniffer Pro may have the pretty gauges and the map that shows what's talking to what (utterly useless, IMHO), and Observer Pro comes with buttloads of tools for things like SNMP configuration and whatnot, but as a sniffer, nothing has ever beated Ethereal in ease of use, capability, or packet decodes.
For your security, this post has been encrypted with ROT-13, twice.
Ethereal! It's a very high-end multi-platform sniffer with numerous features, as well as excellent GUI and command-line interfaces that are a joy to use. It has all the features you'd expect in high-end commercial network sniffers, and it's free!
I made a PHP/MySQL library that prevents SQL injection & makes coding easier!
Two college kids wrote an interesting interpretive packet sniffer called ZAsniffer (I gather the Z and A are from their respective last names).
I found it to be quite nice for monitoring telnet usage and I use it a lot.
Personally I prefer Solaris's snoop. Linux has built in sniffers as well. And they are free (as in GPL).
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
What kinds of problems can only be figured out by sniffing packets? Rogue programs? Unauthorized porn downloads? Illegal P2P activity?
On a properly configured network, where are the points of failure that can't be figured out with any other method besides packet sniffing? If these problems exist, would it be worthwhile to incorporate functionality directly into the networking software to watch for these problems and fix them automatically?
I have been pwned because my
Hands down, Fluke.
http://www.flukenetworks.com/us/default.htm
Alcohol & calculus don't mix. Never drink & derive.
- Ethereal
- hping
- tcpdump
- tcpflow
Ahh, the staples of my diet. What my roommates don't know won't hurt 'em"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
.....an Oscilliscope. Read the bits off the wire. You'd be suprised what an Oscilliscope in the hands of a VERY well trained person can accomplish.
From their website:
Cool Features: Characters injection in an established connection : you can inject character to server (emulating commands) or to client (emulating replies) maintaining the connection alive !!
SSH1 support : you can sniff User and Pass, and even the data of an SSH1 connection. ettercap is the first software capable to sniff an SSH connection in FULL-DUPLEX
HTTPS support : you can sniff http SSL secured data... and even if the connection is made through a PROXY
Remote traffic through GRE tunnel: you can sniff remote traffic through a GRE tunnel from a remote cisco router and make mitm attack on it
PPTP broker: you can perform man in the middle attack against PPTP tunnels
Plug-ins support : You can create your own plugin using the ettercap's API. List of available plugins
Password collector for : TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE, QUAKE 3, MSN, YMSG (other protocols coming soon...)
Paket filtering/dropping: You can set up a filter that search for a particular string (even hex) in the TCP or UDP payload and replace it with yours or drop the entire packet.
OS fingerprint: you can fingerprint the OS of the victim host and even its network adapter
Kill a connection: from the connections list you can kill all the connections you want
Passive scanning of the LAN: you can retrive infos about: hosts in the lan, open ports, services version, type of the host (gateway, router or simple host) and extimated distance in hop.
Check for other poisoners: ettercap has the ability to actively or passively find other poisoners on the LAN
Bind sniffed data to a local port: you can connect to that port with a client and decode unknown portocols or inject data to it (only in arp based mode)
Port Stealing: a new method to sniff on switched LAN without ARP poisoning...
http://ettercap.sourceforge.net/
Activists United
we have been having quite a few network problems that can only really be resolved by sniffing packets.
By "packets" I hope you mean "Ethernet frames". Looking only at layer 3+ information can be useless for many network problems. Anyhow, brain dump:
Do your switches and LAN router(s) have statistic counters (# of frames of various sizes, undersided/oversized frames, flooded frames, deferred frames, etc)?
If you don't have a LAN router for 500 users: why?
What's the most amount of hops (switches) your packets will travel from one end of the LAN to the other? Any more than 3 and you should be putting a LAN router in there (ideally)
Do you have hubs? If so, destroy them all right now. Hubs are pure, unadulterated evil.
