Protocol Analyzers

Network Stumbler is a packet sniffer for wireless networks. It supports wireless network cards that use the Hermes chipset, including Lucent, Dell True Mobile, Compaq WL 110, Elsa Airlancer and several others. We have installed but not tested this version, since our wireless card was not compatible. This version is currently in beta testing.

IP sniffer is a protocol analyzer, that uses the XP/2K Raw Socket features. It supports filtering rules, adapter selection, packet decoding, advanced protocol description and more. Detailed information about each packet is provided in a tree-style view, and the right-click menu allows to resolve or scan the selected source IP address. Additional features include adapter statistics, IP traffic monitoring, traceroute, ping, port scanning, TCP/UDP/ICMP spoofing options, open tcp/udp ports attached to process, mac address changing, and DNS/WINS/SNMP/WHOIS/DHCP queries.

SmartSniff is a TCP/IP packet capture program that allows you to inspect network traffic that passes through your network adapter. The two pane interface displays the captured packet and detailed information in ASCII or Hex view below. Additional features include color coding of local and remote traffic, export to HTML, capture filters and more. SmartSniff can use in Windows 2000/XP Raw Sockets or WinPcap for other versions of Windows.

Sniphere is a WinPCAP network sniffer that supports most of common protocols. It can be used on ethernet devices and supports PPPoE modems. The program allows you to set filters based on IP, Mac Address, ports, protocol etc. and also decodes packages into an easy to understand format. In addition, session logs can be saved in XML format and selected packets copied to the clipboard. Sniphere supports most common protocols, including IP, TCP, UDP and ICMP. Very small, standalone program.

Wireshark (also known as Ethereal) is a network protocol analyzer that enables you to capture and examine data from a live network or from a capture file on disk. You can interactively browse the capture data and view summary and detail information for each packet. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It can read capture files from tcpdump (libpcap), NAI Sniffer (compressed and uncompressed), Sniffer Pro, NetXray, snoop, Shomiti Surveyor, AIX s iptrace, Microsoft Network Monitor, Novell s LANalyzer, RADCOM s WAN/LAN Analyzer, HP-UX nettl, ISDN4BSD, Cisco Secure IDS iplog, the pppd log (pppdump-format), and the AG Group s/Wildpacket Etherpeek. It can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers. Any of these files can be compressed with gzip and Wireshark will decompress them on the fly.

Microsoft Network Monitor 3 is a network protocol analyzer that can capture network traffic for further inspection by a network administrator. It supports regular expression filters, scriptable parsers, custom data types and other advanced features. Network Monitor 3 can simultaneously capture packets on multiple network adapters and provides real-time display as well as frame and tree view to manage the captured data.

NetworkActiv PIAFCTM enables you to capture and analyze IP packets, search for keywords in the content and set various filters to limit capture to the packets you`re interested in. Filtering options include by IP, by port, string, protocol and more. In addition, you can also use the File Sniffer mode, which allows you to capture and store complete HTTP files (web-pages, pictures, downloads, etc.) that go through your computer via your network. The files can be stored in a directory of your choice for later review or processing. NetworkActiv PIAFCTM also includes a graphical packets mode which attempts to create a real-time network map from the captured traffic (beta test). An easy to use tool for TCP/IP network administrators, security professionals, and just about any advanced computer user with an internet connection.

AnalogX PacketMon allows you to capture IP packets that pass through your network interface - whether they originated from the machine on which PacketMon is installed, or a completely different machine on your network! Once the packet is received, you can use the built in viewer to examine the header as well as the contents, and you can also export the results into a standard comma-delimited file for further processing. PacketMon includes a powerful rule system that allows advanced users to narrow down the packets it captures to ensure you get exactly what you re after, without having to dig through tons of unrelated information. The rule sets can be saved as individual files, that can be exchanged with other users, or only loaded during special tasks. The program is intended for advanced users that have technical knowledge of TCP/IP networking. Packetmon is not much to look at but offers highly customizabe filtering options and fast and efficient processing.

HTTP Spy .NET enables you to trace HTTP requests to a web site in order to analyze headers, raw HTTP data and connection bottlenecks. The program provides a real-time log view and can also log requests to a file. You can limit logging to specific sites, exclude sites, mark packets and preview images. HTTP Spy .NET only works with Internet Explorer traffic.