Content deleted Content added
Tag: Reverted |
m simplify link |
||
| (14 intermediate revisions by 9 users not shown) | |||
Line 2:
{{Use mdy dates|date=December 2020}}
{{Use American English|date=March 2015}}
{{more refs|date=June 2025}}
[[File:Wireshark 3.6 screenshot.png|thumb|Screenshot of Wireshark network protocol analyzer]]
A '''packet analyzer''' (also '''packet sniffer''' or '''network analyzer''')<ref name="Chapple2018">{{cite book |last1=Chapple |first1=Mike |last2=Stewart |first2=James Michael |last3=Gibson |first3=Darril |title=(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide |date=2018 |publisher=John Wiley & Sons |isbn=978-1-119-47587-3 |url=https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647 |language=en |quote=A sniffer (also called a packet analyzer or protocol analyzer) is a software application that captures traffic traveling over the network. |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405072609/https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647 |url-status=live }}</ref><ref name="Rakibul2020">{{cite book |last1=Rakibul |first1=Hoque, Md |last2=Edward |first2=Bashaw, R. |title=Cross-Border E-Commerce Marketing and Management |date=2020 |publisher=[[IGI Global]] |isbn=978-1-7998-5824-9 |page=186 |url=https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186 |quote=Packet Sniffing: It is also known as packet analyzer, protocol analyzer |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405180903/https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186 |url-status=live }}</ref><ref name="Trost2009">{{cite book |last1=Trost |first1=Ryan |title=Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century: Prevention and Detection for the Twenty-First Century |date=2009 |publisher=Pearson Education |isbn=978-0-321-59188-3 |url=https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59 |quote=A packet sniffer (also known as a packet analyzer, protocol analyzer, or networkanalyzer) monitors network traffic |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405072610/https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59 |url-status=live }}</ref><ref>{{cite book |last1= |first1= |title=Cyber Law, Privacy, and Security: Concepts, Methodologies, Tools, and Applications |date=2019 |publisher=IGI Global |isbn=978-1-5225-8898-6 |page=58 |url=https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58 |quote=Packet Sniffing: A packet analyzer, also called as a network analyzer, protocol analyzer or packet sniffer |access-date=March 23, 2023 |archive-date=April 6, 2023 |archive-url=https://web.archive.org/web/20230406043813/https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58 |url-status=live }}</ref><ref name="Asrodia2012">{{cite journal |last1=Asrodia |first1=Pallavi |last2=Patel |first2=Hemlata |title=Analysis of Various Packet Sniffing Tools for Network Monitoring and Analysis |journal=International Journal of Electrical, Electronics and Computer Engineering |date=2012 |page=55 |citeseerx=10.1.1.429.567 |issn=2277-2626 |quote=Packet Sniffing... also known as Network or Protocol Analyzer or Ethernet Sniffer}}</ref><ref name="kaspersky2018">{{cite web |title=What is a Packet Sniffer? |url=https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer |website=www.kaspersky.com |date=2018 |access-date=December 26, 2021 |archive-date=August 30, 2023 |archive-url=https://web.archive.org/web/20230830125455/https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer |url-status=live }}</ref><ref name="Endace2023">{{cite web |title=What is Network Packet Capture? |url=https://www.endace.com/learn/what-is-network-packet-capture |website=www.endace.com |date=2023 |access-date=April 5, 2023 |archive-date=July 30, 2023 |archive-url=https://web.archive.org/web/20230730185317/https://www.endace.com/learn/what-is-network-packet-capture |url-status=live }}</ref><ref name="PcMag">{{cite web |title=Definition of network analyzer |url=https://www.pcmag.com/encyclopedia/term/network-analyzer |website=PCMAG |access-date=December 26, 2021 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405180906/https://www.pcmag.com/encyclopedia/term/network-analyzer |url-status=live }}</ref> is a [[computer program]] or [[computer hardware]] such as a [[packet capture appliance]] that can [[Traffic analysis|analyze]] and [[Logging (computing)|log]] traffic that passes over a [[computer network]] or part of a network.<ref>{{cite book|title=Law of Internet Security and Privacy|author=Kevin J. Connolly|pages=131|year=2003|isbn=978-0-7355-4273-0|publisher=[[Aspen Publishers]]}}</ref> '''Packet capture''' is the process of intercepting and logging traffic. As [[data stream]]s flow across the network, the analyzer captures each [[Network packet|packet]] and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate [[Request for Comments|RFC]] or other specifications.▼
