A network sniffer (also known as a network analyzer, protocol analyzer or packet analyzer) is a software or hardware tool that can intercept and log traffic on a digital network.

As data flows across the network, the sniffer captures each packet and, if necessary, decode the packet’s raw data. Once captured the sniffer can produce the values of various fields, analyze its content and flag potentially anything potentially malicious as defined by the system administrator’s specifications or security best practices.

The functionality of protocol analyzers vary in several ways including their ability to display data in multiple views, automatically detect errors, determine an error’s root cause, generation of timing diagrams, etc.

Besides analyzing input, certain protocol analyzers can also generate output for testing purposes, that can be fed back to the device being analyzed. In this way, the device can be checked for functionality and if it recovers gracefully from errors in the protocol.

Read the full post