A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer,
is a
computer program
A computer program is a sequence or set of instructions in a programming language for a computer to Execution (computing), execute. Computer programs are one component of software, which also includes software documentation, documentation and oth ...
or
computer hardware
Computer hardware includes the physical parts of a computer, such as the case, central processing unit (CPU), random access memory (RAM), monitor, mouse, keyboard, computer data storage, graphics card, sound card, speakers and motherboard.
...
such as a
packet capture appliance, that can intercept and log traffic that passes over a
computer network
A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are ...
or part of a network. Packet capture is the process of intercepting and logging traffic. As
data streams flow across the network, the analyzer captures each
packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate
RFC or other specifications.
A packet analyzer used for intercepting traffic on wireless networks is known as a wireless analyzer or WiFi analyzer. While a packet analyzer can also be referred to as a
network analyzer or
protocol analyzer
A protocol analyzer is a tool (hardware or software) used to capture and analyze signals and data traffic over a communication channel. Such a channel varies from a local computer bus to a satellite link, that provides a means of communication usi ...
these terms can also have other meanings. Protocol analyzer can technically be a broader, more general class that includes packet analyzers/sniffers. However, the terms are frequently used interchangeably.
Capabilities
On wired
shared-medium networks, such as
Ethernet
Ethernet () is a family of wired computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN). It was commercially introduced in 1980 and first standardized in 1 ...
,
Token Ring, and
FDDI, depending on the network structure (
hub or
switch),
it may be possible to capture all traffic on the network from a single machine. On modern networks, traffic can be captured using a network switch using
port mirroring, which mirrors all packets that pass through designated ports of the switch to another port, if the switch supports port mirroring. A
network tap
A network tap is a system that monitors events on a local network. A tap is typically a dedicated hardware device, which provides a way to access the data flowing across a computer network.
The network tap has (at least) three ports: an ''A por ...
is an even more reliable solution than to use a monitoring port since taps are less likely to drop packets during high traffic load.
On
wireless LAN
A wireless LAN (WLAN) is a wireless computer network that links two or more devices using wireless communication to form a local area network (LAN) within a limited area such as a home, school, computer laboratory, campus, or office buildi ...
s, traffic can be captured on one channel at a time, or by using multiple adapters, on several channels simultaneously.
On wired broadcast and wireless LANs, to capture
unicast
Unicast is data transmission from a single sender (red) to a single receiver (green). Other devices on the network (yellow) do not participate in the communication.
In computer networking, unicast is a one-to-one transmission from one point in ...
traffic between other machines, the
network adapter capturing the traffic must be in
promiscuous mode. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the
service set the adapter is configured for are usually ignored. To see those packets, the adapter must be in
monitor mode. No special provisions are required to capture
multicast
In computer networking, multicast is group communication where data transmission is addressed to a group of destination computers simultaneously. Multicast can be one-to-many or many-to-many distribution. Multicast should not be confused wi ...
traffic to a multicast group the packet analyzer is already monitoring, or
broadcast
Broadcasting is the distribution of audio or video content to a dispersed audience via any electronic mass communications medium, but typically one using the electromagnetic spectrum (radio waves), in a one-to-many model. Broadcasting began wi ...
traffic.
When traffic is captured, either the entire contents of packets or just the
headers are recorded. Recording just headers reduces storage requirements, and avoids some
privacy legal issues, yet often provides sufficient information to diagnose problems.
Captured information is decoded from raw digital form into a
human-readable format that lets engineers review exchanged information. Protocol analyzers vary in their abilities to display and analyze data.
Some protocol analyzers can also generate traffic. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the
device under test's ability to handle errors.
Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets or packet headers to a disk array.
Uses
Packet analyzers can:
* Analyze network problems
* Detect
network intrusion attempts
* Detect network misuse by internal and external users
* Documenting regulatory compliance through logging all perimeter and endpoint traffic
* Gain information for effecting a network intrusion
* Identify data collection and sharing of software such as operating systems (for strengthening
privacy
Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.
The domain of privacy partially overlaps with security, which can include the concepts of ...
