<!doctypehtml><title>
   What are popular packet sniffers on Linux
  </title><meta charset=utf-8><meta content=width=device-width,initial-scale=1 name=viewport><script async src=https://www.googletagmanager.com/gtag/js?id=UA-31255384-2></script><script>window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'UA-31255384-2');</script><script>var PAGE_URL="https://www.xmodulo.com/what-are-popular-packet-sniffers-on-linux.html";
var PAGE_IDENTIFIER=242;</script><link href=assets/xmodulo.css rel=stylesheet><body><div class=wrapper><div id=header><a href=https://www.xmodulo.com/> <img src=img/logo.jpg> </a></div><div id=container><h1>What are popular packet sniffers on Linux</h1><p><em> Last updated on November 16, 2020 by Dan Nanni </em></p><script async src=https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><ins class=adsbygoogle data-ad-client=ca-pub-7245163904660683 data-ad-format=auto data-ad-slot=6357311593 data-full-width-responsive=true style=display:block> </ins><script>(adsbygoogle = window.adsbygoogle || []).push({});</script><p>A packet sniffer tool captures live packets from networks, decodes them according to protocol specifications, and optionally takes actions according to the parsed packet contents (e.g., in case of intrusion detection/prevention systems). Packet sniffing tools are very useful when you diagnose networks or protect against security attacks over networks. The following list shows <strong> popular open-source packet sniffers that are available on Linux </strong> .</p><img src=img/242.jpg><h3>1. tcpdump</h3><p>The most popular general-purpose packet analyzer. <a href=https://www.xmodulo.com/tcpdump.html> <code>
       tcpdump
      </code> </a> uses <code>
      libpcap
     </code> library to capture packets on OSI layer 2 (e.g., Ethernet, PPP, and SLIP), and above. It also supports regular expressions for advanced packet filtering, and allows one to export and import packet dumps to and from a file.</p><script async src=https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><ins style="display:block; text-align:center;"class=adsbygoogle data-ad-client=ca-pub-7245163904660683 data-ad-format=fluid data-ad-layout=in-article data-ad-slot=5674857721> </ins><script>(adsbygoogle = window.adsbygoogle || []).push({});</script><h3>2. Wireshark</h3><p>Formerly known as Ethereal, <a href=https://www.xmodulo.com/wireshark.html> Wireshark </a> is an open-source packet analyzer with graphical front end. Functionality-wise, Wireshark is quite similar to <code>
      tcpdump
     </code> , and is available on multiple platforms including Linux, BSD, and Mac OS X, and MS Windows. A CLI client called <code>
      tshark
     </code> comes with it.<h3>3. dhcpdump</h3><p>Snoops on DHCP request/response traffic captured by <code>
      libpcap
     </code> library, and displays the DHCP packets in human readable formats. <code>
      dhcpdump
     </code> is useful for DHCP debugging and troubleshooting.<h3>4. p0f</h3><p>A <a href=http://lcamtuf.coredump.cx/p0f3/> passive OS fingerprinting tool </a> that identifies the operating systems of two end point hosts associated with an existing TCP connection. For accurate fingerprinting, <code>
      p0f
     </code> draws from various signatures including TCP/IP headers, TCP three-way handshake dynamics, contents of application-level payloads (e.g., HTTP request/response). Besides OS fingerprinting, <code>
      p0f
     </code> also detects the types of HTTP clients, network links (e.g., ethernet, DSL, modem), as well as <a href=https://www.xmodulo.com/internet-connection-sharing-iptables-linux.html> NAT connection sharing </a> , load-balancing setup, etc.<h3>5. Snort</h3><p>An open-source intrusion detection and prevention system that relies on real-time network sniffing and analysis. <a href=https://www.xmodulo.com/snort.html> Snort </a> conducts extensive protocol analysis and content matching to detect a variety of network attacks and hostile scans.<h3>6. Kismet</h3><p>A wireless network detector and intrusion detection system for 802.11 wireless links, supporting 802.11a, 802.11b, 802.11g, and 802.11n. It identifies wireless clients and their network association by passively collecting packets on wireless network card interfaces. <a href=https://www.kismetwireless.net/> Kismet </a> also detects active wireless sniffing programs to alert wireless network attacks.