My point of that is simple: not all LAN problems are computer problems. Looking at the IP traffic doesn't always cut it. Re: the subject: At my workplace we have a nice LAN meter from Fluke. They aren't cheap but if you have that many users your company should damn well pay for the right tools for you to do your job.
Trolling is a art,
Like everybody else has said, you have those two, you're covered.
However, I find myself frequently using tcpdump to capture data, then downloading it and analyzing it in Ethereal on my workstation later.
tcpdump -w myfile.dump -s 2000
Of course, the more reasonbly priced the better, but I know you usually get what you pay for.
This is Slashdot, you'll lose an eye here faster than you will in a barfight for saying that free (beer and speech) GNU/Linux isn't better than costly (money and your soul) Windows!
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Don't forget the eternally useful.
I was recently clued-in to the existence of Argus.
It's really good for summarizing flow information in quasi-realtime, so it fills the niche of being more detailed than NetFlow, but more big-picture than tcpdump or ethereal.
As of late, we have been having quite a few network problems that can only really be resolved by sniffing packets.
What kind of problems are you talking about? On ethernet level? On IP level? On application level?
They all have different approaches, and all have different tools.
bash$
-------
Create a WAP server
I use tcpdump UNIX-side, and Ethereal Windows-side. Personally? I find Ethereal hard to use, but it gets the job done. I've traced down bugs in OpenBSD TCP stacks with it on my production servers. I've tried half a dozen other packages but they didn't add enough value to make them worth trying to hit my boss up for cash.
To install Ethereal, you will need to download and install the low-level WinPcap driver.
And you may find the Ethereal packet analysis plug-in Packetyzer helpful; sometimes reading raw logs gets a bit annoying.
--LP
I sniff with Olfactory 1.0.
Karma: -2147483648 (Mostly affected by integer overflow)
While it probably does suit the poster, I have to say for network diagnostics, Sniffer Pro is awesome. With the right network cards, it goes right down to the network layer, pulling out collision stats etc, and can even go and setup your switches for monitoring using rmon.
Got wan problems, Sniffer can work with a Y cable and hardware decoder to watch your WAN.
They even have long term trending and reporting tools. Its maybe the one tool that Network Associates does right.
Ethereal and TCPDump are good for protocol analysis, but most network problems I've delt with are not really at the application layer, but more the pysical layer. (Dodgy Network Cards, Flat network designs with hundreds of hosts, causing your collision rate to go through the roof etc)
The other thing that I like about sniffer, is its made for people that might not have degree's in network analysis. Its got that Expert System. It will throw at you all the errors it finds, and is good enough to tell you what those errors means.
Lastly, The export feature is great. Does my boss want to know what is the biggest talker on the network, Let sniffer run for a few hours, export to excell, and I can give him the top 10/20/50, I can break it down further by protocol or application, and can even tell him who the partners are.
I know there are other tools out there that can do all this, (ntop, ethereal, tcpdump, rrd's) but thats exactly my point. They are different tools, they don't work together, and imho, none of them are true network diagnostic tools.
I'm Ex NAI employee btw, so maybe a bit biased, but I still use Sniffer (legit copies) to this day. There are only a few reasons why I still have a windows drive for my laptop, and Sniffer is no. 1)
dsniff and ethereal. If you're talking windows, just install cygwin and you'll be able to build all your own tools from source. doesn't get cheaper than Free.
FreeBSD for the impatient.
One of the common network administration problems that software tools aren't very good at is finding where wires go when they're behind furniture or walls. Wires are pretty much like string, and my cats like to chase string, so I send them out to chase the wires, listen for the thumping noises, and see where the cat comes out. Doesn't work every time, and sometimes they'd rather chase mice than wires, but one of my cats really like chomping on RJ45 jacks, so if I suspect that a problem is related to an unplugged RJ45, he's the one for the job.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
For windows get winpcap
then get ethereal for windows
and get windump
SANS.org has all the info: Packet capture apps
analyzer is a native win32 app that is directly associated with winpcap, the packet capture architecture on which most win32 sniffing-type freeware depends.
What about driftnet?! Who are YOU to point fingers if you don't even mention driftnet?
