Packet analyzer
A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer, is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.

A packet analyzer used for intercepting traffic on wireless networks is known as a wireless analyzer or WiFi analyzer. While a packet analyzer can also be referred to as a network analyzer or protocol analyzer these terms can also have other meanings. Protocol analyzer can technically be a broader, more general class that includes packet analyzers/sniffers. However, the terms are frequently used intechangably.

Capabilities
On wired shared medium networks, such as Ethernet, Token Ring, and FDDI, depending on the network structure (hub or switch), it may be possible to capture all traffic on the network from a single machine. On modern networks, traffic can be captured using a network switch using port mirroring, which mirrors all packets that pass through designated ports of the switch to another port, if the switch supports port mirroring. A network tap is an even more reliable solution than to use a monitoring port since taps are less likely to drop packets during high traffic load.

On wireless LANs, traffic can be captured on one channel at a time, or by using multiple adapters, on several channels simultaneously.

On wired broadcast and wireless LANs, to capture unicast traffic between other machines, the network adapter capturing the traffic must be in promiscuous mode. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the service set the adapter is configured for are usually ignored. To see those packets, the adapter must be in monitor mode. No special provisions are required to capture multicast traffic to a multicast group the packet analyzer is already monitoring, or broadcast traffic.

When traffic is captured, either the entire contents of packets or just the headers are recorded. Recording just headers reduces storage requirements, and avoids some privacy legal issues, yet often provides sufficient information to diagnose problems.

Captured information is decoded from raw digital form into a human-readable format that lets engineers review exchanged information. Protocol analyzers vary in their abilities to display and analyze data.

Some protocol analyzers can also generate traffic. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the device under test's ability to handle errors.

Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets or packet headers to a disk array.

Uses
Packet analyzers can:

 Analyze network problems
 Detect network intrusion attempts
 Detect network misuse by internal and external users
 Documenting regulatory compliance through logging all perimeter and endpoint traffic
 Gain information for effecting a network intrusion
 Identify data collection and sharing of software such as operating systems (for strengthening privacy, control and security)
 Aid in gathering information to isolate exploited systems
 Monitor WAN bandwidth utilization
 Monitor network usage (including internal and external users and systems)
 Monitor data in transit
 Monitor WAN and endpoint security status
 Gather and report network statistics
 Identify suspect content in network traffic
 Troubleshoot performance problems by monitoring network data from an application
 Serve as the primary data source for day-to-day network monitoring and management
 Spy on other network users and collect sensitive information such as login details or users cookies (depending on any content encryption methods that may be in use)
 Reverse engineer proprietary protocols used over the network
 Debug client/server communications
 Debug network protocol implementations
 Verify adds, moves, and changes
 Verify internal control system effectiveness (firewalls, access control, Web filter, spam filter, proxy)

Packet capture can be used to fulfill a warrant from a law enforcement agency to wiretap all network traffic generated by an individual. Internet service providers and VoIP providers in the United States must comply with Communications Assistance for Law Enforcement Act regulations. Using packet capture and storage, telecommunications carriers can provide the legally required secure and separate access to targeted network traffic and can use the same device for internal security purposes. Collecting data from a carrier system without a warrant is illegal due to laws about interception.  By using end-to-end encryption, communications can be kept confidential from telecommunication carriers and legal authorities.

Notable packet analyzers

 Allegro Network Multimeter
Capsa Network Analyzer
Charles Web Debugging Proxy
Carnivore (software)
CommView
dSniff
EndaceProbe Analytics Platform by Endace
ettercap
Fiddler
Kismet
Lanmeter
Microsoft Network Monitor
NarusInsight
NetScout Systems nGenius Infinistream
ngrep, Network Grep
OmniPeek, Omnipliance by Savvius
SkyGrabber
The Sniffer
snoop
tcpdump
Observer Analyzer
Wireshark (formerly known as Ethereal)
Xplico Open source Network Forensic Analysis Tool

See also
Bus analyzer
Logic analyzer
Network detector
pcap
Signals intelligence
Traffic generation model

Notes

References

External links

Multi-Tap Network Packet Capture
WiFi Adapter for Packet analyzer

Network analyzers
Packets (information technology)
Wireless networking
Deep packet capture