SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Packet analyzer</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Packet analyzer</span></span>

</h1>

</header>

</p>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

<p>A <b>packet analyzer</b> (also <b>packet sniffer</b> or <b>network analyzer</b>)<sup id="cite_ref-Chapple2018_1-0" class="reference"><a href="#cite_note-Chapple2018-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Rakibul2020_2-0" class="reference"><a href="#cite_note-Rakibul2020-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Trost2009_3-0" class="reference"><a href="#cite_note-Trost2009-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Asrodia2012_5-0" class="reference"><a href="#cite_note-Asrodia2012-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-kaspersky2018_6-0" class="reference"><a href="#cite_note-kaspersky2018-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Endace2023_7-0" class="reference"><a href="#cite_note-Endace2023-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-PcMag_8-0" class="reference"><a href="#cite_note-PcMag-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup> is a <a href="Computer_program" title="Computer program">computer program</a> or <a href="Computer_hardware" title="Computer hardware">computer hardware</a> such as a <a href="Packet_capture_appliance" title="Packet capture appliance">packet capture appliance</a> that can <a href="Traffic_analysis" title="Traffic analysis">analyze</a> and <a href="Logging_(computing)" title="Logging (computing)">log</a> traffic that passes over a <a href="Computer_network" title="Computer network">computer network</a> or part of a network.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup> <b>Packet capture</b> is the process of intercepting and logging traffic. As <a href="Data_stream" title="Data stream">data streams</a> flow across the network, the analyzer captures each <a href="Network_packet" title="Network packet">packet</a> and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate <a href="Request_for_Comments" title="Request for Comments">RFC</a> or other specifications.

</p><p>A packet analyzer used for intercepting traffic on wireless networks is known as a <b>wireless analyzer</b> - those designed specifically for <a href="Wi-Fi" title="Wi-Fi">Wi-Fi</a> networks are <b>Wi-Fi analyzers</b>.<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>a<span class="cite-bracket">]</span></a></sup> While a packet analyzer can also be referred to as a <a href="Network_analyzer_(disambiguation)" class="mw-redirect mw-disambig" title="Network analyzer (disambiguation)">network analyzer</a> or <a href="Protocol_analyzer" title="Protocol analyzer">protocol analyzer</a> these terms can also have other meanings. Protocol analyzer can technically be a broader, more general class that includes packet analyzers/sniffers.<sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> However, the terms are frequently used interchangeably.<sup id="cite_ref-12" class="reference"><a href="#cite_note-12"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Capabilities">Capabilities</h2></div>

<p>On wired <a href="Shared-medium_network" class="mw-redirect" title="Shared-medium network">shared-medium networks</a>, such as <a href="Ethernet" title="Ethernet">Ethernet</a>, <a href="Token_Ring" title="Token Ring">Token Ring</a>, and <a href="FDDI" class="mw-redirect" title="FDDI">FDDI</a>, depending on the network structure (<a href="Ethernet_hub" title="Ethernet hub">hub</a> or <a href="Network_switch" title="Network switch">switch</a>),<sup id="cite_ref-13" class="reference"><a href="#cite_note-13"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>b<span class="cite-bracket">]</span></a></sup> it may be possible to capture all traffic on the network from a single machine. On modern networks, traffic can be captured using a network switch using <a href="Port_mirroring" title="Port mirroring">port mirroring</a>, which mirrors all packets that pass through designated ports of the switch to another port, if the switch supports port mirroring. A <a href="Network_tap" title="Network tap">network tap</a> is an even more reliable solution than using a monitoring port since taps are less likely to drop packets during high traffic loads.

</p><p>On <a href="Wireless_LAN" title="Wireless LAN">wireless LANs</a>, traffic can be captured on one channel at a time, or by using multiple adapters, on several channels simultaneously.

</p><p>On wired broadcast and wireless LANs, to capture <a href="Unicast" title="Unicast">unicast</a> traffic between other machines, the <a href="Network_adapter" class="mw-redirect" title="Network adapter">network adapter</a> capturing the traffic must be in <a href="Promiscuous_mode" title="Promiscuous mode">promiscuous mode</a>. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the <a href="Service_set_(802.11_network)" title="Service set (802.11 network)">service set</a> the adapter is configured for are usually ignored. To see those packets, the adapter must be in <a href="Monitor_mode" title="Monitor mode">monitor mode</a>. No special provisions are required to capture <a href="Multicast" title="Multicast">multicast</a> traffic to a multicast group the packet analyzer is already monitoring, or <a href="Broadcasting_(networking)" title="Broadcasting (networking)">broadcast</a> traffic.

