Ethereal is a PacketSniffer. It is no longer being developed as an open-source product; that development has moved to Wireshark.

It is now in pretty GTK2.

A patch for DCCP support can be found at http://www.jp.nishida.org/dccp/

Tips

Display Filters

Although ethereal's help shows you many fields you can use to filter on, such as all the subfields of the various supported protocols, it doesn't give you any help as to how to set up a simple filter!

So, here are some simple examples:

Hides all SSH and ARP protocol packets

ssh && !arp

Hide all SSH protocol packets, as well as TCP ACK/FIN etc packets for ssh connections

ssh && tcp.port != 22

Traffic to or from a 192.168 subnet

ip.addr == 192.168.0.0/16

Traffic to this IP that is UDP

ip.dst == 192.168.1.1 && udp

ip.dst

CategoryNetworking