Free sniffer software for linux

phpsniffer shows that PHP really is the right tool for every programmnig task imaginable (humor, laugh), I submit for your amusement, phpsniffer.

phpsniffer is a packet sniffer written entirely in PHP without any PECL/PEAR extensions. (It is recommended that you check out Phpcap for any serious sniffing at http://alcane.newffr.com/phpcap/).

phpsniffer has some limitations:

- You probably will only see one side of a conversation.
- You might miss packets with a short TTL.
- Currently only IP,ICMP,UDP, and TCP headers are decoded.
- Sockets must be enable in your PHP build.

assniffer is an auto saving sniffer for windows and linux.

assniffer can monitor (using pcap) a network, and for every HTTP transfer it sees, save a copy of the transferred data.

This is less for sinister uses, and more for taking advantage of the already-transferred data that your computer may be exposed to.

Linux users should install libpcap, and tools to enable compiling.

Compilation:

- Go to the source/assniffer directory and type make.

slsnif is a serial line sniffer. It listens to the specified serial port and logs all data coming through it. slsnif works transparently for both the device connected to the serial port and the controlling software for this device. It operates by opening a pseudo tty (pty) and linking it to the actual serial port.
slsnif operates by opening a pty and linking it to the serial port. These are following parameters / options:
1. Serial port to open (required).
2. Name of the file to direct output to (optional, defaults to stdout).
3. Desired baudrate (optional, defaults to 9600 baud).
4. Timestamp On/Off (optional, defaults to Off).
5. Print ascii values in hex On/Off (optional, defaults to Off)
6. Print number of bytes transmitted On/Off (optional, defaults to Off).
7. Optional colors for timestamp, number of bytes transmitted and normal output.
8. Lock port On/Off (optional, defaults to On).
9. Use Unix98 ptys instead of BSD ptys (optional, defaults to BSD style).
10. Second serial port to open. If specified, this port will be used instead of a pty, thus providing an ability to log data between two serial ports.
Enhancements:
- Added ability to resynchronize ports at any time by sending a SIGUSR1 signal to slsnif. Useful for debugging applications that change port parameters mid-way, after starting the transmission. One example is pppd daemon, which sets initial parameters in the chat script, and changes them later, after chat script terminates.
- Added ability to use SYSV (Unix98) ptys instead of BSD ones (see -u and --unix98 parameters). This option can also be turned on/off from rc-file.

Aps is a small tool for analyzing network traffic. It prints out a great deal of information about the relevant protocols including TCP, UDP, ARP, and ICMP.
It allows you to filter IP addresses, hardware addresses, ports, and specific protocols. It comes with a little GTK-GUI displaying packet counters for each protocol.
APS tries to print detailed info about network frames that are received from the SOCK_RAW (ETH_P_ALL) socket. I am not sure if this is the clean way, but it works fine. APS prints info about the hardware layer and the IP and TCP/UDP/ICMP header.
The tail of the packet (mostly the data) wich could not be interpreted is written on the screen as ascii/hex-dump or both (your choice).
Example
HW-ADDR: 00:60:8c:f6:40:96 -----> 00:80:ad:30:8f:3b
IP-ADDR: 192.168.17.52 -----> 192.168.17.50
IP-Ver4 || Head:0x0a (bytes) || Service(TOS):16 || Length over all:0061
Fragmentation: ID:0x4079 - Flags: 0 1 0 - Offset:00000
TTL:064 || Protokoll:006 (TCP) || HeaderCRC:0x567b
TCP-HEADER:
Ports: 0023-->1034 (telnet) Seq./Ack. Nr.:0x70843468 / 0xeae29434
Data-Offset:0x05 Reserved-6Bit:00 Flags:-urg-ACK-PSH-rst-syn-fin-
Window:0x7fe0 CRC:0x9420 Urgent-Pointer:0x0000
73 61 74 75 72 6e 32 3a 2f 73 72 76 2f 70 72 69 6e 74 71 23 20
HW-ADDR: 52:54:40:25:8d:88 -----> ff:ff:ff:ff:ff:ff
SAMBA/NetBios
e0 e0 03 ff ff 00 22 00 11 00 00 00 00 ff ff ff ff ff ff 04 52 00 00 00 00 52
40 25 8d 88 40 08 00 03 00 04 20 20 20 20 20 20 20 20 20
HW-ADDR: 00:80:ad:30:8f:3b -----> 00:60:8c:f6:40:96
IP-ADDR: 192.168.17.50 -----> 194.112.123.200
IP-Ver4 || Head:0x0a (bytes) || Service(TOS):0 || Length over all:0029
Fragmentation: ID:0x29ae - Flags: 0 0 0 - Offset:00000
TTL:064 || Protokoll:001 (ICMP) || HeaderCRC:0x411f
echo request CODE:0x0 CRC:0xf9f5 SIG:0x602 NUM:0x0
00 ea
Enhancements:
- added break for Packet-counter and fixed some minor bugs

