Ethereal Power | Linux Magazine

One of the most important tools in a network administrator’s toolbox is a packet sniffer, a program that intercepts and displays network traffic. Using a packet sniffer, you can examine the individual bytes that make up packets sent across the network wire. Depending on your network configuration, packet sniffers can see traffic sent to or from the computer on which the sniffer runs and even monitor traffic between other computers on the network.

A packet sniffer is quite a powerful tool, but because it operates at such a low level, running one also requires greater expertise than many other network diagnostic tools. Advanced packet sniffers (often called protocol analyzers) can avoid such complications by helping you interpret data packets.

One of the more popular and flexible packet sniffers for Linux is Ethereal (http://www.ethereal.com). Ethereal has protocol analysis features and provides a graphical user interface (GUI). Its protocol analysis features include information on a wide variety of network protocols, enabling Ethereal to parse the data in the packets, greatly simplifying data analysis.

Before proceeding further, you should be aware that, although packet sniffers are very useful and legitimate tools, the tools can also be abused by crackers. Crackers typically use packet sniffers to look for unencrypted passwords and other sensitive data. For this reason, many organizations forbid the use of packet sniffers except under certain limited conditions. Before deploying a packet sniffer, be sure to obtain…

Please log in to view this content.

Not Yet a Member?

Register with LinuxMagazine.com and get free access to the entire archive, including:

Hands-on Content
White Papers
Community Features
And more.

Already a Member?
Log in!

Forgotten your password?
Forgotten your username?