20. tcpdump, ngrep and ethereal

tcpdump and ethereal are network traffic analysis tools; the former is a rough-and-ready command-line utility, while the latter has a GUI and can in addition analyse many protocols.

20.1. tcpdump

tcpdump prints out the headers of packets on a given network interface which match the given boolean expression.

Some examples:

    tcpdump -i hme0
        # print all packet headers arriving at or leaving interface hme0

    tcpdump talby.csu.umist.ac.uk
        # print all packet headers arriving from or leaving for talby
        # on the default interface

    tcpdump 'tcp port 80'
        # print tcp traffic on local port 80

    tcpdump 'host not talby.csu.man.ac.uk'
        # print everything except packets to/from 

20.2. Ethereal

Ethereal is like tcpdump with a GUI and (more importantly) a protocol analyser — tcpdump on steroids.

20.3. ngrep

From the home page:

ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool [cf. tcpdump] that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes TCP, UDP, ICMP... and understands bpf filter logic in the same fashion as... tcpdump....

Examples:

    ngrep -d any port 25
        # ...any device

    ngrep -i -d any 'error' port syslog
        # ...monitor SysLog traffic (port 514) for the string "error" 
        #    (case-insensitive)

    ngrep -wi -d any 'user|pass' port 21
        # ...traffic on src/dest port 21, look (case-insensitive) for 
        #    "user" and "pass" as word-expressions (must have non-alphanumeric
        #    delimiting characters) --- sniff out credentials