What are some good utilities for capturing packets?

Tim Rohaly

For all flavors of Unix, tcpdump, available from http://www-nrg.ee.lbl.gov/, is the standard. tcpdump is a command-line tool, with no graphical user interface. Source code is included.

WinDump, available from http://netgroup-serv.polito.it/windump/, is a port of tcpdump for Windows. Source code is included.

Ethereal, a GUI-based protocol analyzer, can be downloaded from http://www.zing.org/. Ethereal runs on Windows and many variants of Unix. Source code is included.

Both of the Windows utilities require WinPCap, a packet capture driver for Windows available from http://netgroup-serv.polito.it/winpcap/.