, control and security)
* Aid in gathering information to isolate exploited systems
* Monitor WAN bandwidth utilization
* Monitor network usage (including internal and external users and systems)
* Monitor
data in transit
* Monitor WAN and
endpoint security
Endpoint security or endpoint protection is an approach to the protection of computer networks that are remotely bridged to client devices. The connection of endpoint devices such as laptops, tablets, mobile phones, Internet-of-things device ...
status
* Gather and report network statistics
* Identify suspect content in network traffic
* Troubleshoot performance problems by monitoring network data from an application
* Serve as the primary data source for day-to-day network monitoring and management
* Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content
encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can d ...
methods that may be in use)
*
Reverse engineer proprietary protocol
In telecommunications, a proprietary protocol is a communications protocol owned by a single organization or individual.
Intellectual property rights and enforcement
Ownership by a single organization gives the owner the ability to place restric ...
s used over the network
* Debug
client/server communications
* Debug network protocol implementations
* Verify adds, moves, and changes
* Verify internal control system effectiveness (
firewalls, access control, Web filter, spam filter, proxy)
Packet capture can be used to fulfill a warrant from a
law enforcement agency
A law enforcement agency (LEA) is any government agency responsible for the enforcement of the laws.
Jurisdiction
LEAs which have their ability to apply their powers restricted in some way are said to operate within a jurisdiction.
LE ...
to
wiretap all network traffic generated by an individual.
Internet service provider
An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise priva ...
s and
VoIP
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. The terms Internet t ...
providers in the United States must comply with
Communications Assistance for Law Enforcement Act regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and can use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception. By using
end-to-end encryption
End-to-end encryption (E2EE) is a system of communication where only the communicating users can read the messages. In principle, it prevents potential eavesdroppers – including telecommunications service providers, telecom providers, Internet ...
, communications can be kept confidential from telecommunication carriers and legal authorities.
Notable packet analyzers
* Allegro Network Multimeter
*
Capsa Network Analyzer
*
Charles Web Debugging Proxy
*
Carnivore (software)
Carnivore, later renamed DCS1000, was a system implemented by the Federal Bureau of Investigation (FBI) that was designed to monitor email and electronic communications. It used a customizable packet sniffer that could monitor all of a target user ...
*
CommView
*
dSniff
dSniff is a set of password sniffing and network traffic analysis tools written by security researcher and startup founder Dug Song to parse different application protocols and extract relevant information. dsniff, filesnarf, mailsnarf, msgsnarf ...
*
EndaceProbe Analytics Platform by Endace
*
ettercap
*
Fiddler
*
Kismet
*
Lanmeter
*
Microsoft Network Monitor
Microsoft Network Monitor is a deprecated packet analyzer. It enables capturing, viewing, and analyzing network data and deciphering network protocols. It can be used to troubleshoot network problems and applications on the network. Microsoft Netw ...
*
NarusInsight
Narus Inc. was a Software industry, software company and Independent software vendor, vendor of big data analytics for cybersecurity.
History
In 1997, Ori Cohen, Vice President of Business and Technology Development for VDONet, founded Narus with ...
*
NetScout Systems nGenius Infinistream
*
ngrep
ngrep (network grep) is a network packet analyzer written by Jordan Ritter. It has a command-line interface, and relies upon the pcap library and the GNU regex library.
ngrep supports Berkeley Packet Filter ( BPF) logic to select network source ...
, Network Grep
*
OmniPeek, Omnipliance by Savvius
*
SkyGrabber
*The
Sniffer
*
snoop
*
tcpdump
*
Observer Analyzer
*
Wireshark
Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, the project was renamed Wireshark in May 2006 du ...
(formerly known as Ethereal)
*
Xplico Open source Network Forensic Analysis Tool
See also
*
Bus analyzer
A bus analyzer is a type of a protocol analysis tool, used for capturing and analyzing communication data across a specific interface bus, usually embedded in a hardware system. The bus analyzer functionality helps design, test and validation eng ...
*
Logic analyzer
A logic analyzer is an electronic instrument that captures and displays multiple signals from a digital system or digital circuit. A logic analyzer may convert the captured data into timing diagrams, protocol decodes, state machine traces, ass ...
*
Network detector
Network detectors or network discovery software are computer programs that facilitate detection of wireless LANs using the 802.11b, 802.11a and 802.11g WLAN standards.''Wireless Hacking for Dummies''. Discovering networks may be done through acti ...
*
pcap
*
Signals intelligence
Signals intelligence (SIGINT) is intelligence-gathering by interception of '' signals'', whether communications between people (communications intelligence—abbreviated to COMINT) or from electronic signals not directly used in communication ...
*
Traffic generation model
Notes
References
External links
*
{{Authority control
Network analyzers
Packets (information technology)
Wireless networking
Deep packet capture