Linux Security Cookbook

9.17. Observing Network Traffic (GUI)

Problem

You want to watch network traffic via a graphical interface.

Solution

Use Ethereral and tethereal.

Discussion

Prolonged perusing of tcpdump output [Recipe 9.16] can lead to eyestrain. Fortunately, alternatives are available, and Ethereal is one of the best.

Ethereal is a GUI network sniffer that supports a number of enhancements beyond the capabilities of tcpdump. When Ethereal starts, it presents three windows:

Packet List

A summary line for each packet, in a format similar to tcpdump.

Tree View

An expandable protocol tree for the packet selected in the previous window. An observer can drill down to reveal individual fields at each protocol level. Ethereal understands and can display an astounding number of protocols in detail.

Data View

Hexadecimal and ASCII dumps of all bytes captured in the selected packet. Bytes are highlighted according to selections in the protocol tree.

Ethereal uses the same syntax as tcpdump for capture filter expressions. However, it uses a different, more powerful syntax for display filter expressions. Our previous tcpdump example, to select packets related to FTP transfers to or from a server: [Recipe 9.16]

tcp port ftp or ftp-data and host server.example.com

would be rewritten using Ethereal’s display filter syntax as:

ftp or ftp-data and ip.addr == server.example.com

The display filter syntax is described in detail in the ethereal(1) manpage.

Warning

If you receive confusing and uninformative syntax error messages, ...