Network Sniffing Tools: Wireshark, tcpdump & More

Wireshark is the world's foremost network protocol analyzer with a graphical interface for capturing and interactively analyzing network traffic. It supports hundreds of protocols and can read capture files from many other tools.

Start capturing on an interface by selecting it and clicking the shark fin icon. Use capture filters to limit what is collected (e.g., 'host 192.168.1.1' or 'port 80'). Display filters refine what you see after capture (e.g., 'http.request.method == POST').

Follow TCP streams to reconstruct complete conversations: right-click a packet → Follow → TCP Stream. This reassembles the entire data exchange, making it easy to read HTTP requests, email messages, or file transfers in plaintext protocols.

Wireshark's statistics features (Statistics menu) provide powerful analysis: Protocol Hierarchy shows traffic distribution, Conversations lists communication pairs, and IO Graphs visualize traffic patterns over time. Expert Information flags anomalies automatically.

tcpdump is the standard command-line packet analyzer for Unix-like systems. It is lighter than Wireshark and ideal for capturing traffic on remote servers without GUI access. Basic usage: 'sudo tcpdump -i eth0' captures all traffic on the eth0 interface.

Apply filters to focus capture: 'tcpdump -i eth0 port 80' captures only HTTP traffic, 'tcpdump -i eth0 host 192.168.1.100' captures traffic to/from a specific host, 'tcpdump -i eth0 tcp and dst port 443' captures only outgoing HTTPS connections.

Save captures for later analysis: 'tcpdump -i eth0 -w capture.pcap' writes packets to a file. Open this file in Wireshark for detailed graphical analysis. Use '-c 1000' to limit capture to 1000 packets.

Advanced tcpdump usage: '-A' displays packet contents in ASCII (useful for HTTP), '-X' shows hex and ASCII, '-v/-vv/-vvv' increases verbosity, and '-n' prevents DNS resolution for faster output.

Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN. It performs ARP spoofing automatically, positioning itself between targets to intercept traffic. Launch with: 'ettercap -G' for the graphical interface or 'ettercap -T' for text mode.

Ettercap's plugin system extends functionality: 'dns_spoof' redirects DNS queries to attacker-controlled servers, 'remote_browser' monitors target browsing activity, and various filters can modify traffic in real-time as it passes through.

dSniff is a collection of tools for network auditing and penetration testing. It includes dsniff (password sniffer), arpspoof (ARP spoofing), urlsnarf (URL logging), and mailsnarf (email capture). Each tool focuses on a specific sniffing task.

Bettercap is a modern alternative to Ettercap with active development and a modular architecture. It supports ARP spoofing, DNS spoofing, HTTP/HTTPS proxying, Wi-Fi attacks, and Bluetooth Low Energy reconnaissance in a single framework.

Always obtain written authorization before using sniffing tools on any network. Unauthorized packet capture is illegal in most jurisdictions and can result in criminal charges, civil liability, and termination of employment.

Use capture filters to minimize data collection. Capturing everything generates enormous files and may inadvertently collect sensitive data outside the scope of your engagement. Focus on specific protocols, hosts, or ports relevant to your objectives.

Securely store and handle capture files, especially those containing credentials or personal data. Encrypt capture files at rest, transmit them securely, and delete them according to the engagement's data handling agreement.

Combine multiple tools for comprehensive analysis: use tcpdump for efficient capture on remote servers, Wireshark for detailed analysis, and specialized tools like NetworkMiner for forensic analysis and credential extraction from capture files.