Rahasia : Packet Sniffer

Packet sniffing is listening (with software) to the raw network device for packets that interest you. When your software sees a packet that fits certain criteria, it logs it to a file. The most common criteria for an interesting packet is one that contains words like "login" or "password."
To do packet sniffing, you will have to obtain or code a packet sniffer that is capable of working with the type of network interface supported by your operating system:

Network interfaces include:

• LLI
• NIT (Network Interface Tap)
• Ultrix Packet Filter
• DLPI (Data Link Provider Interface)
• BPF (Berkeley Packet Filter)

LLI was a network interface used by SCO, which has been augmented with DLPI support as of SCO OpenServer Release V.
NIT was a network interface used by Sun, but has been replaced in later releases of SunOS/Solaris with DLPI.
Ultrix supported the Ultrix Packet Filter before Digital implemented support for BPF.
DLPI is supported under current releases of System V Release 4, SunOS/Solaris, AIX, HP/UX, UnixWare, Irix, and MacOS. DLPI is partially supported under Digital Unix. Sun DLPI version 2 supports Ethernet, X.25 LAPB, SDLC, ISDN LAPD, CSMA/CD, FDDI, Token Ring, Token Bus, and Bisync as data-link protocols. The DLPI network interface provided with HP/UX supports Ethernet/IEEE 802.3, IEEE 802.5, FDDI, and Fibre Channel.

BPF is supported under current releases of BSD and Digital Unix, and has been ported to SunOS and Solaris. AIX supports BPF reads, but not writes. A BPF library is available for Linux.

Packet Sniffers

Commercial, bundled, and free packet sniffers are available for most operating systems:

Free Packet Sniffers

Ethereal

Platform(s): Most
License: Open Source GPL
Ethereal is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. Its open source license allows talented experts in the networking community to add enhancements. It runs on all popular computing platforms, including Unix, Linux, and Windows.

tcpdump

Platform(s): Most
License: BSD License
Tcpdump prints out the headers of packets on a network interface that match the boolean expression. It can also be run with the -w flag, which causes it to save the packet data to a file for later analysis, and/or with the -b flag, which causes it to read from a saved packet file rather than to read packets from a network interface. In all cases, only packets that match expression will be processed by tcpdump.

nfswatch/

Platform(s): Unix
License: Open Source
nfswatch is a packet sniffer which is dedicated to sniffing NFS (Network File System) traffic. nfswatch lets you monitor NFS requests to any given machine, or the entire local network. It mostly monitors NFS client traffic (NFS requests); it also monitors the NFS reply traffic from a server in order to measure the response time for each RPC.

Web Packet Sniffer

Platform(s): nix
License: Open Source
Web Packet Sniffer is a pair of Perl scripts that together will:

• Listen to all TCP/IP traffic on a subnet.
• Intercept all outgoing requests for web documents and display them.
• Intercept all incoming requests for web documents and display them.
• Decode the Basic authentication passwords, if any.

Sniffit

Platform(s): Linux, SunOS, Solaris, FreeBSD and Irix
License: Open Source
sniffit is a packet sniffer for TCP/UDP/ICMP packets. sniffit is able to give you very detailed technical info on these packets (SEQ, ACK, TTL, Window, …) but also packet contents in different formats (hex or plain text, …).

Bundled Packet Sniffers

Microsoft Network Monitor

Platform(s): Windows
License: Bundled with Microsoft Windows
Microsoft Network Monitor is the packet sniffer which is bundled with Microsoft Windows.
Network Monitor is a component of Microsoft Systems Management Server (SMS) that enables you to detect and troubleshoot problems on LANs, WANs, and serial links running the Microsoft Remote Access Server (RAS). Network Monitor provides real-time and post-capture modes of network data analysis.
In real-time analysis, network traffic is examined by real-time monitors. These monitors test network traffic for a specific set of conditions, and when those conditions are detected, display events, which may prompt end-user action. For example, a monitor can detect conditions that indicate a SYN attack and aid a network administer to respond to the potential attack.
In post-capture analysis, network traffic is saved in a proprietary capture file so that the captured data can be analyzed later. In this case, analysis can be in the form of protocol parsers picking out specific network frame types and displaying the frame data in the Network Monitor UI; or analysis can be in the form of experts examining the network data and displaying a report (experts may also manipulate the network data).
Network Monitor provides the following types of functionality:

• Captures network data in real-time or delayed mode.
• Provides filtering capabilities when capturing data.
• Uses monitors for real-time analysis and security.
• Uses experts and parsers for detailed post-capture analysis.

snoop

Platform(s): Solaris
License: Bundled with Solaris
snoop is the packet sniffer which is bundled with the Solaris Operating System.
snoop captures packets from the network and displays their contents. snoop uses both the network packet filter and streams buffer modules to provide efficient capture of packets from the network. Captured packets can be displayed as they are received, or saved to a file for later inspection.
snoop can display packets in a single-line summary form or in verbose multi-line forms. In summary form, only the data pertaining to the highest level protocol is displayed. For example, an NFS packet will have only NFS information displayed. The underlying RPC, UDP, IP, and ethernet frame information is suppressed but can be displayed if either of the verbose options are chosen.

nettl / netfmt

Platform(s): HP-UX
License: Bundled with HP-UX
The nettl and netfmt packet sniffing utilities are bundled with the HP-UX operating system.

