Difference between pages "Tcpdump" and "Wireshark"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(New page: {{Infobox_Software | name = tcpdump | maintainer = The Tcpdump team | os = {{Linux}} | genre = Network forensics | license = {{BSD license}} | website = [http://www.tcpdump.org...)
 
(New page: {{Infobox_Software | name = Wireshark | maintainer = The Wireshark team | os = {{Linux}}, {{Windows}} | genre = Network forensics | license = {{GPL}} | website = [http://www.wi...)
 
Line 1: Line 1:
 
{{Infobox_Software |
 
{{Infobox_Software |
   name = tcpdump |
+
   name = Wireshark |
   maintainer = The Tcpdump team |
+
   maintainer = The Wireshark team |
   os = {{Linux}} |
+
   os = {{Linux}}, {{Windows}} |
 
   genre = Network forensics |
 
   genre = Network forensics |
   license = {{BSD license}} |
+
   license = {{GPL}} |
   website = [http://www.tcpdump.org/ www.tcpdump.org] |
+
   website = [http://www.wireshark.org/ www.wireshark.org] |
 
}}
 
}}
  
'''tcpdump''' is a common packet sniffer for [[Unix]]-like operating systems ([[Linux]], [[BSD]], etc).
 
  
[[Category:Network Forensics]]
+
'''Wireshark''' is a popular network protocol analyzer.
  
 
== Overview ==
 
== Overview ==
  
tcpdump prints out a description of the contents of packets on a network interface that match the boolean expression.
+
Wireshark has a rich feature set which includes the following:
It can also save the packet data to a file for later analysis.
+
 
 +
* Deep inspection of hundreds of protocols;
 +
* Live capture and offline analysis;
 +
* Standard three-pane packet browser;
 +
* Multi-platform: runs on [[Windows]], [[Linux]], [[Mac OS X]], [[Solaris]], [[FreeBSD]], [[NetBSD]], and many others;
 +
* Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility;
 +
* Powerful display filters;
 +
* Rich [[VoIP]] analysis;
 +
* Read/write many different capture file formats: tcpdump (libpcap), Catapult DCT2000, Cisco Secure IDS iplog, [[Microsoft Network Monitor]], Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others;
 +
* Capture files compressed with gzip can be decompressed on the fly;
 +
* Live data can be read from [[Ethernet]], [[Wireless forensics|IEEE 802.11]], PPP/HDLC, ATM, [[Bluetooth]], [[USB]], Token Ring, Frame Relay, FDDI, and others (depending on your platfrom);
 +
* Decryption support for many protocols, including [[IPsec]], ISAKMP, Kerberos, SNMPv3, [[SSL forensics|SSL/TLS]], [[Wireless forensics|WEP, and WPA/WPA2]];
 +
* Coloring rules can be applied to the packet list for quick, intuitive analysis;
 +
* Output can be exported to [[XML]], PostScript®, [[CSV]], or plain text.
 +
 
 +
== Network Forensics ==
 +
 
 +
Wireshark can be used in the [[network forensics]] process. There are some limitations:
 +
 
 +
* Wireshark is packet-centric (not data-centric);
 +
* Wireshark doesn't work well with large network capture files (you can turn all packet coloring rules off to increase performance);
 +
 
 +
=== Wireless Forensics ===
 +
 
 +
Wireshark can decrypt IEEE 802.11 WLAN data with user specified encryption keys.
  
 
== External Links  ==
 
== External Links  ==
  
* [http://www.winpcap.org/windump/ WinDump - tcpdump for Windows]
+
* [http://wiki.wireshark.org/ Wireshark Wiki]
 +
 
 +
== See Also ==
 +
 
 +
* [[tcpdump]]
 +
 
 +
[[Category:Network Forensics]]

Revision as of 10:16, 28 August 2008

Wireshark
Maintainer: The Wireshark team
OS: Linux,Windows
Genre: Network forensics
License: GPL
Website: www.wireshark.org


Wireshark is a popular network protocol analyzer.

Contents

Overview

Wireshark has a rich feature set which includes the following:

  • Deep inspection of hundreds of protocols;
  • Live capture and offline analysis;
  • Standard three-pane packet browser;
  • Multi-platform: runs on Windows, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, and many others;
  • Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility;
  • Powerful display filters;
  • Rich VoIP analysis;
  • Read/write many different capture file formats: tcpdump (libpcap), Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others;
  • Capture files compressed with gzip can be decompressed on the fly;
  • Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom);
  • Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2;
  • Coloring rules can be applied to the packet list for quick, intuitive analysis;
  • Output can be exported to XML, PostScript®, CSV, or plain text.

Network Forensics

Wireshark can be used in the network forensics process. There are some limitations:

  • Wireshark is packet-centric (not data-centric);
  • Wireshark doesn't work well with large network capture files (you can turn all packet coloring rules off to increase performance);

Wireless Forensics

Wireshark can decrypt IEEE 802.11 WLAN data with user specified encryption keys.

External Links

See Also