The packet sniffer ethereal is essential for reverse engineering applications and diagnosing network problems. But it's primarily an interactive tool with a GUI. I can't figure out a way to use the Ethereal packet analysis code as part of a program I write.

One hack is to store packet captures to disk, then use tethereal on the command line to dump what you're interested in to ASCII. Here's a quick and dirty way to print out all the URLs that were fetched:

tethereal -r foo.pcap -R http.request |
  sed 's/.*GET //; s/ .*$//'
Still, there's gotta be a better way to process pcap data with the high level analysis Ethereal does. ImPacket is an interesting alternative, but it seems orphaned.
tech
  2005-06-25 18:01 Z