Commercial Packet Sniffers

LanWatch

Platform(s): DOS/Windows
License: Commercial
LANWatch is a software-based network packet analyzer. Easy to install and use, LANWatch monitors traffic in real time and displays a wide range of statistics. With LANWatch, network administrators can quickly identify problems and keep networks running at peak performance. Support and QA Personnel can determine the origin of network problems. Network Application and Protocol Developers can easily monitor, examine and verify network protocols in both hexadecimal and formatted views.

Etherpeek

Platform(s): Windows, Macintosh
License: Commercial
EtherPeek is an Ethernet network traffic and protocol analyzer designed to make the complex tasks of troubleshooting and debugging mixed-platform, multi-protocol networks easy. EtherPeek sets the industry standard for ease-of-use while delivering all the superior diagnostic and analysis capabilities expected of a full-featured analyzer at an affordable price.

Sniff'em

Platform(s): Windows
License: Commercial
Sniff'em captures, monitors and analyzes network traffic, detecting bottlenecks and other network related problems. Using this information, a network manager can keep traffic flowing efficiently. The Sniff'em packet sniffer can also be used legitimately or illegitimately to capture data being transmitted over a network.
Sniff'em is a competitively priced, performance minded Windows based Packet sniffer, Network analyzer and Network sniffer, a revolutionary new network management tool designed from the ground up with ease and functionality in mind.

EffeTech HTTP Sniffer

Platform(s): Windows
License: Commercial
EffeTech HTTP Sniffer is a HTTP packet sniffer, protocol analyzer and file reassembly software based on windows platform. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol, rebuild the HTTP sessions, and reassemble files sent through HTTP protocol. Its smart real-time analyzer enables on-the-fly content viewing while capture, analyze, parse and decode HTTP protocol.

Iris

Platform(s): Windows
License: Commercial
Iris is a powerful yet intuitive network traffic analyzer which allows system administrators to examine the inner workings of their network, simplifying the detective work of pinpointing a security breach or resolving a performance problem.
Iris takes network traffic and returns it to its original format, dramatically reducing the time previously spent examining individual packets. Utilizing Iris, security professionals are able to; read the actual text of an email, as well as any attachments, exactly as it was sent, reconstruct the actual HTML pages that your users have visited and even simulate cookies for entry into password-protected websites.
Iris provides automated filters that can be set up to flag and record specific network traffic that contains a particular MC or IP address, unacceptable words or websites, and more, to ensure whether company security is being compromised or corporate policies are abused. Iris also provides a variety of statistical measurements allowing you to proactively identify, and take the steps to eliminate, performance issues before they can result in downtime.

Rahasia : HTTP sniffer on Linux - urlsnarf

We have experienced high load on one of our web servers lately (Apache 2.0.59 on Linux). So, I started thinking about how to analyze this in a bit more detail. We are running multiple virtual hosts (around 60) so when using tcpdump it is not easy to see which URLs are requested, therefore I looked around for some HTTP-oriented sniffer. My search ended with “urlsnarf” from the “dsniff” package.

Last change in dsniff was in 2000 and it has libnet and libnids dependencies. It took me a couple of tries (and a minor patch) to get it to compile but when done I was happy with the result. urlsnarf simply sniffs HTTP traffic on one or more parts and generates output in the common log format making it easy to see which URLs are reqeusted.
I could then see what URL were the most frequently requested and continue on to the awstats logs which we have for each virtual host. Then it was quite easy to find a couple of pages with very large images that were very frequently requested and from there we could take relevant actions to reduce the HTTP load.

