Once upon a time, there was a network-capture utility named Ethereal, and it was good. Unfortunately, the original author of Ethereal, Gerald Combs, had to change the name of the product when he took a position with network monitoring tool vendor CACE Technologies, which published a competing product.
Ethereal has now been reincarnated as Wireshark. The same team of engineers works on the product. However, Wireshark has been released as a free product under the GNU General Public License. It's free for most uses (i.e., deployment in a corporate environment or personal use) but it cannot be re-used as part of a commercial product without adhering to certain rules regarding incorporating GPL-covered software in a proprietary system.
CACE has ported Wireshark to a variety of platforms, including 32-bit Windows (including Vista), Linux, Solaris and Mac OS X.
For those who are not familiar with Ethereal, Wireshark reads live data from many types of networks—not just Ethernet, 802.11 wireless or token-ring, but also FDDI, PPP/SLIP serial links and ATM connections. The results can then be dumped out to a file and analyzed, either live or from a previous dump file.
With Wireshark, it's always possible to add support for other protocols in the future. Furthermore, Wireshark can read a wide variety of capture file formats—everything from the output of standard tools like libpcap and tcpdump to proprietary formats such as the dump output from Toshiba ISDN routers. (Dump files can also be exported as plaintext, PostScript, CSV, markup or raw byte dumps.)
Features in Wireshark make the task of capturing and analyzing traffic as easy as possible. One such function is the ability to "follow" TCP streams, which lets a network administrator view traffic for a particular TCP conversation as a given application would see it. Also included in Wireshark is an interpreter for Lua, a language that allows admins to write scripts and other automation features for the program. The product's documentation includes samples to get you going, as well as a full rundown of the APIs exposed in Wireshark.
About the author: Serdar Yegulalp is editor of the Windows Insight, (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of Windows experience under his belt, and contributes regularly to SearchWinComputing.com and SearchSQLServer.com.
More information on this topic:
