Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What packet sniffer would you recommend using, especially in a 50+ workstation environment? I am a fan of Wireshark but it's got quite a bit of security history. Is there something better?

share|improve this question
    
it must be quite scarry to have network of so hostile workstations. hostile up to the point that they might craft packets that can exploit some vulnerabilities in network traffic analyzers ;-] –  pQd Jun 15 '09 at 21:43
1  
As unlikely as it is, still could happen. –  Terry Jun 15 '09 at 21:50

10 Answers 10

up vote 4 down vote accepted

I haven't run into anything free that is better. My work it too cheap to pay for a sniffer when Wireshark is so good at what it does. Yes, it seems Wireshark has a new vuln against a decoder every other day or so, but that kind of thing happens when you're by far the top package in a field like this. Yes, I'd like them to update a bit more often. But the sheer utility of Wireshark makes me keep using it.

share|improve this answer
    
+1 Exactly what I was looking for –  Terry Jun 15 '09 at 22:02
    
and may I say you have restored my faith in this community. –  Terry Jun 15 '09 at 22:04

I use Wireshark on Windows all the time - with a SPAN session or similar, plus cunning use of capture/display filters, you can get it to tell you pretty much anything you need. And you can make pretty graphs for your boss, too. What did you mean by 'security history'?

share|improve this answer
    
Wireshark is packed with features and its free. +1 –  cop1152 Jun 15 '09 at 21:46
    
+1 for Wireshark (used to be Ethereal) –  KPWINC Jun 15 '09 at 21:47
    
I still use wireshark, but do a quick lookup of wireshark on Packetstorm –  Terry Jun 15 '09 at 21:52
    
+1 for wireshark too.. –  Greg Meehan Jun 15 '09 at 21:52
1  
How is it that this is voted to the top when the question clearly states that he doesn't want the security issues associated with wireshark? –  Jim B Jun 17 '09 at 5:05

get windows version of tcpdump and analyze traces later with anything [ including wireshark ] on separate desktop box.

or use network switch with port mirroring and attach linux [ or - in worst case - virtual machine with linux and bridging to separate ethernet interface ] and perform all sniffing on it.

share|improve this answer
    
Yes, tcpdump/windump is a great light tool if you just need to capture. –  radius Jun 15 '09 at 22:22

I don't use this stuff nearly as much as I used to, but I always liked Microsoft Network Monitor when I needed a free protocol analyzer to track down a problem. http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=983b941d-06cb-4658-b7f6-3088333d062f

share|improve this answer

(Disclosure: My name is at the top of Wireshark's list of authors.)

Wireshark's security record is one of the very few aspects of the project that I've been unhappy with. The good news is that we have a talented team of developers and a solid architecture. One of the reasons you hear about Wireshark's security is that we actively look for flaws and report them. We're usually the first to discover them, and I try to push out updates and advisories as quickly as possible when they are found. The bad news is that eliminating every flaw in 1.7 million lines of code is Really Damn Hard.

Something to keep in mind if you're looking at a commercial analyzer: many of them use older versions Wireshark (or Ethereal) as a back-end for decoding.

share|improve this answer

I use Wireshark and would still recommend the same, but an alternative to pQd's suggestion of two-stepping the actual packet capture (presumably Windump) and analysis (Wireshark) would be using the updated first-party Microsoft Network Monitor or checking out the array of "WinPcap-based Tools and Programs" at the WinPcap site (the underlying support for many packet analyzers including WinDump and Wireshark). I've used "Analyzer" in the past.

share|improve this answer

If you know python, scapy is great. Here is how to install it one windows. You can use to sniff traffic, and even craft packets. Conceptually it breaks everything down into OSI layers.

share|improve this answer

Netmon 3.3 is definitly your best bet. The best new feature is experts functionality

share|improve this answer

I would agree with RainyRat, (that's an awesome username, BTW dude) and express my own incredulity with your anti-wireshark sentiments. (I also don't know of any security vulnerabilities in it either, and I use it quite a bit.) That being said, I'd love to know if there are any.

In the interim, there's always LanHound

share|improve this answer
    
Thanks. It's an anagram of my real one. –  RainyRat Jun 15 '09 at 22:20

If you have some bucks to spend, try Wildpacket's OmniPeek. It has enormous analysis features and decoders, session/flow based views, easy-to-build filters and great support for real NICs with hardware filtering.

I often use it for my daily work to analyze problems in chatty customer networks - you can drop some small linux-boxes with tcpdump and use them as remote-NIC for larger setups.

You can download a trial version and give it a shot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.