</p><p>When traffic is captured, either the entire contents of packets or just the <a href="Header_(computing)" title="Header (computing)">headers</a> are recorded. Recording just headers reduces storage requirements and avoids some <a href="Privacy_law" title="Privacy law">privacy legal issues</a>, yet often provides sufficient information to diagnose problems.

</p><p>Captured information is decoded from raw digital form into a <a href="Human-readable_format" class="mw-redirect" title="Human-readable format">human-readable format</a> that lets engineers review exchanged information. Protocol analyzers vary in their abilities to display and analyze data.

</p><p>Some protocol analyzers can also generate traffic. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the <a href="Device_under_test" title="Device under test">device under test</a>'s ability to handle errors.<sup id="cite_ref-15" class="reference"><a href="#cite_note-15"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-16" class="reference"><a href="#cite_note-16"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup>

</p><p>Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets or packet headers to a disk array.

</p>

<p>Packet analyzers can:

</p>

<ul><li>Analyze network problems</li>

<li>Detect <a href="Network_intrusion_detection_system" class="mw-redirect" title="Network intrusion detection system">network intrusion</a> attempts</li>

<li>Detect network misuse by internal and external users</li>

<li>Documenting regulatory compliance through logging all perimeter and endpoint traffic</li>

<li>Gain information for effecting a network intrusion</li>

<li>Identify data collection and sharing of software such as operating systems (for strengthening <a href="Privacy" title="Privacy">privacy</a>, control and security)</li>

<li>Aid in gathering information to isolate exploited systems</li>

<li>Monitor WAN bandwidth utilization</li>

<li>Monitor network usage (including internal and external users and systems)</li>

<li>Monitor <a href="Data_in_transit" title="Data in transit">data in transit</a></li>

<li>Monitor WAN and <a href="Endpoint_security" title="Endpoint security">endpoint security</a> status</li>

<li>Gather and report network statistics</li>

<li>Identify suspect content in network traffic</li>

<li>Troubleshoot performance problems by monitoring network data from an application</li>

<li>Serve as the primary data source for day-to-day network monitoring and management</li>

<li>Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content <a href="Encryption" title="Encryption">encryption</a> methods that may be in use)</li>

<li><a href="Reverse_engineer" class="mw-redirect" title="Reverse engineer">Reverse engineer</a> <a href="Proprietary_protocol" title="Proprietary protocol">proprietary protocols</a> used over the network</li>

<li>Debug <a href="Client%E2%80%93server_communication" class="mw-redirect" title="Client–server communication">client–server communication</a></li>

<li>Debug network protocol implementations</li>

<li>Verify adds, moves, and changes</li>

<li>Verify internal control system effectiveness (<a href="Firewall_(computing)" title="Firewall (computing)">firewalls</a>, access control, Web filter, spam filter, proxy)</li></ul>

<p>Packet capture can be used to fulfill a warrant from a <a href="Law_enforcement_agency" title="Law enforcement agency">law enforcement agency</a> to <a href="Wiretap" class="mw-redirect" title="Wiretap">wiretap</a> all network traffic generated by an individual. <a href="Internet_service_provider" title="Internet service provider">Internet service providers</a> and <a href="VoIP" class="mw-redirect" title="VoIP">VoIP</a> providers in the United States must comply with <a href="Communications_Assistance_for_Law_Enforcement_Act" title="Communications Assistance for Law Enforcement Act">Communications Assistance for Law Enforcement Act</a> regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and can use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception. By using <a href="End-to-end_encryption" title="End-to-end encryption">end-to-end encryption</a>, communications can be kept confidential from telecommunication carriers and legal authorities.

</p>

<div class="mw-heading mw-heading2"><h2 id="Notable_packet_analyzers">Notable packet analyzers</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">For a more comprehensive list, see <a href="Comparison_of_packet_analyzers" title="Comparison of packet analyzers">Comparison of packet analyzers</a>.</div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .div-col{margin-top:0.3em;column-width:30em}.mw-parser-output .div-col-small{font-size:90%}.mw-parser-output .div-col-rules{column-rule:1px solid #aaa}.mw-parser-output .div-col dl,.mw-parser-output .div-col ol,.mw-parser-output .div-col ul{margin-top:0}.mw-parser-output .div-col li,.mw-parser-output .div-col dd{page-break-inside:avoid;break-inside:avoid-column}

/* end https://en.wikipedia.org/ */

</style><div class="div-col" style="column-width: 20em;">

<ul><li>Allegro Network Multimeter</li>

<li><a href="Capsa_(software)" title="Capsa (software)">Capsa</a> Network Analyzer</li>

