Ethereal is a free network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Ethereal has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.

Recent versions of Ethereal have included many enhancements to the interface. Under the "Display" menu, you can now jump to a particular frame, find a frame in the list, and match a frame's component. The filter entry box now sports a popup list, similar to many web browsers. The TCP stream window can display the client and server data in different colors.

If there is a site that should be listed here or if a link goes dead, .

Links

• Introduction to Ethereal
  
• Ethereal FAQ
  
• Javvin’s Map of Communication Protocols
  
• Sniffing (network wiretap, sniffer) FAQ
  
• Using Ethereal
  
• Opening a Protocol Inspector or Surveyor Trace in Ethereal
  
• Ethereal Presentation
  
• Plugins:
  • H.323 plugin for Ethereal
    
• Versions / sources :
  • Debian Ethereal version
    
  • Freshmeat.net Ethereal versions
    
  • Windows Ethereal version