Rahasia : Top 11 Packet Sniffers

After the tremendously successful 2000 and 2003 security tools surveys, Insecure.Org is delighted to release this 2006 survey. I (Fyodor) asked users from the nmap-hackers mailing list to share their favorite tools, and 3,243 people responded. This allowed me to expand the list to 100 tools, and even subdivide them into categories. This is the category page for packet sniffers -- the full network security list is available here. Anyone in the security field would be well advised to go over the list and investigate tools they are unfamiliar with. I discovered several powerful new tools this way. I also point newbies to this site whenever they write me saying “I don't know where to start”.
Respondents were allowed to list open source or commercial tools on any platform. Commercial tools are noted as such in the list below. No votes for the Nmap Security Scanner were counted because the survey was taken on a Nmap mailing list. This audience also biases the list slightly toward “attack” hacking tools rather than defensive ones.
Each tool is described by one ore more attributes:

	Did not appear on the 2003 list
	Generally costs money. A free limited/demo/trial version may be available.
	Works natively on Linux
	Works natively on OpenBSD, FreeBSD, Solaris, and/or other UNIX variants
	Works natively on Apple Mac OS X
	Works natively on Microsoft Windows
	Features a command-line interface
	Offers a GUI (point and click) interface
	Source code available for inspection.

Please send updates and suggestions (or better tool logos) to Fyodor. If your tool is featured or you think your site visitors might enjoy this list, you are welcome to use our link banners. Here is the list, starting with the most popular:

#1

Wireshark : Sniffing the glue that holds the Internet together Wireshark (known as Ethereal until a trademark dispute in Summer 2006) is a fantastic open source network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, delving down into just the level of packet detail you need. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It also supports hundreds of protocols and media types. A tcpdump-like console version named tethereal is included. One word of caution is that Ethereal has suffered from dozens of remotely exploitable security holes, so stay up-to-date and be wary of running it on untrusted or hostile networks (such as security conferences).

---

#2

Kismet : A powerful wireless sniffer Kismet is an console (ncurses) based 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. It identifies networks by passively sniffing (as opposed to more active tools such as NetStumbler), and can even decloak hidden (non-beaconing) networks if they are in use. It can automatically detect network IP blocks by sniffing TCP, UDP, ARP, and DHCP packets, log traffic in Wireshark/TCPDump compatible format, and even plot detected networks and estimated ranges on downloaded maps. As you might expect, this tool is commonly used for wardriving. Oh, and also warwalking, warflying, and warskating, ... Also categorized as: wireless tools

---

#3

Tcpdump : The classic sniffer for network monitoring and data acquisition Tcpdump is the IP sniffer we all used before Ethereal (Wireshark) came on the scene, and many of us continue to use it frequently. It may not have the bells and whistles (such as a pretty GUI or parsing logic for hundreds of application protocols) that Wireshark has, but it does the job well and with fewer security holes. It also requires fewer system resources. While it doesn't receive new features often, it is actively maintained to fix bugs and portability problems. It is great for tracking down network problems or monitoring activity. There is a separate Windows port named WinDump. TCPDump is the source of the Libpcap/WinPcap packet capture library, which is used by Nmap among many other tools.

---

#4

Cain and Abel : The top password recovery tool for Windows UNIX users often smugly assert that the best free security tools support their platform first, and Windows ports are often an afterthought. They are usually right, but Cain & Abel is a glaring exception. This Windows-only password recovery tool handles an enormous variety of tasks. It can recover passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. It is also well documented. Also categorized as: password crackers

---

#5

Ettercap : In case you still thought switched LANs provide much extra security Ettercap is a terminal-based network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like ssh and https). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.

---

#6

Dsniff : A suite of powerful network auditing and penetration-testing tools This popular and well-engineered suite by Dug Song includes many tools. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected ssh and https sessions by exploiting weak bindings in ad-hoc PKI. A separately maintained partial Windows port is available here. Overall, this is a great toolset. It handles pretty much all of your password sniffing needs.

---

#7

NetStumbler : Free Windows 802.11 Sniffer Netstumbler is the best known Windows tool for finding open wireless access points ("wardriving"). They also distribute a WinCE version for PDAs and such named Ministumbler. The tool is currently free but Windows-only and no source code is provided. It uses a more active approach to finding WAPs than passive sniffers such as Kismet or KisMAC. Also categorized as: wireless tools

---

#8

Ntop : A network traffic usage monitor Ntop shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user's terminal. In Web mode, it acts as a Web server, creating an HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics. Also categorized as: traffic monitoring tools

---

#9

Ngrep : Convenient packet matching & display ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop. Also categorized as: traffic monitoring tools

---

#10

EtherApe : EtherApe is a graphical network monitor for Unix modeled after etherman Featuring link layer, IP and TCP modes, EtherApe displays network activity graphically with a color coded protocols display. Hosts and links change in size with traffic. It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network. Also categorized as: traffic monitoring tools

---

#11

KisMAC : A A GUI passive wireless stumbler for Mac OS X This popular stumbler for Mac OS X offers many of the features of its namesake Kismet, though the codebase is entirely different. Unlike console-based Kismet, KisMAC offers a pretty GUI and was around before Kismet was ported to OS X. It also offers mapping, Pcap-format import and logging, and even some decryption and deauthentication attacks. Also categorized as: wireless tools Source : http://sectools.org/