What is your favorite freeware packet sniffer?

  • Thread starter Thread starter John Corliss
  • Start date Start date
I'm looking for an alternative to Ethereal that's a little more user
friendly.

TIA
Click to expand...
Analyzer is a full configurable network analyzer program for Win32
environment. Analyzer is able to capture packets on all platforms (and
link-layer technologies) supported by WinPcap, except for Windows 95.

http://analyzer.polito.it/
 
Mel said:
Analyzer is a full configurable network analyzer program for Win32
environment. Analyzer is able to capture packets on all platforms (and
link-layer technologies) supported by WinPcap, except for Windows 95.

http://analyzer.polito.it/
Click to expand...

Thanks Mel, but this part makes me nervous:

"This work has been partially sponsored by Microsoft Research and
Telecom Italia Labs."

Given Microsoft's penchant for having their software "call home", even
my mouse and keyboard softwares, who knows what strings are attached to
their "sponsorship"?

On the other hand, I like the looks of this one:

http://www.analogx.com/contents/download/network/pmon.htm

The interface appears more cleanly laid out than that of Ethereal. Just
wish the download was a zip file instead of an installation executable.

I wish there was a freeware program that allowed one to extract files
from an Installshield or a Microsoft installer file. I hate having to
install a program in order to read the EULA or to discover that it
modifies the system in a fashion that I don't like.
 
John said:
Thanks Mel, but this part makes me nervous:

"This work has been partially sponsored by Microsoft Research and
Telecom Italia Labs."

Given Microsoft's penchant for having their software "call home", even
my mouse and keyboard softwares, who knows what strings are attached to
their "sponsorship"?

On the other hand, I like the looks of this one:

http://www.analogx.com/contents/download/network/pmon.htm

The interface appears more cleanly laid out than that of Ethereal. Just
wish the download was a zip file instead of an installation executable.

I wish there was a freeware program that allowed one to extract files
from an Installshield or a Microsoft installer file. I hate having to
install a program in order to read the EULA or to discover that it
modifies the system in a fashion that I don't like.
Click to expand...

Crap. I just noticed this:

"Please note, PacketMon is currently only available for Win2000/XP ONLY."

The search continues I guess.
 
I got interested in that old question a few months back when I started
using Win 2K Pro on one machine. Looked to me like the evidence of
something possibly along those lines disappeared when I disabled
Telephony ... making dialup impossible. On Win ME, I think it
disappears when you rename RPCSS.EXE to RPCSS.OLD in pure
DOS. I do that anyway on Win ME to close a port ... as part of my
"close all open ports" technique for that OS. And I did that when
I was using Win 98 as well.

Anyway, there's no trace of mysterious outgoing, or attempts at it,
on any of my machines. I use tools like TCPView, Active Ports,
Netstat, and Sygate free firewall for this sort of detective work.

I thought it was interesting that whatever was trying to call out
on a fresh install of Win 2K disappeared when I "destroyed" the OS
capability to support dialup.

Art

http://home.epix.net/~artnpeg
 
Thanks Mel, but this part makes me nervous:

"This work has been partially sponsored by Microsoft Research and
Telecom Italia Labs."

Given Microsoft's penchant for having their software "call home", even
my mouse and keyboard softwares, who knows what strings are attached to
their "sponsorship"?
Click to expand...
Out of all the millions of people on the internet what makes you think
they are interested in what you do?
On the other hand, I like the looks of this one:

http://www.analogx.com/contents/download/network/pmon.htm

The interface appears more cleanly laid out than that of Ethereal. Just
wish the download was a zip file instead of an installation executable.
Then you are installing WinXP.

I wish there was a freeware program that allowed one to extract files
from an Installshield or a Microsoft installer file. I hate having to
install a program in order to read the EULA or to discover that it
modifies the system in a fashion that I don't like.
Click to expand...
Yup me too.
 
ISPs sometimes supply spyware in their software allegedly to collect
useage patterns for marketing research purposes. I dunno why M$
should be any different.
Click to expand...

Like you can really make yourself invisible.
 
Mel said:
Out of all the millions of people on the internet what makes you think
they are interested in what you do?
Click to expand...

Well, I never said that they were, Mel. What I meant was that it
wouldn't be unlike Microsoft to stipulate as a condition of their
"sponsorship" that the sniffer be unable to detect packets from
something that they include in their OS. And not as a particular
interest in what *I* am doing, but rather as a potential to protect
their ability to do something to people in general. Consider this....
who knows what kind of deals they've made with the United States Justice
Department (and FBI, CIA, "Fatherland Security", etc.) in order to
circumvent prosecution for being a monopoly?
Then you are installing WinXP.
Click to expand...

No, I caught that in the reply I made to the post your reply was to.
Yup me too.
Click to expand...

Seems like a good idea, but of course it would probably require some
kind of reverse engineering in order to see inside such files.
 
Art said:
ISPs sometimes supply spyware in their software allegedly to collect
useage patterns for marketing research purposes. I dunno why M$
should be any different.
Click to expand...

