Use this tool to find passwords in a Telnet session or make sense of a data stream. The tool sees TCP data in the same way as that of the application layer.A set of filters for customized data display can be refined using a display filter.Captured files can be programmatically edited via command-line.It captures live network traffic from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI networks.Wireshark uses Winpcap to capture packets, so it can only capture the packets on the networks supported by Winpcap.It lets you capture and interactively browse the traffic running on a computer network.You may also use Wireshark capture and analysis tool.7.7 Sniffing Tools Sniffing Tool: Wireshark To capture all packets from a specific host on the network: Tcpdump: verbose output suppressed, use -v or -vv for full protocol decode To capture all packets on the WAN (the below assumes that interface eth1 is the WAN interface): tcpdump relies on libcap, therefore it can produce standard pcap analysis files which may be processed by other tools. It may be used to capture packets on the fly and/or save them in a file for later analysis. Tcpdump is a network capture and analysis tool.

Wireshark capture filter flags