looking for good sniffer
 

i'm looking for a sniffer - sth like IEAnalyzer, but I need to get all incoming and outgoing packets on any ports...
IEAnalyzer works perfectly, but shows only HTTP traffic...
i know about etheral and wireshark, but it listens on a specified network adapter and i cannot set up listing requested program only...

hope, you know what i am writing about :)

maybe commview?

OmniPeek ?

maybe i'm wrong, but as i remember - commview it works very similar to other network sniffers (etheral, whireshark...)

OmniPeek... Hmm... let's see it :D

Ok OmniPeek, but somewhere cracked version ? :)

why not use 'wireshark'?

+1 to whireshark.
Great Sniffer...

Used to use Observer Suite, which was very good and incredibly expensive.

Would not describe WireShark as great, but it's OK, is supported and is getting better.

i want to view traffic made by one program only, not listen network interface... there is a lot of logs from any program... i though that there is some sniffer that works similarly to httpanalyzer - select running process and listen... but httpanalyzer shows only http traffic, so it's redundant for me...

i know that wireshark is a great sniffer, but i'm looking for sth diffrent
maybe i'm wrong, but i didn't find this option in wireshark or etheral, even in omnipeek...

when i was using one of above sniffers, i had to analyze all the packets and separate them... i wasn't sure which packets was generated by application that i want to listen...

You can do packet custom filtering by process right AFTER completed capture.

Hi
mafcin HHD Software produce a very nice products, try the "Accurate Network Monitor" product I think it's what you looking for.

Hi,
maybe, you can use Microsoft Network Monitor.
It's free. And it can work on windows x64 .

thanks for that - it is exactly what i needed :D

hi, i know you found what you need but i feel Ospy is similar tool

oSpy is a tool which aids in reverse-engineering software running on the Windows platform.

or

oSpy is even better for me than Microsoft Network Monitor :)
here i can run program from oSpy and view all trafiic made by loaded program

in Network Monitor some packets are shown as 'Undefinied' what is not in oSpy

@mafcin
no problem, it truely is some beast program, i use all time when needed.

I would like to make you aware of another program.
"Fiddler" - web debugging program..
Filddler 2 is released. Now you can have extensions (3rd party aswell :D ) so its so much better to what you want.. even you can make your own simple extension for what you aim.


or

Fiddler is nice tool, but it shows only HTTP traffic... it's simmilar to HTTP Analyzer (that i use very often), maybe better than Analyzer... i'll check it :) First impressions are very positive :)

yes ^__^

You/anyone know any other like fiddler (web browser but all port is fine) ?
I remember an install only program , I think called jaihotsniff - but I cannot find it anywhere on the net...was open source

i usually using socket sniff, free n small

Why a megaupload link if it is at google code??
http://code.google.com/p/ospy/downloads/detail?name=oSpy-1.10.4.zip&can=2&q=

ok good for you and googlecodes.

x64 (64bit) support?

You may use "TracePlus"...

The problem with current sniffer products is that too much irrelevant traffic are captured. We often want to filter traffic by PID.

The problem with PID is that some nasty program (e.g. Chrome and IE) spawn child process all the time so the PID always changes dynamically.

commview may fit with you.
Advantages:
1.It can capture specific process,like qq and thunder.
2.auto save packets, save as pcap format, which can be read by wiershark and other opensoure tools based on libpcap lib.
Disadvantages:
1.commercial software
2.the cracked version i tried was unreliable,it will exit when come across with heavy traffic.

Wireshark can capture special port and ip ,but process like qq may have lots of ports,it can't capture all traffic.may be someone can solve this by customed filter :-)

NetworkMonitor which produced by windows, it's output format is private, you cannot anaylase it later. Am i wrong? :confused:


P.S Wireshark and Commview can capture packets from MAC/IP/TCP_UDP/APP packets.
If no sniffer can fit you requirment, you can write a program based on winpcap or libpcap to do it.

I hope it helps you

Omnipeek v9.1 recently released. Fantastic.

Its Quite unusual to post on such old thread. Better to create Thread in Reverse Software section if you want to let everyone know if its underrated or really useful tool.

Regards,
DB

Hi,

If the purpose is monitoring, Netflow is also used to collect statistics instead of packet decoding. As a sniffer, when i consider flow graphing, Wireshark is already fine, but i don't know the others for such.

Cheers,
cp74

smartsniff ...simple and easy.:-)

SmartSniff is a network monitoring utility that allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump. (for non-text base protocols, like DNS)

http://www.nirsoft.net/utils/smsniff.html

URL Snooper is great.

i recommend Microsoft Network Monitor also, it is very conviently

go for Colasoft. it's my alternative to wireshark