Packet analyzer
A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer,[1][2][3][4][5][6][7][8] is a computer program or computer hardware such as a packet capture appliance that can analyze and log traffic that passes over a computer network or part of a network.[9] Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.
A packet analyzer used for intercepting traffic on wireless networks is known as a wireless analyzer or WiFi analyzer. While a packet analyzer can also be referred to as a network analyzer or protocol analyzer these terms can also have other meanings. Protocol analyzer can technically be a broader, more general class that includes packet analyzers/sniffers.[10] However, the terms are frequently used interchangeably.[11]
Capabilities
On wired
On wireless LANs, traffic can be captured on one channel at a time, or by using multiple adapters, on several channels simultaneously.
On wired broadcast and wireless LANs, to capture
When traffic is captured, either the entire contents of packets or just the headers are recorded. Recording just headers reduces storage requirements, and avoids some privacy legal issues, yet often provides sufficient information to diagnose problems.
Captured information is decoded from raw digital form into a
Some protocol analyzers can also generate traffic. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the device under test's ability to handle errors.[13][14]
Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets or packet headers to a disk array.
Uses
Packet analyzers can:
- Analyze network problems
- Detect network intrusionattempts
- Detect network misuse by internal and external users
- Documenting regulatory compliance through logging all perimeter and endpoint traffic
- Gain information for effecting a network intrusion
- Identify data collection and sharing of software such as operating systems (for strengthening privacy, control and security)
- Aid in gathering information to isolate exploited systems
- Monitor WAN bandwidth utilization
- Monitor network usage (including internal and external users and systems)
- Monitor data in transit
- Monitor WAN and endpoint security status
- Gather and report network statistics
- Identify suspect content in network traffic
- Troubleshoot performance problems by monitoring network data from an application
- Serve as the primary data source for day-to-day network monitoring and management
- Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content encryption methods that may be in use)
- Reverse engineer proprietary protocols used over the network
- Debug client/server communications
- Debug network protocol implementations
- Verify adds, moves, and changes
- Verify internal control system effectiveness (firewalls, access control, Web filter, spam filter, proxy)
Packet capture can be used to fulfill a warrant from a
Notable packet analyzers
- Allegro Network Multimeter
- Capsa Network Analyzer
- Charles Web Debugging Proxy
- Carnivore (software)
- CommView
- dSniff
- EndaceProbe Packet Capture Platform
- ettercap
- Fiddler
- Kismet
- Lanmeter
- Microsoft Network Monitor
- NarusInsight
- NetScout Systems nGenius Infinistream
- ngrep, Network Grep
- OmniPeek, Omnipliance by Savvius
- SkyGrabber
- The Sniffer
- snoop
- tcpdump
- Observer Analyzer
- Wireshark (formerly known as Ethereal)
- Xplico Open source Network Forensic Analysis Tool
See also
Notes
- ^ Some methods avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g., ARP spoofing).
References
- ISBN 978-1-119-47587-3.
A sniffer (also called a packet analyzer or protocol analyzer) is a software application that captures traffic traveling over the network.
- ISBN 978-1-7998-5824-9.)
Packet Sniffing: It is also known as packet analyzer, protocol analyzer
{{cite book}}
: CS1 maint: multiple names: authors list (link - ISBN 978-0-321-59188-3.
A packet sniffer (also known as a packet analyzer, protocol analyzer, or networkanalyzer) monitors network traffic
- ISBN 978-1-5225-8898-6.
Packet Sniffing: A packet analyzer, also called as a network analyzer, protocol analyzer or packet sniffer
- ISSN 2277-2626.
Packet Sniffing... also known as Network or Protocol Analyzer or Ethernet Sniffer
- ^ "What is a Packet Sniffer?". www.kaspersky.com. 2018.
- ^ "What is Network Packet Capture?". www.endace.com. 2023.
- ^ "Definition of network analyzer". PCMAG.
- ISBN 978-0-7355-4273-0.
- S2CID 212863330.
Those protocol analyzers that are designed for packet analysis are called packet analyzers (packet sniffers, sometimes network analyzers).
- ISBN 978-0-13-280216-1.
protocol analyzer. Also known as a network analyzer or packet analyzer, a protocol analyzer is a hardware device or software program that enables you to capture, store, and analyze each packet that crosses your network
- ^ "Network Segment Definition". www.linfo.org. Retrieved January 14, 2016.
- ^ "Lab Protocol Analyzers". www.amilabs.com. Retrieved June 30, 2023.
- ^ shivakumar (December 18, 2020). "Where is Protocol analyzer used?". Prodigy Technovations. Retrieved June 30, 2023.
External links
- Protocol Analyzers at Curlie
- Packet Capture