<li><a href="Charles_Proxy" title="Charles Proxy">Charles Web Debugging Proxy</a></li>

<li><a href="Carnivore_(software)" title="Carnivore (software)">Carnivore (software)</a></li>

<li><a href="CommView" title="CommView">CommView</a></li>

<li><a href="DSniff" title="DSniff">dSniff</a></li>

<li><a href="Endace" title="Endace">EndaceProbe Packet Capture Platform</a></li>

<li><a href="Ettercap_(software)" title="Ettercap (software)">ettercap</a></li>

<li><a href="Fiddler_(software)" class="mw-redirect" title="Fiddler (software)">Fiddler</a></li>

<li><a href="Kismet_(software)" title="Kismet (software)">Kismet</a></li>

<li><a href="Lanmeter" title="Lanmeter">Lanmeter</a></li>

<li><a href="Microsoft_Network_Monitor" title="Microsoft Network Monitor">Microsoft Network Monitor</a></li>

<li><a href="NarusInsight" class="mw-redirect" title="NarusInsight">NarusInsight</a></li>

<li><a href="NetScout_Systems" title="NetScout Systems">NetScout Systems nGenius Infinistream</a></li>

<li><a href="Ngrep" title="Ngrep">ngrep</a>, Network Grep</li>

<li><a href="OmniPeek" title="OmniPeek">OmniPeek</a>, Omnipliance by Savvius</li>

<li><a href="SkyGrabber" title="SkyGrabber">SkyGrabber</a></li>

<li>The <a href="Sniffer_(protocol_analyzer)" title="Sniffer (protocol analyzer)">Sniffer</a></li>

<li><a href="Snoop_(software)" title="Snoop (software)">snoop</a></li>

<li><a href="Tcpdump" title="Tcpdump">tcpdump</a></li>

<li><a href="Viavi_Solutions#Service_Enablement_(SE)" title="Viavi Solutions">Observer Analyzer</a></li>

<li><a href="Wireshark" title="Wireshark">Wireshark</a> (formerly known as Ethereal)</li>

<li><a href="Xplico" title="Xplico">Xplico</a> Open source Network Forensic Analysis Tool</li></ul>

</div>

<ul><li><a href="Bus_analyzer" title="Bus analyzer">Bus analyzer</a></li>

<li><a href="Logic_analyzer" title="Logic analyzer">Logic analyzer</a></li>

<li><a href="Network_detector" title="Network detector">Network detector</a></li>

<li><a href="Signals_intelligence" title="Signals intelligence">Signals intelligence</a></li>

<li><a href="Traffic_generation_model" title="Traffic generation model">Traffic generation model</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Notes">Notes</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist reflist-lower-alpha">

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text">The term Wi-Fi analyzer is also used to describe the instruments/software for <a href="Wireless_site_survey" title="Wireless site survey">wireless site surveys</a>.</span>

</li>

<li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text">Some methods avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g., <a href="ARP_spoofing" title="ARP spoofing">ARP spoofing</a>).</span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFChappleStewartGibson2018" class="citation book cs1">Chapple, Mike; Stewart, James Michael; Gibson, Darril (2018). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647"><i>(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide</i></a>. John Wiley & Sons. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-119-47587-3</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230405072609/https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647">Archived</a> from the original on April 5, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">March 23,</span> 2023</span>. <q>A sniffer (also called a packet analyzer or protocol analyzer) is a software application that captures traffic traveling over the network.</q></cite></span>

</li>

<li id="cite_note-Rakibul2020-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-Rakibul2020_2-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFRakibulEdward2020" class="citation book cs1">Rakibul, Hoque, Md; Edward, Bashaw, R. (2020). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186"><i>Cross-Border E-Commerce Marketing and Management</i></a>. <a href="IGI_Global" title="IGI Global">IGI Global</a>. p. 186. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-7998-5824-9</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230405180903/https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186">Archived</a> from the original on April 5, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">March 23,</span> 2023</span>. <q>Packet Sniffing: It is also known as packet analyzer, protocol analyzer</q></cite><span class="cs1-maint citation-comment"><code class="cs1-code">{{cite book}}</code>: CS1 maint: multiple names: authors list (link)</span></span>

