Introduction to Ethereal (v.0.9.9), The Open Source Network-Protocol Analyzer

Ethereal

Getting started:

tcpdump

capture filters...

What is tcpdump?

• Open-source text-based network trace facility

• Well-known, standard utility, in use for over ten years

• Originally developed at Lawrence Berkeley National Lab

• Uses the libpcap library to capture network traffic

• tcpdump and libpcap are actively maintained by The

tcpdump Group (www.tcpdump.com)

•Advantages oftcpdump:

g consumes minimal system resources (no X processing)

g easy to use, yet supports complex filtering syntax (libpcap)

g detail of output can be controlled, header to full dump

g does respectable job decoding and formatting SMBs