;)
User EtherApe on Linux - very cool graphics and allows you to focus on who's loading LAN segments (put it onto the monitor port on your switch). And Ethereal as many have mentioned on both Windows and Linux. I use Ethereal for everything from finding what spyware is trying to do through to trapping inconsistent content from a server farm to working out what ciphers SSL is negotiating through to looking at what DNS replies I'm getting. I'd be lost without it.
Ettercap
Steal This Sig
http://www.snort.org/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I use tcpdump on Mac OS X and Linux/Unix, but when I'm at a client site and all I have is my WinXP laptop, Packetyzer is my sniffer of choice. One of my cow-orkers swears by Ethereal, but it's all good.
k.
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
Ethereal to pick up the packets and look at the fine details. But if you need graphs and treds (packets/sec... bytes/sec) source destination... ntop is great.
Plus you can use ethereal for fibrechannel/iscsi as well as traditional networking protocols (tcpip/eth)..
My nose is indispensable OTJ. If a network card stops working, or is flaky I simply pop it out and smell for burned silicon.
I found it works with routers, switches, hubs and servers too.
Funny you mention EtherPeek. I worked for that company (who was in my little hometown) back when they were still Ag Group. Last I heard they became WildPackets!. (Exclamation is part of the name). EtherPeek was some slick software, but yeah cost some $$ if you didnt get a free key from them =)
I'm sure you are going to get plenty of responses like 'Snoop', 'Tcpdump', 'Ethereal', etc. The problem is that those tools are sniffers, and you have to perform quite extensive analysis to figure out what's wrong with network, just from the packet trace. Been there, done that.
...). It does some interesting analysis, if you can get it - get it!
A classic 'Sniffer' from Network General (which is currently 'Network Associates' attempts to perform some rudimentary analysis (which is called 'Expert whatever
If you are interested in pin-pointing the reason why some distributed applicaiton doesn't run well on your network, by all means get OPNET Application Doctor. it is fairly expensive tool, but this is probably the best you can get. Used it and love it.
Well I use my own special homemade Network sniffer, let me explain it, its a BIG Rubber nose on a BIG Stick with cat 5 hanging out the nostrils. It works GREAT Walk into someones office with that and they start rambling about all the programs they are running , have run, could run, and want to run, MOST likley out of fear of what you are going to do with the rubber nose on the stick, or maybe just because they are scared someone actually spent the time and built it.
EtherPEG works by capturing unencrypted TCP packets off your local network, collecting packets into groups based on TCP connection (determined from source IP address, destination IP address, source TCP port and destination TCP port), reassembling those packets into order based on TCP sequence number, and then scanning the resulting data for byte sequences that suggest the presence of JPEG or GIF data.
Or in other words, fire it up, plug in a data projector and watch everyone's porn. Interesting side-effect: It makes (most) people a lot more careful what they browse if they know the results will be displayed for everyone's amusement. Mercifully, it's also a lot less likely these days to see The Goatse flying across the screen.
Do you or your partner snore? - Visit www.snoring.com.au
Here's a link.
I haven't used it for a while (College) but it was the most impressive tool I've ever used for Network Sniffing. It's available for pretty much every major platform.
infested with jello like fishes no melotron wishes
I would advise you to get a LanScaper from Test-Um Inc. Retail is $419, shopping on Froogle will save you $70 or so. Anyway, the benefit of this device is that it will tell you all sorts of things about your infrastructure that any OS based tool will not. A defective cable, for instance, might work 80% of the time, maybe even more, but will lead to corrupt data (which is messy when you're dealing with some big database or something). This tool will weed out bad cables and links pretty quick. You can also find out length of runs, do pings, and many many other things. Totally worth its' weight in gold. (Which is about what it costs)
Often in Error, Never in Doubt.
SmokePing, which uses rrdtool as a backend, is a great tool for graphically displaying ping informaiton.
Netsaint is very good for monitoring systems and networks and letting you know ASAP when there's a problem. It can also use rrdtool to generate graphs of packet loss and ping latency.
