Ethereal is an open source network protocol analyzer. It can analyze live data or files from an amazing number of other applications (tcpdump, snoop, Cisco iplog etc.).
The list of protocols it groks just goes on and on - 658 when I just checked now. Runs on Linux, Unix and Windows.
One (of many) interesting features is the ability to reconstruct a tcp session in the order the application would have seen it (network bytes don't necessarily arrive in order; it's up to higher levels of the tcp stack to reconstruct them). It can also do helpful resolution translations for you: mac addresses to ip addresses, mac to manufacturer, ip addresses to dns, port numbers to names.
Free, extensible, powerful.
Got something to add? Send me email.
More Articles by Tony Lawrence © 2012-07-16 Tony Lawrence