This is known as packet capture. While computers are generally designed to ignore the hubbub of traffic activity from other computers, packet sniffers reverse this. When you install packet sniffing software, the network interface card NIC —the interface between your computer and the network—must be set to promiscuous mode. This commands the computer to capture and process, via the packet sniffer, everything that enters the network. What can be captured depends on the network type.

For wired networks, the configuration of network switches, which are responsible for centralizing communications from multiple connected devices, determines whether the network sniffer can see traffic on the entire network or only a portion of it. For wireless networks, packet capture tools can usually only capture one channel at a time unless the host computer has multiple wireless interfaces.

A packet sniffer can help you target new resources when expanding your network capacity, manage your bandwidth, increase efficiencies, ensure delivery of business services, enhance security, and improve end-user experience. But while many of the benefits of packet sniffing will fall into place, there are certain best practices to follow if you want to reap the full results and protect your company from security violations.

To get the most out of your packet sniffer, ensure you:. While sniffer software is a tremendous asset to any IT team when implemented correctly, it can also be used by hackers to collect passwords, eavesdrop on unencrypted data within the packets, and steal data in transit. Hackers also use packet sniffers to conduct man-in-the-middle attacks , in which data is altered and diverted in transit to defraud a user.

The malicious use of packet sniffers can lead to security breaches, industrial espionage, and more. Compared to other security measures, VPNs, virtual private networks, offer the most protection because they encrypt your traffic. You can also protect the metadata of your packets, such as destination addresses, by ensuring your DNS queries go through the VPN.

Many sysadmins also choose to invest in intrusion detection systems , which monitor network traffic for unusual spikes in traffic—a telltale sign of an intruder. Another option is to leverage tools like AntiSniff , which detect when a network interface has been put into promiscuous mode, raising a red flag if this occurred without your knowledge. There are countless packet sniffers on the market today, both paid and free. And while each tool is built on the core tenets of network traffic collection, they vary greatly in their breadth and depth.

Many—although not all—free versions can be upgraded to provide additional analytical features if you determine greater support is needed. With so many products on the market, it can be hard to know which packet sniffer to choose. In many cases, what sets these tools apart is their ability to perform deep packet inspection DPI. DPI software relies on sensors installed on transaction servers and a network sensor attached to a test access point TAP or mirror port.

The software gathers data about the response time in interactions between clients and servers for both connectivity-level and application-level transactions. This metadata empowers admins to regulate traffic flows and differentiate between network issues and application issues to determine the cause of bottlenecks, slowdowns, and downtime.

These large enterprise-level tools are often equipped to alert on exception cases and to produce intuitive graphs and charts displaying detailed metrics.

This multi-layered tool provides a comprehensive view of your network, so you can quickly detect, diagnose, and resolve network performance issues and avoid downtime. NPM leverages DPI to capture packet-level data across your network by accessing managed Windows devices and drawing on installed sensors.

With probes installed on network devices, SolarWinds NPM can view and gather metadata for all the traffic across the network. The diagnostic tool then registers and displays information like response times, data volume, and transactions to locate slowdowns and flag any issues. These DPI insights guide you in determining whether the application or the network is the cause of poor user experience and create a hop-by-hop packet path map for you to view bottleneck locations at a glance.

Article Contributed By :. Himanshu Gupta Easy Normal Medium Hard Expert. Writing code in comment? Please use ide. Load Comments. What's New. Most popular in Computer Networks. More related articles in Computer Networks. Packet sniffing is invaluable when you've got to really dig down beyond the top layer of a problem to get a better picture of what's happening, or what isn't happening and should be!

Every IT professional, from companies big or small, knows the value of data. The package includes real-time displays of packet information, which is derived from NetFlow data extractors, and also statistical functions that capture packets, analyze the header contents, and produces aggregated traffic characteristics. Installs on Windows Server. Start a day free trial. Runs on Windows Server and Linux. Wireshark A free packet capture and analysis tool that has a great graphical front-end for viewing traffic statistics.

Kismet A free packet sniffer for wireless networks. Available for Linux, macOS, and Unix. EtherApe A free packet capture tool. Runs on Linux, macOS, and Unix. Cain and Abel Known as a hacker tool, this system includes a wireless packet sniffer. Runs on windows. Network Miner Available in free and paid versions, this tool captures packets and displays them live on screen. Runs on macOS. There's almost too many choices in this category of software. They also range from free to quite expensive for corporate licensing!

What should you look for in free network analyzers for traffic management? We reviewed the market for free packet sniffers and analyzed the options based on the following criteria: The ability to communicate with switches and routers using NetFlow, sFlow, J-Flow, and Netstream Suitability for multi-vendor environments An alerting system to warn of potential bottlenecks Traffic shaping measures, such as queuing methodologies The option to analyze network packets by sorting, filtering, grouping, and searching A way to try paid network analyzers for free Tools that work and are not a waste of time installing With these selection criteria in mind, we have identified some excellent traffic analyzers that have good reputations.

