It can filter traffic to be shown, and can read traffic from a file as well as live from the network. It supports Ethernet, WLAN, FDDI, Token Ring, ISDN, PPP and SLIP devices. Hosts and links change in size with traffic. 28, 2006 (16 years, 4 months ago).įeaturing link layer, IP, and TCP modes, EtherApe displays network activity graphically with a color coded protocols display. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. Ngrep strives to provide most of GNU grep's common features, applying them to the network layer. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics. In Web mode, it acts as a Web server, creating an HTML dump of the network status. In interactive mode, it displays the network status on the user's terminal.

Ntop shows network usage in a way similar to what top does for processes.

Packet sniffing tool