The packet sniffer ethereal
is essential for reverse engineering applications and diagnosing network
problems. But it's primarily an interactive tool with a GUI.
I can't figure out a way to use the Ethereal
packet analysis code as
part of a program I write.
One hack is to store packet captures to disk, then use tethereal on the command line to dump what you're interested in to ASCII. Here's a quick and dirty way to print out all the URLs that were fetched:
tethereal -r foo.pcap -R http.request |
Still, there's gotta be a better way to process pcap data with the
high level analysis Ethereal does.
ImPacket is an
interesting alternative, but it seems orphaned.
sed 's/.*GET //; s/ .*$//' |