All of the above are things that will give you current as well as historic information. Current information is good, but historic information is incredibly important. Trending is the obvious thing, allowing you to predict future use to some extent. More importantly, it lets you examine things that happened recently but aren't currently happening, and to see recurring issues.
Recently, our local Internet cooperative was having problems where one of the upstream connections was going into very high packet loss and dropping it's BGP peer. We keep fairly high resolution traffic statistics through ganglia, another rrdtool based network system. That along with the RRD CGI grapher allowed us to create custom graphs of traffic with very high resolution, for days and weeks past, overlaying multiple sources.
Once we did that, it became obvious that every time we ran into these problems, one of our members was hitting the line somewhat hard. It wasn't hard enough that it pegged the line from a bandwidth standpoint, but it apparently was hard enough that it caused some part of the network to experience extremely high packet loss.
That was definitely a case where having the right tool allowed us to track down a fairly hard to see problem. Because our line was not at all saturated, we spent a lot of time looking for things like bad cables, ports with lots of accumulating errors, etc...
Sean
hunt (sniffer, spoofer, ... perhaps more handy in blackhat situations or to sniff ascii services)
tcpdump (simple packet dumper)
netwatch (console tool to monitor connections etc)
ethereal (graphical traffic analyser - pretty easy to use)
snort (IDS, probably better for aimed searching)
These are the programs I have used in the past (and some others like netcat and netgrep, but these probably don't come in handy for what you want to do). Be careful that whatever daemon you run, doesn't get you into trouble - although these are security-programs, they occasionally have security bugs themselves. It would feel stupid to be compromised because of the very program that's supposed to aid in fighting hackers.
Also remember some of these tools can fill up your drives in seconds, if you're not careful. I once had that problem, due to a typo, and it took a few days before I realised. Ofcourse, you miss anything you would want to have logged during that time...
I don't really know any commercial tools. And I don't think I'll ever need one... Unix/Linux systems have lots of net tools, it's probably one of the best represented categories.
Cause its fun!
Red Hat / Fedora packages at Dag's apt repository
The Fluke NetTool does all that plus stuff like it can hook up inbetween a workstation and a switch and tell you why it's not connected (crossover cable instead of a patch cable, wrong subnet, cut wire, etc.)
$1200, but well worth it.
They have an 802.11x version too.
tbdean
The thing is, there are tons of network applications that fulfill usefully different roles:
Users range from single computers connected to a congested cable modem, to five-nines uptime network admins who maintain multiple datacenters around the world, so there's a wide range of complexity that different apps need to fill.
Add to that user preferences about specific OS's, licenses, languages, etc. they like to use, and you can spend days searching for just the right network app for your specific need.
I use:
tcpdump, whenever possible.
I grab packets with that, and view them in ethereal.
For debugging application level problems with tcp stuff, sometimes sniffit is more convenient.
Now.. for situations where I don't have a suitable machine in the right place to sniff what I want... and don't want to start re-cabling things... ettercap can be handy, specifically the arp poisoning stuff, so you can sniff traffic off a switched network. Make sure you have clear in your head the ramifications of how it works, though, or you might end up with a bit of a mess.
The best too by far, though, is your own head.. having a really clear idea of what it is you are SUPPOSED to see makes it a lot easier to find out what's wrong.
A comprehensive listing, that has been some years in the making, can be found at Insecure.org.
I found this page, created by the famous and brilliant Fyodor (of nmap fame), to be a truly indispensible resource when I first began to be interested in computer security.
Hope this helps!
-pararox-
Are you THAT fucking stupid? How long have you been a "network administrator"? Which part of Google and basic documentation do you not understand?
I don't mean to flame, but...
Are you THAT fucking stupid? How long have you been a "member of society"? Which part of consulting your peers do you not understand?
