Wireshark (also known as Ethereal) is a network protocol analyzer that enables you to capture and examine data from a live network or from a capture file on disk. You can interactively browse the capture data and view summary and detail information for each packet.

Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It can read capture files from tcpdump (libpcap), NAI Sniffer (compressed and uncompressed), Sniffer Pro, NetXray, snoop, Shomiti Surveyor, AIX s iptrace, Microsoft Network Monitor, Novell s LANalyzer, RADCOM s WAN/LAN Analyzer, HP-UX nettl, ISDN4BSD, Cisco Secure IDS iplog, the pppd log (pppdump-format), and the AG Group s/Wildpacket Etherpeek. It can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers.

Any of these files can be compressed with gzip, and Wireshark will decompress them on the fly.

[14808k] [Win98/ME/2k/XP] [FREE] [Gerald Combs]