</li>

<li id="cite_note-Trost2009-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-Trost2009_3-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFTrost2009" class="citation book cs1">Trost, Ryan (2009). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59"><i>Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century: Prevention and Detection for the Twenty-First Century</i></a>. Pearson Education. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-321-59188-3</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230405072610/https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59">Archived</a> from the original on April 5, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">March 23,</span> 2023</span>. <q>A packet sniffer (also known as a packet analyzer, protocol analyzer, or networkanalyzer) monitors network traffic</q></cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation book cs1"><a rel="nofollow" class="external text" href="https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58"><i>Cyber Law, Privacy, and Security: Concepts, Methodologies, Tools, and Applications</i></a>. IGI Global. 2019. p. 58. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-5225-8898-6</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230406043813/https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58">Archived</a> from the original on April 6, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">March 23,</span> 2023</span>. <q>Packet Sniffing: A packet analyzer, also called as a network analyzer, protocol analyzer or packet sniffer</q></cite></span>

</li>

<li id="cite_note-Asrodia2012-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-Asrodia2012_5-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFAsrodiaPatel2012" class="citation journal cs1">Asrodia, Pallavi; Patel, Hemlata (2012). "Analysis of Various Packet Sniffing Tools for Network Monitoring and Analysis". <i>International Journal of Electrical, Electronics and Computer Engineering</i>: 55. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.429.567">10.1.1.429.567</a></span>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/2277-2626">2277-2626</a>. <q>Packet Sniffing... also known as Network or Protocol Analyzer or Ethernet Sniffer</q></cite></span>

</li>

<li id="cite_note-kaspersky2018-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-kaspersky2018_6-0">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer">"What is a Packet Sniffer?"</a>. <i>www.kaspersky.com</i>. 2018. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230830125455/https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer">Archived</a> from the original on August 30, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">December 26,</span> 2021</span>.</cite></span>

</li>

<li id="cite_note-Endace2023-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-Endace2023_7-0">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.endace.com/learn/what-is-network-packet-capture">"What is Network Packet Capture?"</a>. <i>www.endace.com</i>. 2023. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230730185317/https://www.endace.com/learn/what-is-network-packet-capture">Archived</a> from the original on July 30, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">April 5,</span> 2023</span>.</cite></span>

</li>

<li id="cite_note-PcMag-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-PcMag_8-0">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.pcmag.com/encyclopedia/term/network-analyzer">"Definition of network analyzer"</a>. <i>PCMAG</i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230405180906/https://www.pcmag.com/encyclopedia/term/network-analyzer">Archived</a> from the original on April 5, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">December 26,</span> 2021</span>.</cite></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite id="CITEREFKevin_J._Connolly2003" class="citation book cs1">Kevin J. Connolly (2003). <i>Law of Internet Security and Privacy</i>. <a href="Aspen_Publishers" class="mw-redirect" title="Aspen Publishers">Aspen Publishers</a>. p. 131. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-7355-4273-0</bdi>.</cite></span>

</li>

<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><cite id="CITEREFSikos2020" class="citation journal cs1">Sikos, Leslie F. (2020). <a rel="nofollow" class="external text" href="https://doi.org/10.1016%2Fj.fsidi.2019.200892">"Packet analysis for network forensics: A comprehensive survey"</a>. <i>Forensic Science International: Digital Investigation</i>. <b>32</b>: 200892. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://doi.org/10.1016%2Fj.fsidi.2019.200892">10.1016/j.fsidi.2019.200892</a></span>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/2666-2817">2666-2817</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:212863330">212863330</a>. <q>Those protocol analyzers that are designed for packet analysis are called packet analyzers (packet sniffers, sometimes network analyzers).</q></cite></span>

</li>

<li id="cite_note-12"><span class="mw-cite-backlink"><b><a href="#cite_ref-12">^</a></b></span> <span class="reference-text"><cite id="CITEREFPoulton2012" class="citation book cs1">Poulton, Don (2012). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=VQuWAAAAQBAJ&pg=PT1267"><i>MCTS 70-642 Cert Guide: Windows Server 2008 Network Infrastructure, Configuring</i></a>. Pearson Education. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-13-280216-1</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230413100037/https://books.google.com/books?id=VQuWAAAAQBAJ&pg=PT1267">Archived</a> from the original on April 13, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">March 23,</span> 2023</span>. <q>protocol analyzer. Also known as a network analyzer or packet analyzer, a protocol analyzer is a hardware device or software program that enables you to capture, store, and analyze each packet that crosses your network</q></cite></span>

</li>

<li id="cite_note-13"><span class="mw-cite-backlink"><b><a href="#cite_ref-13">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.linfo.org/network_segment.html">"Network Segment Definition"</a>. <i>www.linfo.org</i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230607181215/http://www.linfo.org/network_segment.html">Archived</a> from the original on June 7, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">January 14,</span> 2016</span>.</cite></span>

