The packet analyzer understands the format of Ethernet frames, and so can identify the IP datagram within an Ethernet frame. For example, suppose we are interested in displaying the various fields in messages exchanged by the HTTP protocol. In order to do so, the packet analyzer must “ understand” the structure of all messages exchanged by protocols. The second component of a packet sniffer is the packet analyzer, which displays the contents of all fields within a protocol message.

Capturing all link-layer frames thus gives you all messages sent/received from/by all protocols and applications executing in your computer. Here we assumed that, the physical media is an Ethernet, and so all upper layer protocols are eventually encapsulated within an Ethernet frame. Messages exchanged by higher layer protocols such as HTTP, FTP, TCP, UDP, DNS, or IP all are eventually encapsulated in link-layer frames that are transmitted over physical media such as an Ethernet cable. The packet capture library receives a copy of every link-layer frame that is sent from or received by your computer. The packet sniffer, shown within the dashed rectangle in above image is an addition to the usual software in your computer, and consists of two parts. Instead, a packet sniffer receives a copy of packets that are sent / received from/by application and protocols executing on your machine.Īt the right of above image are the protocols (in this case, Internet protocols) and applications (such as a web browser or ftp client) that normally run on your computer. Similarly, received packets are never explicitly addressed to the packet sniffer. It observes messages being sent and received by applications and protocols running on your computer, but never sends packets itself. As the name suggests, a packet sniffer captures (“ sniffs“) messages being sent/received from/by your computer it will also typically store and/or display the contents of the various protocol fields in these captured messages.Ī packet sniffer itself is passive.

The basic tool for observing the messages exchanged between executing protocol entities is called a packet sniffer. The purpose of this article is to introduce the most popular packet sniffer i.e.

Sniffer wireshark