Difference between revisions of "Winpcap and Windump"
m (→Other Winpcap Based Tools) |
m (→Ethereal) |
||
| Line 37: | Line 37: | ||
=== Ethereal === | === Ethereal === | ||
network protocol analyzer | network protocol analyzer | ||
| − | * http://www. | + | * http://www.wireshark.org/<BR> |
| − | Ethereal can read capture files from (libpcap). | + | <nowiki>*</nowiki> The Ethereal project was forced to change names in May 2006 due to trademark issues. It is now called [http://sourceforge.net/project/showfiles.php?group_id=255 Wireshark]. |
| + | |||
| + | Ethereal can read capture files from (libpcap). | ||
| + | |||
| + | Q 1.2: What's up with the name change? Is Wireshark a fork? | ||
| + | |||
| + | A: In May of 2006, Gerald Combs (the original author of Ethereal) went to work for CACE Technologies (best known for WinPcap). Unfortunately, he had to leave the Ethereal trademarks behind. | ||
| + | |||
| + | This left the project in an awkward position. The only reasonable way to ensure the continued success of the project was to change the name. This is how Wireshark was born. | ||
| + | |||
| + | Wireshark is almost (but not quite) a fork. Normally a "fork" of an open source project results in two names, web sites, development teams, support infrastructures, etc. This is the case with Wireshark except for one notable exception -- every member of the core development team is now working on Wireshark. There has been no active development on Ethereal since the name change. Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline. | ||
=== myNetMon === | === myNetMon === | ||
Latest revision as of 13:39, 27 December 2007
WinPcap
The Packet Capture and Network Monitoring Library for Windows
WinDump
tcpdump for Windows
WinDump is able to use the interfaces exported by WinPcap. WinDump can run on all the operating systems supported by WinPcap, i.e. Windows 95, 98, ME, NT4, 2000, XP, 2003, Longhorn/Vista.
- windump -p : Capture in non-promiscuous mode.
- windump -D : Show available interfaces.
- windump -i 2 : Select the second network interface. It is easier to specify the interface number rather than by name.
man page
tcpdump - dump traffic on a network
SYNOPSIS
tcpdump [ -AdDeflLnNOpqRStuUvxX ] [ -c count ]
[ -C file_size ] [ -F file ]
[ -i interface ] [ -m module ] [ -M secret ]
[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ]
[ -E spi@ipaddr algo:secret,... ]
[ -y datalinktype ] [ -Z user ]
[ expression ]
The complete windump manual: http://www.winpcap.org/windump/docs/manual.htm
Other Winpcap Based Tools
Ethereal
network protocol analyzer
* The Ethereal project was forced to change names in May 2006 due to trademark issues. It is now called Wireshark.
Ethereal can read capture files from (libpcap).
Q 1.2: What's up with the name change? Is Wireshark a fork?
A: In May of 2006, Gerald Combs (the original author of Ethereal) went to work for CACE Technologies (best known for WinPcap). Unfortunately, he had to leave the Ethereal trademarks behind.
This left the project in an awkward position. The only reasonable way to ensure the continued success of the project was to change the name. This is how Wireshark was born.
Wireshark is almost (but not quite) a fork. Normally a "fork" of an open source project results in two names, web sites, development teams, support infrastructures, etc. This is the case with Wireshark except for one notable exception -- every member of the core development team is now working on Wireshark. There has been no active development on Ethereal since the name change. Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline.
myNetMon
myNetMon, Network Monitor and Packet Analyzing Tool (V.2.0)
myNetMon is windows based network monitor and packet analyzing (sniffer) tool. myNetMon uses WinPcap, a windows port of Libpcap which is a packet capturing library.
- It does not seem to work with the lateset WinPcap.
