Introduction to Ethereal (v.0.9.9), The Open Source Network-Protocol Analyzer

Ethereal

Tracing for indefinite periods...

Problem: How to capture traffic for an indefinite period,

while controlling disk consumption and size of trace files.

Solution: tethereal “ring buffers”

• tethereal is the terminal (non GUI) version of Ethereal

• ring buffers are capture files: when the last is full, the first

is reused

• user specifies number of buffers (-b option), size in Kb or

number of packets (-a option), and basename for output

files (-w option)

• capture files are binary; they can be opened in Ethereal or

displayed as text by tethereal