3.1.7 Summary
Filtering is a very valuable aspect to any sniffer. For this reason we included a
simple, but useful, filtering module in Airscanner Mobile Sniffer™. If used, this filter
will allow you to focus on the data that matters. This will reduce the time you spend
looking through the data, will reduce the wasted space filled with useless data, and will
allow you to collect only data that matters to you. In addition, since this data is captured
in Ethereal format, you can easily export it and analyze it much more intensely on your
desktop.
3.2 Ethereal
URL: http://www.ethereal.com
3.2.1 Description
Ethereal is one of the most popular sniffers available. It performs packet sniffing on
almost any platform (Unix, Windows), in both real-time (live), and from saved capture
files from other sniffers (NAI’s Sniffer, NetXray, tcpdump, and more). Included with this
program are many features such as filtering, TCP stream reconstruction, promiscuous
mode, third-party plug-in options, and the capability to recognize more than 260
protocols. Ethereal also supports capturing on Ethernet, FDDI, PPP, token ring, X-25,
and IP over ATM. In short, it is one of the most powerful sniffers available on the market
today—and it is free.
3.2.2 Installation on Windows
Installation varies depending on the platform. Because 98% of people using this
program employ either a Linux distribution (such as RedHat) or a Windows operating
system, we will be discussing only those platforms. For the most part, what works on one
*nix operating system will work on another with only slight modifications to the
installation procedure.
Using Ethereal with Windows is fairly straightforward. There is one exception to this
point. 802.11 packet captures are not currently available using Ethereal with any
Windows OS. However, if you want to capture data from a wired network, Ethereal will
work quite well.
3.2.2.1 Requirements
WinPcap: http://winpcap.polito.it
There is one requirement for Ethereal on Windows: WinPcap. This program,
available for free online, enables Ethereal to link right into the network card before the
data is passed up to the network software and processed by Windows. This program is
required because of the way in which Windows interacts with its hardware. To reduce
system crashes, any program installed in a Windows environment must interface with the
OS software, which in turn communicates with the hardware. This is meant to be
beneficial by restricting direct access to the hardware, which can cause software
incompatibilities, ultimately resulting in system crashes.
In addition to the packet driver previously discussed, WinPcap includes another
