Saving Captures to Disk
I've showed you how to use Ethereal to sniff network traffic and work with packets in memory. However, Ethereal can also write packet data directly to disk. And Ethereal can save packets to, and read packets from, a variety of file formats, including the capture file formats that Network Monitor, Network Associates' Sniffer, and other products use. Thus, you could, for example, use Network Monitor to capture from agents on remote segments, then use Ethereal for your data analysis.
By default, Ethereal uses the libpcap capture format, which tcpdump, WinDump, the Snort Intrusion Detection System (IDS), and many other applications use. (Libpcap format is something of a lingua franca for packet-manipulation and packet-analysis tools.) If you need to translate one vendor's file format into another's or render heterogeneous capture files into libpcap, you can use Ethereal's editcap.exe and text2pcap.exe utilities. . . .
Register
