Packet analyzer: Difference between revisions

Revision as of 11:01, 8 June 2023

Revision as of 11:01, 8 June 2023

Line 28:

* Analyze network problems

* Detect [[Network intrusion detection system|network intrusion]] attempts

* Detect network misuse by internal and external users

* Documenting regulatory compliance through logging all perimeter and endpoint traffic

* Gain information for effecting a network intrusion

* Identify data collection and sharing of software such as operating systems (for strengthening [[privacy]], control and security)

* Aid in gathering information to isolate exploited systems

* Monitor WAN bandwidth utilization

* Monitor network usage (including internal and external users and systems)

* Monitor [[data in transit]]

* Monitor WAN and [[endpoint security]] status

* Gather and report network statistics

* Identify suspect content in network traffic

* Troubleshoot performance problems by monitoring network data from an application

* Serve as the primary data source for day-to-day network monitoring and management

* Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content [[encryption]] methods that may be in use)

* [[Reverse engineering|Reverse engineer]] [[proprietary protocolsprotocol]]s used over the network

* Debug [[Client–server model|client/server communications]]

* Debug network protocol implementations

* Verify adds, moves, and changes

* Verify internal control system effectiveness ([[Firewall (computing)|firewalls]], access control, Web filter, spam filter, proxy)

Packet capture can be used to fulfill a warrant from a [[law enforcement agency]] to [[wiretap]] all network traffic generated by an individual. [[Internet service providersprovider]]s and [[VoIP]] providers in the United States must comply with [[Communications Assistance for Law Enforcement Act]] regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and can use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception. By using [[end-to-end encryption]], communications can be kept confidential from telecommunication carriers and legal authorities.<!--[[User:Kvng/RTH]]-->

==Notable packet analyzers==

{{Mainlist|Comparison of packet analyzers}}

{{div col|colwidth=20em}}

* Allegro Network Multimeter

*[[Capsa (software)|Capsa]] Network Analyzer

*[[Charles Proxy|Charles Web Debugging Proxy]]

*[[Carnivore (software)]]

*[[CommView]]

*[[dSniff]]

*[[Endace|EndaceProbe Packet Capture Platform]]

*[[Ettercap (software)|ettercap]]

*[[Fiddler (software)|Fiddler]]

*[[Kismet (software)|Kismet]]

*[[Lanmeter]]

*[[Microsoft Network Monitor]]

*[[NarusInsight]]

*[[NetScout Systems|NetScout Systems nGenius Infinistream]]

*[[ngrep]], Network Grep

*[[OmniPeek]], Omnipliance by Savvius

*[[SkyGrabber]]

*The [[Sniffer (protocol analyzer)|Sniffer]]

*[[snoop (software)|snoop]]

*[[tcpdump]]

*[[Viavi Solutions#Service Enablement (SE)|Observer Analyzer]]

*[[Wireshark]] (formerly known as Ethereal)

*[[Xplico]] Open source Network Forensic Analysis Tool

{{div col end}}

==See also==

Line 56 ⟶ 84:

*[[Network detector]]

*[[pcap]]

*[[Signals intelligence]]

*[[Traffic generation model]]

==Notes==