Capturing tools

Many different tools can be used to capture packets off the network and either analyze the packet data directly or store them in pcap files. There are even more tools that will take those pcap files and allow you to do further offline analysis on them.

tcpdump

We've referenced tcpdump several times. This is a command-line packet capture tool, which means that it can be used on systems that don't have a GUI or if you are using a non-GUI interface such as SSH. Because it's not dealing with any graphics and isn't preprocessing packets for you to look at (to tell you any of the protocol specifics for instance), it's one of the higher-performance, lowest-impact tools you'll find for packet capture.

tcpdump uses the Berkely Packet Filter (BPF) syntax to decide which packets to capture. This can be used to filter by IP address, MAC address, protocol, or even specific flags in a TCP packet.

Wireshark

Wireshark is one of the more...