Just so that this isn't a total flame:
The fact that the submitter said nothing about Ethereal and the like doesn't mean he's unaware of them; he may just be wondering what other options are available. Or even if he is unaware, maybe he got drafted into the job by a PHB, and he's honestly trying to get more information. Yes, he could use Google, but asking people with experience is undeniably a more direct route to getting answers. Many people will answer such questions willingly. If you don't want to be bothered by them, then for crying out loud, just ignore them. There's no call for insults.
Also try reading this comment, and be enlightened. "He who knows not and knows that he knows not; he is ignorant, teach him."
For the record, I use tcpdump.
Of course, the more reasonbly priced the better, but I know you usually get what you pay for.
Right, since our FREE (as in beer) Operating System doesn't hold a candle to those other OS's that actually cost money, and stuff, right?
I've seen packet sniffers that cost upwards of $10k on a proprietary box that you couldn't change the ethernet cards out of else it would break the configuration. But a $250 linux box running ettercap (or any of the other tools mentioned here) would have performed just as well, if not better.
You should know better than to equate cost with goodness around these parts, stranger.
GIR: I'm going to sing the Doom song now. Doom doom doom doom doom doom de-doom doom doom doom doom doom doom...
Actually, you sound like a kid who just got a job at a company who has 500+ employees, and wants to sniff their traffic.
:)
:) tethereal is great too (comes with Ethereal). tcpdump is the grand-daddy of all packet sniffers, so it's kinda handy to know how to use it.
:)
You'll learn and get caught. But who am I to stop you from a life experience.
ethereal is great. It's proven to be lots of fun.
For wireless, I use Wellenreiter and Kismet.
Sitting in a major Las Vegas hotel, only a few floors up from the casino, I turned on my laptop, hoping to find an access point I could get online with (damned hotel didn't provide Internet access). I heard two AP's, and caught a couple IP's going by. I assigned myself an IP which appeared to not be used, and fired up ethereal.
I saw text for several of the casino machines going by. It was the text to be updated to the displays, including windows paths to where the files originated from (I believe). It was all in plain text. I noted down what I saw for a few minutes, shut down the laptop, and proceeded to lose for the rest of the night in the casino. Hey, that's what Vegas is for, right?
After I got home, I dug around for something resembling an admin contact at the casino, and advised him of what I saw. It would have probably been pretty easy to push my own updates to the machines. What would I say though?
"Gambing is an addiction, quit now."
"This game is rigged, move on."
"This is the droid you are looking for."
"With a 97% chance of losing, did you really want to play this game?"
or, I guess
"I'm a spiffy keen elite haxor type person, props to my homeyz" haha
Serious? Seriousness is well above my pay grade.
I used Ethereal for a while, sniffing simple HTTP traffic, sorting out cookie issues and so on (I'm not a netadmin -- mostly web app development)... and it was darned handy.
/. headers are entertaining]
Of course, when I found the live http headers plugin for Mozilla it was exactly what I needed -- just the headers, scrolling by realtime, and no more sniffing needed.
Yeah, this is slightly OT (which may be good in a discussion that seems to be a long string of ethereal links, all +5) -- but I wanted to point out to those people out there who think they "need a sniffer" -- unless you're a network admin, you probably don't.
[Plus the Futurama quotes in the
There are only 10 types of people: those who understand decimal, those who don't, and, uh, 8 other types I forget.
backspace :)
^H is geek for "I can't configut^Hre my terminal correctly"
I guess I'm oldschool, but I still use tcpdump for most day-to-day things. It's handy, it's fast, and it runs on just about every OS (including Windows (google for windump)). The output is ugly, but once you get used to it, you hardly notice.
:) ), but couldn't/didn't want to install all kinds of GUI tools, etc. This is where tcpdump really shines. You can capture to a binary file and read the file with tcpdump, ethereal, Etherpeek, and many other packages. As long as you can get the file off the machine, you can analyze the data.
:)
When I really need to analyze a stream or set of streams, or I'm going to be staring at packets for more than about 10 minutes, I switch to ethereal. Again, it's free, runs on most OS's (including Windows, again), and the GUI is a little clunky, but quite usable. As several people have mentioned, the capture filter syntax is identical to tcpdump. The display filter syntax is different and I find is a little tricky to get right, so I try to prefilter (or filter with tcpdump beforehand) as much as possible.
