What are popular packet sniffers on Linux

A typical packet sniffer tool captures live packets from networks, decodes them according to protocol specifications, and optionally takes actions according to the parsed packet contents (e.g., in case of security detection systems). Packet sniffing tools are very useful when you diagnose networks or protect against security attacks over networks. The following are several popular open-source packet sniffers available on Linux.

1. tcpdump: The most popular general-purpose packet analyzer. It uses libpcap library to capture packets on OSI layer 2 (e.g., Ethernet, PPP, and SLIP), and above. tcpdump supports regular expressions for advanced packet filtering, and allows one to export and import packet dumps to and from a file.

2. Wireshark: Formerly known as Ethereal, Wireshark is an open-source packet analyzer with graphical front end. Functionality-wise, Wireshark is quite similar to tcpdump, and is available on multiple platforms including Linux, BSD, and Mac OS X, and MS Windows. A CLI client called tshark comes with it.

3. dhcpdump: Snoops on DHCP request/response traffic captured by libpcap library, and displays the DHCP packets in human readable formats. dhcpdump is useful for DHCP debugging and troubleshooting.

4. p0f: A passive OS fingerprinting tool that identifies the operating systems of two end point hosts associated with an existing TCP connection. For accurate fingerprinting, p0f draws from various signatures including TCP/IP headers, TCP three-way handshake dynamics, contents of application-level payloads (e.g., HTTP request/response). Besides OS fingerprinting, p0f also detects the types of HTTP clients, network links (e.g., ethernet, DSL, modem), as well as NAT connection sharing, load-balancing setup, etc.

5. Snort: An open-source intrusion detection and prevention system that relies on real-time network sniffing and analysis. Snort conducts extensive protocol analysis and content matching to detect a variety of network attacks and hostile scans.

6. Kismet: A wireless network detector and intrusion detection system for 802.11 wireless links, supporting 802.11a, 802.11b, 802.11g, and 802.11n. It identifies wireless clients and their network association by passively collecting packets on wireless network card interfaces. Kismet also detects active wireless sniffing programs to alert wireless network attacks.

7. hcidump: A Bluetooth traffic sniffer which captures HCI packets associated with Bluetooth devices, and display Bluetooth related activities in human readable formats.

8. httpry: An open-source HTTP packet sniffing tool which captures live HTTP packets with libpcap library, and displays HTTP requests and responses in a human-readable format. It comes with a collection of parsing Perl scripts for mining various information from its standard output.

9. dsniff: A suite of CLI tools used for network auditing and penetration testing purposes. Supported functionality includes passwords from login sessions (dsniff), sniffing files from NSF traffic (filesnarf), email messages from SMTP/POP traffic (mailsnarf), URLs from web traffic (urlsnarf), etc.

10. ngrep: grep over network packets. Powered with libpcap library, it captures packets whose payload is matched with extended regular expressions or hexadecimal expressions.

11. ntopng: A full-blown web-based real-time network traffic monitoring system which provides flow/protocol/packet-level analysis of local network traffic. Long-term traffic history is archived in the database backend.

12. Wireless IDS: An open source intrusion detection tool for wireless networks. It sniffs communication between wireless devices and access points to detect any potential WEP/WPA/WPS attacking packets, or possible rogue access point.

13. mysql-sniffer: An open source tool which captures live packets sent to a MySQL server, and dumps MySQL queries in a human readable format.

14. bro: A powerful and flexible network monitoring and intrusion detection system. Analyzes live or recorded traffic to trigger events which are then handled by action policies.

Subscribe to Xmodulo

Do you want to receive Linux FAQs, detailed tutorials and tips published at Xmodulo? Enter your email address below, and we will deliver our Linux posts straight to your email box, for free. Delivery powered by Google Feedburner.

Support Xmodulo

Did you find this tutorial helpful? Then please be generous and support Xmodulo!

The following two tabs change content below.
Dan Nanni is the founder and also a regular contributor of Xmodulo.com. He is a Linux/FOSS enthusiast who loves to get his hands dirty with his Linux box. He likes to procrastinate when he is supposed to be busy and productive. When he is otherwise free, he likes to watch movies and shop for the coolest gadgets.

One thought on “What are popular packet sniffers on Linux

  1. You forgot justniffer. According to the author: a network protocol analyzer that captures network traffic and produces logs in a customized way, can emulate Apache web server log files, track response times and extract all "intercepted" files from the HTTP traffic


Leave a comment

Your email address will not be published. Required fields are marked *