n2disk is a traffic recording application able to produce multiple PCAP files (a per-file limit in duration or size can be used to control the file size) together with an index (for accelerating extraction) and a timeline (for keeping all the files in chronological order).

We did not mention that the same engine can be used for accelerating traffic extraction from an indexed dump set produced by n2disk.

It will build your base by explaining the theory behind how networks work and then get you into real-world applications of the software.In a previous post we introduced our new nBPF library that able to convert a BPF filter to hardware rules for offloading traffic filtering to the network card. This course is an introduction to the application and goes over the basics to get you started capturing and analyzing network traffic. Output can be exported to XML, PostScript®, CSV, or plain text Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)ĭecryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2Ĭoloring rules can be applied to the packet list for quick, intuitive analysis Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many othersĬapture files compressed with gzip can be decompressed on the fly The most powerful display filters in the industry Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many othersĬaptured network data can be browsed via a GUI, or via the TTY-mode TShark utility Wireshark is a great tool for pentester and has a rich feature set which includes the following:ĭeep inspection of hundreds of protocols, with more being added all the time It is cross platform, meaning that it runs on Windows, Mac, Linux, and FreeBSD.

This free and open source application is so widely used in the industry because it works. It is used by IT and Network administrators to troubleshoot network connectivity issues and by Network Security analysts to dissect network attacks. Wireshark is the most widely used network capture and protocol analyzer on the market.

Wireshark libpcap