The Ethereal Packet Sniffer

One of the best security and network troubleshooting tools available on the Internet is a protocol analyzer (or packet sniffer) named Ethereal. Ethereal runs on both Windows and Linux, sports features not found in many commercial sniffers, and, unlike the regular version of Microsoft Network Monitor, captures all packets promiscuously. And it's free!

Installing Ethereal
Installing Ethereal on Windows 9x and later is a two-step process. You must first download and install the most recent version of the WinPcap driver (version 3.0) from http://winpcap.polito.it/install. The WinPcap driver is a free Windows port of the UNIX libpcap packet-capture library. Ethereal uses WinPcap to pull packets off the network. To learn more about WinPcap's other important uses, see the Web-exclusive sidebar "WinPcap and Security Tools," http://www.winnetmag.com/windowssecurity, InstantDoc ID 40950.

To install WinPcap, double-click the downloaded setup executable; you typically don't have to reboot. If you want to cleanly uninstall WinPcap later, you'll find it listed in the Control Panel Add/Remove Programs applet. . . .