Wireshark

Packet analysis, often referred to as packet sniffing or protocol analysis, describes the process of capturing and interpreting live data as it flows across a network in order to better understand what is happening on that network.  Packet analysis is typically performed by a packet sniffer, a tool used to capture raw network data going across the wire.

Packet analysis can help with the following:

• Understanding network characteristics
• Learning who is on a network
• Determining who or what is utilizing available bandwidth
• Identifying peak network usage times
• Identifying possible attacks or malicious activity
• Finding unsecured and bloated applications

There are various types of packet-sniffing programs, including both free and commercial ones.  Each program is designed with different goals in mind.  A few popular packet-analysis programs are Wireshark, tcpdump and OmniPeek.  Wireshark and OmniPeek have graphical user interfaces while tcpdump is a command-line program.

Wireshark is an open source multi-platform network protocol analyzer.  It allows you to examine data from a live network or from a capture file on disk.  You can interactively browse the capture data, delving down into just the level of packet detail you need.  Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.  It also supports a large number of protocols and media types.

How Packet Sniffers work:

The packet-sniffing process involves a co-operative effort between software and hardware.  This process can be broken down into three steps:

Collection  In the first step, the packet sniffer collects raw binary data from the wire.  Typically, this is done by switching the selected network interface into promiscuous mode. In this mode, the network card can listen to all traffic on a network segment, not only the traffic that is addressed to it.

Conversion  In this step, the captured binary data is converted into a readable form.  This is where most advanced command-line packet sniffers stop.  At this point, the network data is in a form that can be interpreted only on a very basic level, leaving the majority of the analysis to the end user.  

Analysis   The third and final step involves the actual analysis of the captured and converted data.  The packet sniffer takes the captured network data, verifies its protocol based on the information extracted, and begins its analysis of that protocol's specific features.