The tools of the trade

There are numerous free and commercial packet sniffers, very often named network analyzers, in the market, and selecting the one that best meets your need is a matter of choice. There are several factors to determine this, such as the operating system in use, supported set of protocols, ease of use, customizability, and of course budget. The following are the popular ones:

• Tcpdump: Tcpdump is a free and popular command-line packet capture utility, which can come in very handy in the absence of a GUI-based tool. However, even after capturing traffic via tcpdump, one can analyze and interpret the traffic using any GUI-based free or commercial tool, as it is visually easy. Refer to TCPDUMP Overview at http://www.tcpdump.org/manpages/tcpdump.1.html.
• Nagios Network Analyzer and OmniPeek: These are commercial-grade network analyzers that provide organizations with packet analysis capabilities with some unique features of their own. The pricing for these products can be seen on their inpidual websites.
• Wireshark: Wireshark, formerly known as Ethereal, is free and open source, and is the most popular packet analyzer out there. It works across multiple platforms and supports a huge set of protocol families with an easy-to-use GUI. Refer to http://wiki.wireshark.org/ProtocolReference/.

Apart from the dedicated sniffer tools we just introduced, packet sniffing capability and modules come integrated in many of the popular security-related tools, such as Snort, Metasploit, and Scapy, to name a few. Snort started off as a sniffer and later used its sniffing capabilities to develop into what we know today as the popular network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) solution.

Another example is the presence of the sniffer module in Metasploit. After successfully compromising a machine using Metasploit, one can execute this module and start sniffing traffic on that compromised box for further enumeration. Sniffing options available with Metasploit are shown as follows:

Another excellent option is using sniff() in Scapy. Scapy is a packet manipulation tool written in Python and can be used to generate, craft, and decode packets and capture them. It is helpful in many security testing-related activities.

The focus of this book is "Wireshark". So, let's get started.