Ethereal

Sweeet Visual tcpdump analyzer. Now know as WireShark.

Pointers

• http://www.wireshark.org/
  • http://www.wireshark.org/docs/ - docs
  • http://wiki.wireshark.org/ - wiki docs
• LibPcap - the packet capture library and related tools
• UnixGeekTools - other great tools for unix geeks

Old Pointers

• http://www.ethereal.com/
  • http://www.ethereal.com/docs/ - docs
• http://wiki.ethereal.com/ - wiki docs

Tips

• nonstandard http port - set "analyze"->"decode as" for port 108x as HTTP
• http filter: http.request.method == "POST"
• statistics = conversations, check tcp tab

Command Line

• tethereal

     #  display conversation statistics, display all POST uris
     tethereal -z conv,tcp -r capture.dump -R 'http.request.method == "POST"'

SSL

• install ethereal-ssl