What this means, more plainly, is it pays mind to more of the pure motility of the network. Pros: Great interface that balances visualizations and key insights well Highly customizable reports, dashboards, and monitoring tools Uses simple QoS rules for quick traffic shaping Built with large networks in mind, can scale to 50, flows Available for both Linux and Windows Cons: Is a highly specialized suite of tools designed for network professionals, not designed for non-technical users In particular this part of the program ferrets out the bandwidth hogs and anomalies, sorted by merit of users, protocols, or applications.

Pros: Supports multiple protocols like NetFlow, great for monitoring Cisco equipment Both tools work well alongside each other to help view traffic patterns and bandwidth usage Easy to use interface automatically highlights bandwidth hogs and other network traffic outliers Scale well, designed for large enterprise networks Can view traffic on a per-hop basis, allowing for granular traffic analysis Cons: Built for enterprise use, not designed for small home networks Click the link below to get started today with a day free trial of this product in your network!

Editors Rating. Overall Rating. Analysts should also have some understanding of the types of network traffic that exist on a normally functioning network such as ARP and DHCP traffic. While almost everything uses tcpdump at its core more on that later , enterprise-level tools can provide other analytical functions such as correlating traffic from many servers, providing intelligent query tools to spot issues, alerting on exception cases, and producing nice graphs that management demands.

Enterprise-level tools tend to focus on network traffic flow rather than judging packet content. By that, I mean that the focus of most sysadmins in an enterprise is to keep the network humming along without performance bottlenecks. When bottlenecks occur, the goal is usually to determine if the problem is the network or an application on the network.

On the other side of the coin, these enterprise-level tools are usually able to see so much traffic that they can help predict when a network segment will saturate which is a critical element of capacity management. Packet sniffers are also used by hackers. Be aware that these tools can be used to attack your network as well as to solve problems. Invest in intrusion detection systems to protect your network from these forms of unauthorized access.

The key feature of a packet sniffer is that it copies data as it travels across a network and makes it available for viewing. The sniffing device simply copies all of the data that it sees passing over a network. When implemented on a switch, settings of the device allow the passing packet to be sent to a second port as well as the intended destination, thus duplicating traffic. Usually, the packets of data that are reaped from the network get copied to a file.

Some tools will also show that data in a dashboard. However, packet sniffers can gather a lot of data, which includes encoded admin information. You will need to find an analysis tool that can help you be dereferencing information on the journey of the packets in the extract and other pieces of information, such as the relevance of the port numbers that the packets travel between.

A straightforward packet sniffer will copy over all of the packets traveling on the network. This can be a problem. If t cases, the contents of the packet are not needed for network performance analysis. If you want to track network usage over a 24 hour period or over a few days, then storing every packet will occupy a very large amount of disk space — even if you are only taking in the packet headers. In these scenarios, it is advisable to sample packets, which means copy every 10th or 20th packet rather than copying over every single one.

They can also be used by more junior sysadmins to gain experience with how modern networks look during day-to-day operations, which will help identify network issues later on. We reviewed the market for packet sniffers and analyzed the options based on the following criteria:. SolarWinds is a comprehensive suite of IT management tools. The tool that is more relevant to this article is the Deep Packet Inspection and Analysis tool. Collecting network traffic activity is relatively straightforward.

But not all situations are that cut and dried. In a bustling network, it may be hard to determine even some fundamental things such as:. The contents of the packet are unknown to the network device. Deep Packet Inspection is different; it means that the actual contents of the packet are inspected to learn more about it. Critical network information that cannot be gleaned from the metadata can be discovered in this way.

Tools like those provided by SolarWinds can provide more meaningful data than simply traffic flow. Other techniques for managing high volume networks include NetFlow and sFlow. Each has its strengths and weaknesses and you can read more about NetFlow and sFlow techniques here. Network analysis, in general, is an advanced topic that is half experience and half training.

SolarWinds Network Performance Monitor mode gives detailed insights into what causes network slowness and allows you to quickly resolve the root causes using deep packet inspection. By identifying traffic by application, category business vs. With a great user interface, this excellent packet sniffing software is perfect for network analysis. Get 30 Day Free Trial: www. It helps you manage your network and your servers. The network monitoring segment of the utility covers two types of tasks.

These are a network performance monitor, which examines the statuses of network devices and a network bandwidth analyzer, which covers the flow of traffic over links in the network. The bandwidth analysis part of PRTG is implemented through the use of four different packet capture tools. These are:.

The PRTG packet sniffer only captures the headers of the packets traveling across your network. This gives the packet analyzer a speed advantage and it also reduces the amount of storage space needed to hold capture files.

The dashboard of the packet sniffer categorizes traffic by application type. These include email traffic, web packets, chat app traffic data, and file transfer packet volumes. NetFlow is a very widely used data flow messaging system. It was created by Cisco Systems but it is also used for equipment produced by other manufacturers. The J-Flow method is a similar messaging system used by Juniper Networks for its equipment.

The sFlow standard samples traffic flows, so it will collect every nth packet. NetFlow and J-Flow both capture continuous streams of packets.