A packet analyzer used for intercepting traffic on wireless networks is known as a '''wireless analyzer''' - those designed specifically for [[
▲A '''packet analyzer''' (also '''packet sniffer''' or '''network analyzer''')<ref name="Chapple2018">{{cite book |last1=Chapple |first1=Mike |last2=Stewart |first2=James Michael |last3=Gibson |first3=Darril |title=(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide |date=2018 |publisher=John Wiley & Sons |isbn=978-1-119-47587-3 |url=https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647 |language=en |quote=A sniffer (also called a packet analyzer or protocol analyzer) is a software application that captures traffic traveling over the network. |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405072609/https://books.google.com/books?id=psJVDwAAQBAJ&pg=PA647 |url-status=live }}</ref><ref name="Rakibul2020">{{cite book |last1=Rakibul |first1=Hoque, Md |last2=Edward |first2=Bashaw, R. |title=Cross-Border E-Commerce Marketing and Management |date=2020 |publisher=IGI Global |isbn=978-1-7998-5824-9 |page=186 |url=https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186 |quote=Packet Sniffing: It is also known as packet analyzer, protocol analyzer |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405180903/https://books.google.com/books?id=xrkIEAAAQBAJ&pg=PA186 |url-status=live }}</ref><ref name="Trost2009">{{cite book |last1=Trost |first1=Ryan |title=Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century: Prevention and Detection for the Twenty-First Century |date=2009 |publisher=Pearson Education |isbn=978-0-321-59188-3 |url=https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59 |quote=A packet sniffer (also known as a packet analyzer, protocol analyzer, or networkanalyzer) monitors network traffic |access-date=March 23, 2023 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405072610/https://books.google.com/books?id=3y2fhCaJJA0C&pg=PT59 |url-status=live }}</ref><ref>{{cite book |last1= |first1= |title=Cyber Law, Privacy, and Security: Concepts, Methodologies, Tools, and Applications |date=2019 |publisher=IGI Global |isbn=978-1-5225-8898-6 |page=58 |url=https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58 |quote=Packet Sniffing: A packet analyzer, also called as a network analyzer, protocol analyzer or packet sniffer |access-date=March 23, 2023 |archive-date=April 6, 2023 |archive-url=https://web.archive.org/web/20230406043813/https://books.google.com/books?id=OpGbDwAAQBAJ&pg=PA58 |url-status=live }}</ref><ref name="Asrodia2012">{{cite journal |last1=Asrodia |first1=Pallavi |last2=Patel |first2=Hemlata |title=Analysis of Various Packet Sniffing Tools for Network Monitoring and Analysis |journal=International Journal of Electrical, Electronics and Computer Engineering |date=2012 |page=55 |citeseerx=10.1.1.429.567 |issn=2277-2626 |quote=Packet Sniffing... also known as Network or Protocol Analyzer or Ethernet Sniffer}}</ref><ref name="kaspersky2018">{{cite web |title=What is a Packet Sniffer? |url=https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer |website=www.kaspersky.com |date=2018 |access-date=December 26, 2021 |archive-date=August 30, 2023 |archive-url=https://web.archive.org/web/20230830125455/https://www.kaspersky.com/resource-center/definitions/what-is-a-packet-sniffer |url-status=live }}</ref><ref name="Endace2023">{{cite web |title=What is Network Packet Capture? |url=https://www.endace.com/learn/what-is-network-packet-capture |website=www.endace.com |date=2023 |access-date=April 5, 2023 |archive-date=July 30, 2023 |archive-url=https://web.archive.org/web/20230730185317/https://www.endace.com/learn/what-is-network-packet-capture |url-status=live }}</ref><ref name="PcMag">{{cite web |title=Definition of network analyzer |url=https://www.pcmag.com/encyclopedia/term/network-analyzer |website=PCMAG |access-date=December 26, 2021 |archive-date=April 5, 2023 |archive-url=https://web.archive.org/web/20230405180906/https://www.pcmag.com/encyclopedia/term/network-analyzer |url-status=live }}</ref> is a [[computer program]] or [[computer hardware]] such as a [[packet capture appliance]] that can [[Traffic analysis|analyze]] and [[Logging (computing)|log]] traffic that passes over a [[computer network]] or part of a network.<ref>{{cite book|title=Law of Internet Security and Privacy|author=Kevin J. Connolly|pages=131|year=2003|isbn=978-0-7355-4273-0|publisher=[[Aspen Publishers]]}}</ref> '''Packet capture''' is the process of intercepting and logging traffic. As [[data stream]]s flow across the network, the analyzer captures each [[Network packet|packet]] and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate [[Request for Comments|RFC]] or other specifications.
