Wireshark and Ethereal Network Protocol Analyzer Toolkit
Ethereal is the number 2 most popular open source security tool used by system administrators
and security professionals. This book provides complete information and step-by-step Instructions
for analyzing protocols and network traffic on Windows, Unix or Mac OS X networks. First, readers
will learn about the types of sniffers available today and see the benefits of using Ethereal.
Readers will then learn to install Ethereal in multiple environments including Windows, Unix and
Mac OS X as well as building Ethereal from source and will also be guided through Ethereal's graphical
user interface. The following sections will teach readers to use command-line options of Ethereal
as well as using Tethereal to capture live packets from the wire or to read saved capture files.
This section also details how to import and export files between Ethereal and WinDump, Snort, Snoop,
Microsoft Network Monitor, and EtherPeek.
The book then teaches the reader to master advanced tasks such as creating sub-trees, displaying
bitfields in a graphical view, tracking requests and reply packet pairs as well as exclusive coverage
of MATE, Ethereal's brand new configurable upper level analysis engine. The final section to the book
teaches readers to enable Ethereal to read new Data sources, program their own protocol dissectors,
and to create and customize Ethereal reports.
What is Network Analysis and Sniffing?
Network analysis (also known as traffic analysis, protocol analysis, sniffing, packet analysis,
eavesdropping, and so on) is the process of capturing network traffic and inspecting it closely to
determine what is happening on the network. A network analyzer decodes the data packets of
common protocols and displays the network traffic in a readable format. A sniffer is a program that
monitors data traveling over a network. Unauthorized sniffers are dangerous to network security
because they are difficult to detect and can be inserted almost anywhere, which makes them a
favorite weapon of hackers.
A network analyzer can be a standalone hardware device with specialized software, or software
that is installed on a desktop or laptop computer. The differences between network analyzers
depends on features such as the number of supported protocols it can decode, the user interface,
and its graphing and statistical capabilities. Other differences include inference capabilities (e.g.
expert analysis features) and the quality of packet decodes. Although several network analyzers
decode the same protocols, some will work better than others for your environment.