Dissecting network traffic

Wireshark [1], the packet sniffer formerly known as Ethereal, is a must-have for system administrators. If you've ever had to troubleshoot a network problem or needed to watch a transaction with a server, then this is the tool for you. Like most (all?) network data capture programs for Linux, Wireshark relies on libpcap, which provides a system-independent interface for capturing packets; therefore, you do not need to write custom routines for every packet sniffer (tcpdump, Snort, Wireshark, etc.). As long as your OS (e.g., Linux, *BSD, HP-UX, Solaris, Windows, etc.) and software support libpcap, you can sniff packets to your heart's content.

Installing libpcap and Wireshark

Libpcap comes with most operating systems, and Wireshark is almost always included (at least on Linux and BSD). Wireshark is sometimes split into two separate packages: one consisting of the back-end utilities like tshark and mergecap, and the other consisting of the graphical user interface (GUI). On Fedora and most related systems, you can simply run yum:

yum install libpcap
yum install wireshark-gnome

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
SUBSCRIPTIONS
Print Subscriptions
Digital Subscriptions

Related content

  • Wireshark

    If you know your way around network protocols, you can get to the source of a problem quickly with Wireshark.

    more »
  • Capture File Filtering with Wireshark

    Wireshark doesn’t just work in real time. If you save a history of network activity in a pcap file using a tool such as tcpdump, you can filter the data with Wireshark to search for evidence.

    more »
  • An Essential Sys Admin and Security Tool

    Wireshark fills the gap between security and system administration for those who need to know more about what’s flowing through the wires or over the airwaves in the corporate network.

    more »
  • Wireshark's New 1.2

    Wireshark 1.2 introduces a few "new and exciting" features for its network protocol analyzer software.

    more »
  • Tshark

    The simple and practical Tshark packet analyzer gives precise information about the data streams on the network.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Digital Autonomy

• The Answer Was Already on the Shelf
• Changing the Chip Industry: How Public Investment Has Grown Open Silicon
• United Nations Open Source Portal Goes Live
• EU Open Source Strategy Plays Key Role in Tech Sovereignty Package
• France Says “Au Revoir” to Microsoft

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Desktop Events Hardware Linux Mobile Programming Security Software Ubuntu Web Development Windows free software open source