Ethereal
Ethereal_Screenshot.png
- This article is about the network traffic analyzer. For more general definitions, see the Wiktionary entry. For the fictional alien race from X-COM: UFO Defense, see Ethereal (alien)
In computing, Ethereal is a protocol analyzer, or "packet sniffer" software, used for network troubleshooting, analysis, software and protocol development, and education. It has all of the standard features of a protocol analyzer.
The functionality Ethereal provides is very similar to tcpdump (c.f.), but it adds a GUI frontend, and many more information sorting and filtering options. It allows the user to see all traffic being passed over the network (usually an Ethernet network but support is being added for others) by putting the network card into promiscuous mode.
Ethereal is released under a open source license, and it runs on most Unix and Unix-compatible systems, including Linux, Solaris, FreeBSD, NetBSD, OpenBSD, and Mac OS X, and also on Microsoft Windows.
Features
- Data can be captured "off the wire" from a live network connection, or read from a capture file.
- Live data can be read from Ethernet, FDDI, PPP, Token Ring, IEEE 802.11, Classical IP over ATM, and loopback interfaces (at least on some platforms; not all of those types are supported on all platforms).
- Captured network data can be browsed via a GUI, or via the TTY-mode "tethereal" program.
- Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
- Display filters can also be used to selectively highlight and color packet summary information.
- Data display can be refined using a display filter.
- 802 protocols can currently be dissected.
- And more...