TOP 5 PACKET SNIFFERS FOR YOUR LINUX

A typical packet sniffer tool captures live packets from networks, decodes them according to protocol specifications, and optionally takes actions according to the parsed packet contents (e.g., in case of security detection systems). Packet sniffing tools are very useful when you diagnose networks or protect against security attacks over networks. The following are several popular open-source packet sniffers available on Linux.

1. tcpdump: The most popular general-purpose packet analyzer. It uses libpcap library to capture packets on OSI layer 2 (e.g., Ethernet, PPP, and SLIP), and above. tcpdump supports regular expressions for advanced packet filtering, and allows one to export and import packet dumps to and from a file.

visit tcpdump.org to download latest version.

2. Wireshark: Formerly known as Ethereal, Wireshark is an open-source packet analyzer with graphical front end. Functionality-wise, Wireshark is quite similar to tcpdump, and is available on multiple platforms including Linux, BSD, and Mac OS X, and MS Windows. A CLI client called tshark comes with it.

visit wireshark.org to download latest version.

3. p0f: A passive OS fingerprinting tool that identifies the operating systems of two end point hosts associated with an existing TCP connection. For accurate fingerprinting, p0f draws from various signatures including TCP/IP headers, TCP three-way handshake dynamics, contents of application-level payloads (e.g., HTTP request/response). Besides OS fingerprinting, p0f also detects the types of HTTP clients, network links (e.g., ethernet, DSL, modem), as well as NAT connection sharing, load-balancing setup, etc.

visit github.com to clone latest version.

4. Snort: An open-source intrusion detection and prevention system that relies on real-time network sniffing and analysis. Snort conducts extensive protocol analysis and content matching to detect a variety of network attacks and hostile scans.

visit snort.org to download latest version.

5. Kismet: A wireless network detector and intrusion detection system for 802.11 wireless links, supporting 802.11a, 802.11b, 802.11g, and 802.11n. It identifies wireless clients and their network association by passively collecting packets on wireless network card interfaces. Kismet also detects active wireless sniffing programs to alert wireless network attacks.

visit kismetwireless.net to download latest version.
Please don't forget to check out www.hackerbhai.com