Wireshark, previously called Ethereal, is a popular computer network debugging and packet sniffer tool. Similar to tcpdump but with a well-designed GUI and many more information sorting and filtering options, Ethereal allows the user to see all traffic being passed over the network by putting the network card into promiscuous mode.
Wireshark/Ethereal is used for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. It is an open source license tool and allows users to add enhancements. It runs on all popular computing platforms, including Unix, Linux, and Windows.
Wireshark/Ethereal has the following main features:
- Data can be captured real time from a live network connection, or read from a capture file.
- Ethereal can read capture files from tcpdump (libpcap), Network general SnifferTM (compressed and uncompressed), SnifferTM Pro, NetXrayTM, Sun snoop and atmsnoop, Shomiti/Finisar Surveyor, AIX's iptrace, Microsoft's Network Monitor, Novell's LANalyzer, RADCOM's WAN/LAN Analyzer, HP-UX nettl, i4btrace from the ISDN4BSD project, Cisco Secure IDS iplog, the pppd log (pppdump-format), the WildPacket's EtherPeek/TokenPeek/AiroPeek, or Visual Networks' Visual UpTime. It can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers, as well as the text output from VMS's TCPIPtrace utility and the DBS Etherwatch utility for VMS.
- Live data can be read from Ethernet, FDDI, PPP, Token-Ring, IEEE 802.11, Classical IP over ATM, and loopback interfaces (at least on some platforms; not all of those types are supported on all platforms).
- Captured network data can be browsed via a GUI, or via the TTY-mode "tethereal" program.
- Capture files can be programmatically edited or converted via command-line switches to the "editcap" program.
- 602 protocols can currently be dissected
- Output can be saved or printed as plain text or PostScript©.
- Data display can be refined using a display filter.
- Display filters can also be used to selectively highlight and color packet summary information.
- All or part of each captured network trace can be saved to disk.
Related Terms: Tcpdump, Windump, libpcap, Sniffer, Javvin Packet Analyzer
Reference Links:http://www.ethereal.com: Network Protocol Analyzer