WinDump
WinDump is an exceptionally powerful command-line packet sniffer. Ported over from the source of the Tcpdump utility available for UNIX, WinDump carries over the same power and flexibility to the Windows world, all in a lightweight executable.
WinDump is a helpful utility when you need to do some quick and easy packet capturing to diagnose a network problem. It’s flexible, and it can capture and display details about every packet going across the network interface. It can filter the output results based on protocol (e.g., Address Resolution Protocol—ARP, IP, TCP, UDP), source network or host, destination network or host, source port, destination port, and many other criteria.
To use WinDump, you’ll first need to download and install the Windows Packet Capture Library (WinPcap), the Windows port of the open-source packet-capture and network-analysis library libpcap for UNIX. WinPcap runs on all versions of Windows.
After you install WinPcap, you can download the standalone WinDump executable. To launch WinDump, simply run it from the command line with the appropriate options for what you’d like to capture or read. You’ll find the online manual for WinDump here.
The first command you might want to execute is Win-Dump -D, which will display a list of interfaces available on your computer, as well as a corresponding number for each interface, so that you can determine which interface to use for your sniffing activities. After you know which interface to run, you can simply use that number with the -i option (i.e., WinDump -i 3, if number 3 is the interface you’d like to use) to start viewing packet data in real time. (Because these are ports of UNIX utilities, the command-line switches are case-sensitive.)
Ngrep
Although WinDump is a tremendous utility, sometimes it requires a considerable amount of overhead or knowledge to determine what you’re looking for. For example, suppose you’re trying to look up whether a DNS query is making it across your network, but you aren’t familiar with the protocols and that DNS uses by default. Or, suppose a lot of traffic is coming across a network connection, and you’re finding it too cumbersome to work through all the packets just to find the one particular packet you’re looking for. For such situations enter ngrep, the network-aware grep utility.
Although WinDump is a tremendous utility, sometimes it requires a considerable amount of overhead or knowledge to determine what you’re looking for. For example, suppose you’re trying to look up whether a DNS query is making it across your network, but you aren’t familiar with the protocols and that DNS uses by default. Or, suppose a lot of traffic is coming across a network connection, and you’re finding it too cumbersome to work through all the packets just to find the one particular packet you’re looking for. For such situations enter ngrep, the network-aware grep utility.
If you aren’t familiar with grep, it’s probably one of the most widely known and oft-utilized UNIX utilities. Grep finds matching text strings (through a mechanism known as regular expressions) in files on a file system, then outputs the lines to the display. You might compare grep with the Windows command-line Find utility, but grep differs by providing an exceptional amount of power in its search for text strings.
By applying these capabilities to the network layer, ngrep provides the same level of functionality for packet sniffing. As a result, you don’t need to know what protocols, ports, network, or IP addresses that two devices are using to transfer data. You just need to know something about the packet’s payload, and ngrep will find it for you—regardless of how it’s transmitted.
Ngrep is great for troubleshooting DNS query problems. In a large Active Directory (AD) environment, dozens of DNS queries are typically occurring across the network per second. If I’m trying to troubleshoot a specific set of problems, searching each packet to find the one I’m looking for is cumbersome at best. Instead of relying on a straight packet capture of all DNS traffic, I can simply use ngrep to find the text string I’m looking for because DNS queries and responses are performed in plain text.
Ngrep currently recognizes ICMP, IGMP, Raw, TCP, and UDP protocols across 802.11, Ethernet, FDDI, PPP, SLIP, Token Ring, and null interfaces. Like WinDump it requires the WinPcap library to operate properly.
WireShark (formerly Ethereal)
When you face a situation in which you need to roll up your sleeves and dive as deeply as possible into network capture and analysis, one utility needs to come to mind: the world’s most popular network analyzer, WireShark. Network experts around the world use WireShark because it has all the standard features you’ll find in most protocol analyzers, in addition to some you won’t find in any other product. More than 400 developers around the world have made contributions to this open-source application. A decade ago, you would have to pay thousands of dollars for software that had the same capabilities, but WireShark offers it all free.
When you face a situation in which you need to roll up your sleeves and dive as deeply as possible into network capture and analysis, one utility needs to come to mind: the world’s most popular network analyzer, WireShark. Network experts around the world use WireShark because it has all the standard features you’ll find in most protocol analyzers, in addition to some you won’t find in any other product. More than 400 developers around the world have made contributions to this open-source application. A decade ago, you would have to pay thousands of dollars for software that had the same capabilities, but WireShark offers it all free.
WireShark can capture data off your network connection, filter the data, dive into the details of each packet, save the packet capture for detailed analysis, send packet captures to other network engineers (or vendors) to help with debugging, and open packet captures from many other leading packet-capture utilities. WireShark can capture data off of various network transports, such as Classical IP over ATM (CIP), Ethernet, Fiber Distributed Data Interface (FDDI), Point-to-Point Protocol (PPP), Token Ring, 802.11, and loopback interfaces (although it doesn’t support all types on every platform). Across all those network transports, WireShark can “dissect” more than 750 protocol types, including FTP, HTTP, NetBIOS, POP3, remote procedure call (RPC), SNMP, SSH, SMTP, and Telnet, just to name a few.
Like the other sniffing utilities I’ve mentioned, WireShark depends on an installation of WinPcap to function properly, so you’ll need to install that first. Then, after you install the latest Ethereal distribution for Windows, simply access the Capture, Interfaces menu and select the interface you want to start using for capture. Then, you’re ready to start analyzing your traffic.