Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use wireshark and microsoft network monitor extensively, but I'm curious if there are other good (hopefully free / open source) software packages for analyzing TCP/IP traffic?

I'm especially interested in forensic uses and analysis of network issues.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Basically this boils down to a question: what OSI level are you interested in? If you want to know about what exactly was transmitted, you cannot avoid Wireshark, tcpdump or alike. But if you are interested to learn patterns that appear in your network you have to analyze netflows, packet capture is simply an overkill.

And for netflows there are many tools:

http://nsmwiki.org/index.php?title=Argus

http://www.networkuptime.com/tools/netflow/

http://www.mindrot.org/projects/

http://code.google.com/p/flow-tools/

http://www.ntop.org/nProbe.html

share|improve this answer
    
Thanks! this looks exactly like what I'm interested in. –  John Weldon Feb 12 '10 at 15:30

I think Wireshark is pretty much the open/free standard. Is there something you're looking for that it doesn't do?

share|improve this answer
    
@mfinni thanks! Yes, Windows Network Monitor has an expert 'TCP Analyzer' or something that identifies network issues... that's the kind of thing I'm interested in. –  John Weldon Feb 12 '10 at 4:47

Ditto on wireshark. If your looking for a command line tool, you might consider running the raw network trace through tcpdump. Although wireshark has better protocol disectors, tcpdump combined with some command line magic can be useful in certain situations.

share|improve this answer
    
wireshark can be text only: wireshark.org/docs/man-pages/tshark.html –  monomyth Feb 12 '10 at 6:44
    
I completely missed tshark. Looks like a lot of the command line parameters are the same as tcpdump too. I have a new tool to add to my arsenal –  SteveM Feb 12 '10 at 14:56
    
Thanks :) What kind of command line magic did you have in mind? –  John Weldon Feb 12 '10 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.