One handy feature is the ability to analyze certain types of streams, such as a TCP session (filter out the whole session and see all the data in one window) and SIP (analyze jitter, loss, extract audio session, etc.). It's also open-source, so if it doesn't understand some kind of traffic, you can write your own extension. I haven't had to do this yet, but I know people who have, and it seems easy enough for a compitent programmer.
My employer has a site license for WildPackets Etherpeek (it comes in several versions... I think we have one of the higher-end ones). Frankly, it's prettier than ethereal, but, at least for the debugging I do, provides very little extra functionality. The capture filters are embedded in a GUI which I find makes it hard to see how they're configured.
Etherpeek is pretty and may be easier for novices to use. But I wouldn't waste the money unless it has some quirky feature you just can't live without.
Something to keep in mind: often, the place where you capture packets is not where you'd like to analyze them. For example, I've had situations where I needed to sniff traffic on a remote server -- I had ssh access to the server (and root, of course
There are also handy tools for managing and analyzing tcpdump files, such as tcpslice, which breaks up large dumps by time, date, etc.; there is a tool that "anonomizes" (sp?) packets so that you can analyze streams without violating anyone's privacy (this is largely for academic use, but if, for example, you wanted to do some kind of traffic analysis on your uplink, you could do so without ruffling as many feathers).
Finally, note that tcpdump will sniff on pretty much any interface that supports libpcap. Tools like Etherpeek only talk to certain (ethernet) adapters, for example. Caveat emptor.
Bottom line: pick the right tool for the job
Hubs are not pure unadulterated evil. They have one use that is unmatched by other ethernet switching devices. That is, seeing every damned packet crossing a given segment. If you want to be able to snoop on *all* the traffic on a segment then you can't rely on a switch because it's keeping you from all the stuff not directed to your host. So if you're feeling snoopy, you want a hub.
Now, in real life where people don't have a need to snoop, switches are a big win. But my home network sure as hell uses a hub. I don't care if it slows down one or two machines, I want to make sure I can see all the traffic there is, whether it's hitting the router or not.
(Actually, my Nortel is a layer 3 (and 4 sorta) switch so it's not really a hub and I can configure any arbitrary port to receive traffic from all the others. So I lied a little. But if I didn't have my studly switch then I'd be using a hub. Because I'm suspicious.)
You may also be interested in Driftnet
I personally think that snort is one of the top 10-20 most usefull tools to come out of the open source movement and recommend it highly. It, in addition, falls into that mantra of using your resources wisely.
Good luck, and consider asking your company to pay for some classes. Having them equip you with some additional knowledge will end up saving them money in the long run.
More information can be found here.
RandomAndInteresting.comdefending the world from stupidity since 1979
Snort can be used to sniff packets on a only-get-what-you-want level. For the admins like myself who do most of their admining from a remote box, Snort can be very useful. With custom rules, you can configure snort to report packets which have relavence, rather then capturing all packets and looking through afterwards. Hope that helps.
Hi there
What a stupid thing to say, on Slashdot of all places!
Ethereal is a really nice application. However, it has it's limits.
c harter. htmli ntwk/i to_doc/rmon.htm
RMON (see RFC 3577) or Remote Monitoring is a set of SNMP MIBs which you allow you to gather traffic information (including packet captures) from network elements itself. You do not need to have a computer to run ethereal, snoop or tcpdump.
The switch/router/probe will collect the info for you, automatically.
Virtually all switches support (mini-)RMON. Furthermore you have (full) RMON probes which you can install at various places in the network.
The flexibility of RMON probes is much larger then ethereal. However, I often use ethereal to look at the packet captured using RMON.