True fact. The ISP that comes to mind immediately is Charter, who I've
seen install Broadjump Client Foundation (active file is named
"cfd.exe") on at least three clients' computers who went with that ISP.
In each case, I removed the spyware with no ill effects. When I called
Charter on it, one of their reps flatly denied Charter having installed
it. However, when I uninstalled their software and then reinstalled it
as a test, BCF reappeared "as if by magic". I wouldn't have caught this
crap if it hadn't been for me installing Kerio before allowing the
Charter guy to put his stuff on. It alerted me to BCF trying to call
out. After Charter's reps leave (they sometimes insist on installing the
software themselves) I always get to work removing BCF and streamlining
the system.
 
Art said:
I got interested in that old question a few months back when I started
using Win 2K Pro on one machine. Looked to me like the evidence of
something possibly along those lines disappeared when I disabled
Telephony ... making dialup impossible. On Win ME, I think it
disappears when you rename RPCSS.EXE to RPCSS.OLD in pure
DOS.
Click to expand...

I did that a long time ago (named it "RPCSS renamed.EXE) because I
really don't like having remote call procedures activated on my system.
"Great minds think alike" I guess.
I do that anyway on Win ME to close a port ... as part of my
"close all open ports" technique for that OS. And I did that when
I was using Win 98 as well.

Anyway, there's no trace of mysterious outgoing, or attempts at it,
on any of my machines. I use tools like TCPView, Active Ports,
Netstat, and Sygate free firewall for this sort of detective work.

I thought it was interesting that whatever was trying to call out
on a fresh install of Win 2K disappeared when I "destroyed" the OS
capability to support dialup.
Click to expand...

I agree. I wonder if that would work with XP though.
 
Mel said:
Like you can really make yourself invisible.
Click to expand...

All one can do is to try, Mel. And a good packet sniffer is a start.
Neutering Java is another step in the right direction. There are
"degrees of visibility", so there's no point in giving up.
 
Like you can really make yourself invisible.
Click to expand...

Agreed, but......

BellSouth ( as well as others) goes a step further w/ *Support.Com*
installed.
Anyone who uses BellSouth for an ISP, should look at their folder,
C:\Program Files\Support.com\backup.
Although it is supposed to help w/ troubleshooting it is def suspect
as spyware.
Case in point : see info on *T g c m d.exe* here :
http://www.answersthatwork.com/Tasklist_pages/tasklist_t.htm
which declares it to be spyware.

I no longer have this service running on my box.....
/bLB
 
Well, I never said that they were, Mel. What I meant was that it
wouldn't be unlike Microsoft to stipulate as a condition of their
"sponsorship" that the sniffer be unable to detect packets from
something that they include in their OS. And not as a particular
interest in what *I* am doing, but rather as a potential to protect
their ability to do something to people in general. Consider this....
who knows what kind of deals they've made with the United States Justice
Department (and FBI, CIA, "Fatherland Security", etc.) in order to
circumvent prosecution for being a monopoly?
Click to expand...
And what makes you think the government didn't institute prosecution of
Microsoft with the sole purpose of getting Microsofts cooperation in
incorporating spyware into their products (to further erode the privacy
of all computer users)? (Too many secrets!)
Seems like a good idea, but of course it would probably require some
kind of reverse engineering in order to see inside such files.
Click to expand...
Some .msi files can be extracted with JvaENE.
 
Mel said:
Looks like most of the Freeware To Capture and Analyze Traffic On Your
Network is listed here:

http://netsecurity.about.com/cs/hackertools/a/aafreepacsniff.htm
Click to expand...

That's what I was thinking too. Am going to give Sniphere a look.
And Freeware Network Monitoring Tools and Utilities are listed here:

http://netsecurity.about.com/cs/hackertools/a/aafreenetmon.htm
Click to expand...

Well, I've already got enough of that kind of thing. Mostly I just want
a good and easy to use packet sniffer. What turned me off to Ethereal
was when I saw their help file refer to a "filtering *language*". Why in
hell do they make it so difficult? Seems to me that a little work on
simplifying their UI is in order. On the other hand, maybe Ethereal is
another one of those products that intended for developers mainly, like
Mozilla used to be.
 
Mel said:
And what makes you think the government didn't institute prosecution of
Microsoft with the sole purpose of getting Microsofts cooperation in
incorporating spyware into their products (to further erode the privacy
of all computer users)? (Too many secrets!)
Click to expand...

Heh. "Oh what a circle of lies we weave when at first we try to deceive"
or something like that.
Some .msi files can be extracted with JvaENE.
Click to expand...

Thanks! I'll check it out. Eh.... got any links? Google didn't come up
with much.
 
All one can do is to try, Mel. And a good packet sniffer is a start.
Neutering Java is another step in the right direction. There are
"degrees of visibility", so there's no point in giving up.
Click to expand...
Yes, you can try, but that doesn't mean you'll succeed, if someone
really wants to know, they can track you anywhere. (even through an
anonomizers or tor)

One can wear a white sheet to hide ones identity, but that doesn't make
one bulletproof.
 
Well, I've already got enough of that kind of thing. Mostly I just want
a good and easy to use packet sniffer. What turned me off to Ethereal
was when I saw their help file refer to a "filtering *language*". Why in
hell do they make it so difficult? Seems to me that a little work on
simplifying their UI is in order. On the other hand, maybe Ethereal is
another one of those products that intended for developers mainly, like
Mozilla used to be.
Click to expand...
Maybe I'll try it: I like to get into bits & bytes.
 
Back
Top