Packet Capture Using Ethereal

Definition for Sniffer: A program and/or device that monitors data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information off a network. Unauthorized sniffers can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal. On TCP/IP networks, where they sniff packets, they're often called packet sniffers.

Why Packet Capture? Troubleshooting! For most computer users, the only way we can tell what the network is doing is by watching the performance of our workstation. If it takes a long time to retrieve a file from the server, we say the network is “slow”. For network analysts that’s just the first step on the road to analyzing a reported problem.

Why Packet Capture? We use a variety or tools to do this analysis, including SNMP and RMON, but before these were available packet capture software was used.

What is Packet Capture? Packet Capture software reads all packets that fly by on the network, whether they are addressed for our workstation or not. It then decodes the binary data into the appropriate fields of each frame and interprets what each is doing. By understanding how a protocol is supposed to work you can look at what you capture and tell what’s going on with your network.

Network General A company called Network General developed a hardware/software combination called the Sniffer. It was expensive software on an expensive portable computer, and you couldn’t buy them separately. The company has since been sold a couple of times and now is owned by Network Associates.

Network General Network Associates promptly changed the sales model to a license arrangement and allowed the software to be sold separately. The software starts at about $5k per year (2003). It captures frames and packets, then uses an expert systems program to analyze the data and suggest the source of problems. PC magazine considers the Sniffer Pro LAN the best high-end packet capture software available.

Packet Capture Tools PC Magazine wrote a series of articles reviewing packet capture tools, and it’s available at 13,00.asp 13,00.asp

Packet Capture Tools Some other brands are listed on the above page, including: EtherPeek (About $1000) LANwatch32 Netboy Observer Sniffer Basic Optiview Integrated Network Analyzer Surveyor 3.2

Ethereal We are going to use Ethereal, because it’s free! You can find it at Ethereal is a free network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Ethereal has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.

Ethereal You can find it at /. You’ll need to install both Ethereal to analyze the data and WinPcap to capture data. There’s a bit of a description of WinPcap at /

Ethereal An introduction to Ethereal, along with some screen shots, can be found at

Ethereal If you have a network at home, download Ethereal onto your own workstation. Be sure to also download WinPcap. Even if you don’t have a network, you can download previously captured data off of the Ethereal (and other) web sites and analyze the data so you can see how it works. The program is about 10MB, so it won’t fit on a floppy disk, but it will fit on a zip disk or CD.

Ethereal Tutorial Here is a complete Ethereal tutorial. It was written for a Unix environment, so skip the parts that have to do with command line. It has complete information about how to use the windows version as well. This is a huge document, so don’t expect to go through all of it and make sense of it. Go through the first guide far enough to figure out how the tool works. There are plenty of screen shots to help you along. guide/chap03.html#AEN1092http:// guide/chap03.html#AEN1092 The complete user’s guide is at