Some info:
http://www.ietf.org/html.charters/rmonmib-
http://www.cisco.com/univercd/cc/td/doc/cis
my 2 cents
Rik
http://www.cs.columbia.edu/~hgs/internet/tools.
iftop - ncurses
iptraf - ncurses
tcpflow - reconstruct into file per tcp conn
ettercap - ncurses, kill conn, drill down on connection, ssh 1 attack, etc
ssldump - http://www.rtfm.com/ssldump/
etherape - graphical view of net
ntop - web based network monitoring
ethereal - GUI - based sniffer, gets all protocols.
mtr - monitor hops
trafshow - nice ncurses sorted list of top bandwith hogs
http://www.mirrors.wiretapped.net/security/networ
2 years and no mod points. Join reddit. Because openness is good.
A very impressive tool is Network Intercept from Sandstorm. http://www.sandstorm.com.
It makes most tools look like looking at a raw byte stream.
All the technology in the world won't hide your lack of vision, talent, or understanding.
A favorite security tools survey was conducted at the Nmap-hackers mailling list. Many of the mentioned tools are listed in order of popularity (with links and a short description)
see http://www.insecure.org/tools.html
Paul
snoopy
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
I use:
:) regexs and the like all good, i love this tool just for its simplicity
:/
ngrep - nice libpcap using tool, network grep
dsniff is good, some interesting things in there,
driftnet is amazing - shows images as they fly by on the network!
ettercap - for those switched network situations - using arp instead
ethereal - usually i use this for browsing pcap dumps but of course its a powerful sniffer in its own right.
CommView is a very nice packet viewer for windows with a complicated ruleset and lots of colour-coding, stats, etc. Alarms, packet searching, dns and also a neat Remote Agent feature. It'll cost ya, but its fun :)
for normal (short) analyse I use ```tcpdump'', or ``netstat -I $INTERFACE 1''* to see, who's gonna make traffic (and slows down my ssh connection
For long distance analysing and for raliable traffic data is use nitpicker.
Under windows i would use etherape to analyse packets... it uses pcap under windows, same as tcpdump, and so its okay :)
Greetings
Mirko
* your `uname -s' should look like this:
I won't list any other tools I use, as they've all been mentioned lots of times, but I will add to the list tethereal, which is the command-line version of ethereal.
;-)
Two very important general notes about analyzing the network, though. First you should know at least somewhat what your network looks like under normal circumstances. I can't tell you how many times I've beeen at a new organization looking at the network for strangeness and seen a long list of errors that some net admin saw and said "yeah, that's a misconfigured m$ box, haven't fixed it yet...yeah, that's a broken printer...yeah...". It helps if you know this stuff ahead of time.
Second, switching's a pain when it comes to network sniffing. The best tool in the world can't help you if the packet never gets to you. Make sure you know the layout of the network in question very well before you try looking for problems, and make sure you're either tapping as necessary or in the right spot to monitor. There are a number of tools that can just jump on a random switched port and sniff, but they often use dicey methods for dealing with the switch (arp poisoning, flooding, etc.) that you don't necessarily want to mess with if you're already having network issues. And if you're not, arp-flooding a switch or poisoning one of your production servers is a great way to cause some!
I'll end with the obligatory war-story in response to a post I read that said (paraphrasing) "What would you need this kind of analysis for?" I had to troubleshoot a weird network problem that seemed to be network-wide (in this case, 3 buildings, total of about 30 switches; not too large). Symptoms were that a host would fail to start talking to another host about 1/2 the time, but once it did start, it was fine (for a while). Turns out that there was a busted switche that was bit-flipping and mangling the MAC address in the response. Thing was, we were using HP's with meshing turned on (I hate this feature; much prefer good old spanning-tee and, if you need, trunking) which black-box combines multiple uplinks between switches so you *NEVER* know what path a piece of data is taking. Hence, the only erroring out about 1/2 the time and working once it did go through (arp cache), and hence us having a real hard time figuring out which was the broken switch.
Ethereal was my friend that day. Had to run it in multiple spots though to see the arp change.