▲A packet analyzer used for intercepting traffic on wireless networks is known as a '''wireless analyzer''' - those designed specifically for [[WiFi]] networks are '''WiFi analyzers'''. While a packet analyzer can also be referred to as a [[Network analyzer (disambiguation)|network analyzer]] or [[protocol analyzer]] these terms can also have other meanings. Protocol analyzer can technically be a broader, more general class that includes packet analyzers/sniffers.<ref>{{cite journal |last1=Sikos |first1=Leslie F. |title=Packet analysis for network forensics: A comprehensive survey |journal=Forensic Science International: Digital Investigation |date=2020 |volume=32 |page=200892 |doi=10.1016/j.fsidi.2019.200892 |s2cid=212863330 |issn=2666-2817 |quote=Those protocol analyzers that are designed for packet analysis are called packet analyzers (packet sniffers, sometimes network analyzers).|doi-access=free }}</ref> However, the terms are frequently used interchangeably.<ref>{{cite book |last1=Poulton |first1=Don |title=MCTS 70-642 Cert Guide: Windows Server 2008 Network Infrastructure, Configuring |date=2012 |publisher=Pearson Education |isbn=978-0-13-280216-1 |url=https://books.google.com/books?id=VQuWAAAAQBAJ&pg=PT1267 |quote=protocol analyzer. Also known as a network analyzer or packet analyzer, a protocol analyzer is a hardware device or software program that enables you to capture, store, and analyze each packet that crosses your network |access-date=March 23, 2023 |archive-date=April 13, 2023 |archive-url=https://web.archive.org/web/20230413100037/https://books.google.com/books?id=VQuWAAAAQBAJ&pg=PT1267 |url-status=live }}</ref>
==Capabilities==
On wired [[shared-medium network]]s, such as [[Ethernet]], [[Token Ring]], and [[FDDI]], depending on the network structure ([[Ethernet hub|hub]] or [[network switch|switch]]),<ref>{{Cite web |title = Network Segment Definition |url = http://www.linfo.org/network_segment.html |website = www.linfo.org |access-date = January 14, 2016 |archive-date = June 7, 2023 |archive-url = https://web.archive.org/web/20230607181215/http://www.linfo.org/network_segment.html |url-status = live }}</ref>{{efn|Some methods avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g., [[ARP spoofing]]).}} it may be possible to capture all traffic on the network from a single machine. On modern networks, traffic can be captured using a network switch using [[port mirroring]], which mirrors all packets that pass through designated ports of the switch to another port, if the switch supports port mirroring. A [[network tap]] is an even more reliable solution than
On [[wireless LAN]]s, traffic can be captured on one channel at a time, or by using multiple adapters, on several channels simultaneously.{{fact|date=June 2025}}
On wired broadcast and wireless LANs, to capture [[unicast]] traffic between other machines, the [[network adapter]] capturing the traffic must be in [[promiscuous mode]]. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the [[Service set (802.11 network)|service set]] the adapter is configured for are usually ignored. To see those packets, the adapter must be in [[monitor mode]].{{Citation needed|date=January 2012}} No special provisions are required to capture [[multicast]] traffic to a multicast group the packet analyzer is already monitoring, or [[Broadcasting (networking)|broadcast]] traffic.
When traffic is captured, either the entire contents of packets or just the [[header (computing)|header]]s are recorded. Recording just headers reduces storage requirements
Captured information is decoded from raw digital form into a [[human-readable format]] that lets engineers review exchanged information. Protocol analyzers vary in their abilities to display and analyze data.{{fact|date=June 2025}}
Some protocol analyzers can also generate traffic. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the [[device under test]]'s ability to handle errors.<ref>{{Cite web |title=Lab Protocol Analyzers |url=https://www.amilabs.com/labanalyzers.htm |access-date=2023-06-30 |website=www.amilabs.com |archive-date=June 30, 2023 |archive-url=https://web.archive.org/web/20230630023940/https://www.amilabs.com/labanalyzers.htm |url-status=live }}</ref><ref>{{Cite web |last=shivakumar |date=2020-12-18 |title=Where is Protocol analyzer used? |url=https://prodigytechno.com/where-protocol-analyzer-is-used/ |access-date=2023-06-30 |website=Prodigy Technovations |language=en-US |archive-date=June 30, 2023 |archive-url=https://web.archive.org/web/20230630025446/https://prodigytechno.com/where-protocol-analyzer-is-used/ |url-status=live }}</ref>
Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets or packet headers to a disk array.{{fact|date=June 2025}}
==Uses==
Packet analyzers can:{{fact|date=June 2025}}
* Analyze network problems
Line 44 ⟶ 43:
* Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content [[encryption]] methods that may be in use)
* [[Reverse engineer]] [[proprietary protocol]]s used over the network
* Debug [[
* Debug network protocol implementations
* Verify adds, moves, and changes
* Verify internal control system effectiveness ([[Firewall (computing)|firewalls]], access control, Web filter, spam filter, proxy)
Packet capture can be used to fulfill a warrant from a [[law enforcement agency]] to [[wiretap]] all network traffic generated by an individual. [[Internet service provider]]s and [[VoIP]] providers in the United States must comply with [[Communications Assistance for Law Enforcement Act]] regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and can use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception. By using [[end-to-end encryption]], communications can be kept confidential from telecommunication carriers and legal authorities.
==Notable packet analyzers==
{{
{{div col|colwidth=20em}}
* Allegro Network Multimeter
Line 74 ⟶ 73:
*[[snoop (software)|snoop]]
*[[tcpdump]]
*[[Viavi Solutions#Service Enablement (SE)|Observer Analyzer]]
*[[Wireshark]] (formerly known as Ethereal)
Line 97 ⟶ 95:
{{Commons category|Computer data network analyzers}}
{{Wikiversity | Packet analyzer}}
* [https://www.endace.com/learn/what-is-network-packet-capture Packet Capture]
| |||