<h3>7. hcidump</h3><p>A Bluetooth traffic sniffer which captures HCI packets associated with Bluetooth devices, and display Bluetooth related activities in human readable formats.</p><script async src=https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><ins style="display:block; text-align:center;"class=adsbygoogle data-ad-client=ca-pub-7245163904660683 data-ad-format=fluid data-ad-layout=in-article data-ad-slot=1246960885> </ins><script>(adsbygoogle = window.adsbygoogle || []).push({});</script><h3>8. httpry</h3><p>An open-source <a href=https://www.xmodulo.com/monitor-http-traffic-command-line-linux.html> HTTP packet sniffing tool </a> which captures live HTTP packets with <code>
      libpcap
     </code> library, and displays HTTP requests and responses in a human-readable format. It comes with a collection of parsing Perl scripts for mining various information from its standard output.<h3>9. dsniff</h3><p>A suite of CLI tools used for <a href=http://www.monkey.org/~dugsong/dsniff/> network auditing and penetration testing </a> purposes. Supported functionality includes passwords from login sessions ( <code>
      dsniff
     </code> ), sniffing files from NSF traffic ( <code>
      filesnarf
     </code> ), email messages from SMTP/POP traffic ( <code>
      mailsnarf
     </code> ), URLs from web traffic ( <code>
      urlsnarf
     </code> ), etc.<h3>10. ngrep</h3><p><code>
      grep
     </code> over network packets. Powered with <code>
      libpcap
     </code> library, it captures packets whose payload is matched with extended regular expressions or hexadecimal expressions.<h3>11. ntopng</h3><p>A full-blown web-based real-time network traffic monitoring system which provides flow/protocol/packet-level analysis of local network traffic. Long-term traffic history is archived in the database backend.<h3>12. Wireless IDS</h3><p>An open source intrusion detection tool for <a href=https://github.com/SYWorks/wireless-ids> wireless networks </a> . It sniffs communication between wireless devices and access points to detect any potential WEP/WPA/WPS attacking packets, or possible rogue access point.<h3>13. mysql-sniffer</h3><p>An open source <a href=https://github.com/zorkian/mysql-sniffer> MySQL sniffer tool </a> which captures live packets sent to a MySQL server, and dumps MySQL queries in a human readable format.<h3>14. bro</h3><p>A powerful and flexible network monitoring and intrusion detection system. Analyzes live or recorded traffic to trigger events which are then handled by action policies.</div><div id=foobar><h2>Support Xmodulo</h2><p>This website is made possible by minimal ads and your gracious donation via <a href=https://www.paypal.com/donate?hosted_button_id=EX94W7Y4D4MMW rel=nofollow target=_blank> PayPal (Credit Card) </a> or <a href=https://www.coinbase.com/join/dnanni rel=nofollow target=_blank> Bitcoin </a> ( <code>
      1M161JGAkz3oaHNvTiPFjNYkeABox8rb4g
     </code> ).<p>Please note that this article is published by Xmodulo.com under a <a href=https://creativecommons.org/licenses/by-sa/3.0/deed.en_US rel=license> Creative Commons Attribution-ShareAlike 3.0 Unported License </a> . If you would like to use the whole or any part of this article, you need to cite this web page at Xmodulo.com as the original source.</div><div id=footer><div id=comment><div id=disqus_thread></div><script>var disqus_config = function () { this.page.url = PAGE_URL; this.page.identifier = PAGE_IDENTIFIER; }; (function() { var d = document, s = d.createElement('script'); s.src = 'https://xmodulo.disqus.com/embed.js'; s.setAttribute('data-timestamp', +new Date()); (d.head || d.body).appendChild(s); })();</script><noscript>Please enable JavaScript to view the <a href=https://disqus.com/?ref_noscript> comments powered by Disqus. </a></noscript></div></div><div class=center><p>Xmodulo © 2021 ‒ <a href=https://www.xmodulo.com/about.html> About </a> ‒ <a href=https://www.xmodulo.com/write-for-us.html> Write for Us </a> ‒ <a href=https://www.xmodulo.com/feed> Feed </a> ‒ Powered by <a href=https://www.xmodulo.com/go/digitalocean rel=nofollow target=_blank> DigitalOcean </a></div></div>