Net::Connection::Sniffer::Util are netaddr utilities.

SYNOPSIS

use Net::Connection::Sniffer::Util;
my $ip = newcidr24 Net::Connection::Sniffer::Util($netaddr);
my $ipcopy = $ip->copy;
if ($someip->within($ip)) {
do something...
if ($ip->contains($someip)) {
do something...
if ($ip1->equal($ip2)) {
do something
__top

Net::Connection::Sniffer::Util is a lite weight perl module to do NetAddr::IP like operations on ip addresses in either 32 or 128 bit formats.
my $ip = newcidr24;

Create a blessed address object with cidr/24 network/broadcast bounds (assumes 32 bit addressing), for ipv6, this will be cidr/120
my $ipcopy = $ip->copy;

Copy a blessed network address object to a new blessed object;
Returns undef if $ip is not a Net::Connection::Sniffer::Util object.
$rv = $someip->within($ip);

Check to see if $someip is within the cidr of $ip. i.e.

network address equal($ip2);

Check if IP1 equal IP2
input: ip2 object
returns: true/false

ggsniff is a sniffer that allows you to record Gadu-Gadu messages. It is not currently a standalone application. Rather, it is a patch for dsniff that adds the ability to record Gadu-Gadu messages to msgsnarf.
It is not currently a standalone application. Rather, it is a patch for dsniff that adds the ability to record Gadu-Gadu messages to msgsnarf.
You should apply this patch in this way:
cd /path/to/dsniff-2.3
patch -p1 < /path/to/file/ggsniff-1.2-dsniff-2.3-patch
For more information, please read documentation supplied with the dsniff.
Useful links:
ggsniff - http://ggsniff.sourceforge.net
dsniff - http://monkey.org/~dugsong/dsniff/
Enhancements:
- added password sniffing (switch -w)

Sniffit is a packet sniffer for TCP, UDP and ICMP packets. sniffit is able to give you very detailed technical info on these packets (SEQ, ACK, TTL, Window etc.) but also packet contents in different formats (hex or plain text).
Sniffit was actually the start of my TCP/IP experimental phase. As the subject interested me, I was exploring the weaknesses in IPv4 further and further. The logical step was to do some work on Spoofing. This resulted in 2 text on spoofing (Non-Blind and Blind). A C toolkit for writing spoof programs: Spoofit, and a Demo program Eriu that demonstrated a connection hijack.
My plans were to go a step further and spoof rooting info, to create my own routes (RIP protocol etc...), unfortunately at that time my thesis started and I never got the time to work on that project.
One of the last things I did on spoofing was some fun application that raced the DNS server with false responses... at HIP 97 this created alot of confusing among innocent surfers...
Enhancements:
- Use of Autoconf
- Upgrade of Libpcap to 0.3
- Added Packet generation
- Added UDP selectivity
- Added "plugins"