Sorry for the shameless plug but I find ipaudit and ipstrings useful. Available from sourceforge.
ipaudit similar to netflow, it summarizes network traffic byte count for every host pair, protocol, and port pair.ipstrings reads string data off the wire similar to unix utility strings. It's included in the ipaudit package.
I like Ethereal as it's highly comparable to Etherpeek without the cost...plus it runs on Linux.
You youngin's don't know how good you got it. Why, back in my day we didn't have no fancy, schmancy network sniffers. We just power cycled the boxes until they started working right (or until quitting time, whichever came first).
*mumbles* gotta teach these whipper snappers a thing or two - next they'll need some lessons in percussive maintenance
What SysAdmin worth his/her salt hasn't heard of and used Ethereal, or can't use GOOGLE to find something similar? Man, I must be getting bitter and cynical in my old age. Or maybe I just don't like idiots. I should start posting as an AC.
No wonder companies are outsourcing techs.
Snort as a recommendation is a rather good pun but, as a network sniffer (packet capture/protocol analyzer) Snort is not the answer.
Snort is an Intrusion Detection System(IDS) that monitors network traffic and performs an action when it sees a matching pattern. That action could be a log entry or it might be configured to save the packet to a file. Other actions are possible using external programs. Snort uses libpcap of TCPDump fame to monitor or capture the network traffic. Snort is useless for displaying or analyzing network traffic but, this is not a function that it was designed for.
Ethereal is a graphical protocol analyzer although it does include a command line version as well called Tethereal. Ethereal also relies on libpcap for actually capturing the network packets but, it goes much further than simply capturing network packets. Ethereal displays a break down of the packets themselves separating categorizing and displaying the various fields and data in a packet. It goes further by also decoding a long list of higher level protocols that may be included in the packet.
Ethereal is also capable of reading and decoding network traffic that has been captured and saved in other formats. Ethereal can read and save packet capture files in MS Network Monitor, NAI Sniffer Pro, and many other formats. Ethereal is increasingly recommended by companies such as Novell who actually has had their own protocol analyzer for years called Lanalyzer. Cisco support engineers are also increasingly recommending the use of Ethereal for capture and analysis of network traffic when troubleshooting potential problems with their equipment.
TCPDump has also been recommended by many people here on Slashdot.. TCPDump is a command line based protocol analyzer. It also relies on libpcap for actual packet capture but, it then displays a break down of the actual packets. Its display is not as attractive or as configurable as the graphical Ethereal and it is more limited in the number of protocols that it can interpret and disassemble but, it is still a very powerful and capable program. Further more, its output can be saved for further examination by ethereal.
Buy one linux server, and then discover the wonders that are ping and SNMP. Simple tools such as Nagios and MRTG (or NRG or Cricket) can do wonders for helping spot problem switches/routers and congestion spots.
For example, every device we have is pinged 3 times every minute, and queried for bandwidth usage every 5 minutes. This has helped in finding bottlenecks, and the occasional switch that reboots every few minutes. (MRTG alone convinced the higher ups to buy new gear for our Datacenter and give it a dedicated link to the Core).
Also, setting up a wonderful SNMP trap server can be very useful. It allowed us to find a switch that likes to reboot at random intervals (the switch is 5 years old and being replaced this weekend). Of course, having it send a trap whenever a switch reboots is just the start of what certain switches/routers can do.
Also the use of Snort to sniff traffic that can be potentially malicious can be very helpful in tuning firewalls and finding those script kiddies. (use ACID for a pretty front end)
Another nice tool is NTOP Does almost everything NetFlow does and has a pretty graphical frontend built in. (I recently used this to find out that one of our firewalls was sending gigs of syslog data to the wrong server.)
And with the mention of syslog, might as well throw out a link for syslog-ng. yet another useful tool.
Basically the point of this is to say that sometimes it's best to let your equipment do that talking. They'll usually tell you what's wrong, just as long as you've set them up to do so. I found that once we put a lot of these tools into full production, we were able to cut down on our need to sniff the line whenever problems came up. This isn't to say that Ethereal isn't needed. That's hardly the case. Its use is still huge and shown all the time.