</li>

<li id="cite_note-15"><span class="mw-cite-backlink"><b><a href="#cite_ref-15">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.amilabs.com/labanalyzers.htm">"Lab Protocol Analyzers"</a>. <i>www.amilabs.com</i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230630023940/https://www.amilabs.com/labanalyzers.htm">Archived</a> from the original on June 30, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">June 30,</span> 2023</span>.</cite></span>

</li>

<li id="cite_note-16"><span class="mw-cite-backlink"><b><a href="#cite_ref-16">^</a></b></span> <span class="reference-text"><cite id="CITEREFshivakumar2020" class="citation web cs1">shivakumar (December 18, 2020). <a rel="nofollow" class="external text" href="https://prodigytechno.com/where-protocol-analyzer-is-used/">"Where is Protocol analyzer used?"</a>. <i>Prodigy Technovations</i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230630025446/https://prodigytechno.com/where-protocol-analyzer-is-used/">Archived</a> from the original on June 30, 2023<span class="reference-accessdate">. Retrieved <span class="nowrap">June 30,</span> 2023</span>.</cite></span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .side-box{margin:4px 0;box-sizing:border-box;border:1px solid #aaa;font-size:88%;line-height:1.25em;background-color:var(--background-color-interactive-subtle,#f8f9fa);display:flow-root}.mw-parser-output .infobox .side-box{font-size:100%}.mw-parser-output .side-box-abovebelow,.mw-parser-output .side-box-text{padding:0.25em 0.9em}.mw-parser-output .side-box-image{padding:2px 0 2px 0.9em;text-align:center}.mw-parser-output .side-box-imageright{padding:2px 0.9em 2px 0;text-align:center}@media(min-width:500px){.mw-parser-output .side-box-flex{display:flex;align-items:center}.mw-parser-output .side-box-text{flex:1;min-width:0}}@media(min-width:720px){.mw-parser-output .side-box{width:238px}.mw-parser-output .side-box-right{clear:right;float:right;margin-left:1em}.mw-parser-output .side-box-left{margin-right:1em}}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1237033735">

/* start https://en.wikipedia.org/ */

@media print{body.ns-0 .mw-parser-output .sistersitebox{display:none!important}}@media screen{html.skin-theme-clientpref-night .mw-parser-output .sistersitebox img[src*="Wiktionary-logo-en-v2.svg"]{background-color:white}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .sistersitebox img[src*="Wiktionary-logo-en-v2.svg"]{background-color:white}}

/* end https://en.wikipedia.org/ */

</style><div class="side-box side-box-right sistersitebox"><style data-mw-deduplicate="TemplateStyles:r1126788409">

/* start https://en.wikipedia.org/ */

.mw-parser-output .plainlist ol,.mw-parser-output .plainlist ul{line-height:inherit;list-style:none;margin:0;padding:0}.mw-parser-output .plainlist ol li,.mw-parser-output .plainlist ul li{margin-bottom:0}

/* end https://en.wikipedia.org/ */

</style>

<div class="side-box-text plainlist">Wikimedia Commons has media related to <span style="font-weight: bold; font-style: italic;"><a href="https://commons.wikimedia.org/wiki/Category:Computer_data_network_analyzers" class="extiw external" title="commons:Category:Computer data network analyzers">Computer data network analyzers</a></span>.</div></div>

</div>

<div class="side-box-text plainlist">Wikiversity has learning resources about <i><b><a href="https://en.wikiversity.org/wiki/Packet_analyzer" class="extiw external" title="v:Packet analyzer"> Packet analyzer</a></b></i></div></div>

</div>

<ul><li><a rel="nofollow" class="external text" href="https://www.endace.com/learn/what-is-network-packet-capture">Packet Capture</a></li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1038841319">

/* start https://en.wikipedia.org/ */

.mw-parser-output .tooltip-dotted{border-bottom:1px dotted;cursor:help}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox authority-control" aria-label="Navbox673" style="padding:3px"><table class="nowraplinks hlist navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="row" class="navbox-group" style="width:1%">Authority control databases: National </th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"><ul><li><span class="uid"><a rel="nofollow" class="external text" href="https://d-nb.info/gnd/4783973-9">Germany</a></span></li><li><span class="uid"><span class="rt-commentedText tooltip tooltip-dotted" title="síťové analyzátory"><a rel="nofollow" class="external text" href="https://aleph.nkp.cz/F/?func=find-c&local_base=aut&ccl_term=ica=ph482817&CON_LNG=ENG">Czech Republic</a></span></span></li></ul></div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-07-19" href="https://en.wikipedia.org/wiki/?title=Packet_analyzer&oldid=1301379616">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>