Prev: Flash less necessary in future
Next: Ping: franklin--at--yahoo.com.sg
From: David H. Lipman on 10 Jun 2010 20:59
From: "za kAT" <zakAT(a)super-secret-IPaddress.invalid>

| On Thu, 10 Jun 2010 17:19:26 -0400, David H. Lipman wrote:

>> Wireshark (and it's pred. Ethereal) is the "Gold Standard".

| It is indeed David. It's useful being cross platform as well. I often use
| it in a Linux VM because it avoids installing WinPCap on the Windows box.

You'd be surprised how often I come across malware whose strings have "wireshark" (or some
variation thereof) in them indicating they will detect if Wireshark is running and thus
they will not do their dirty work or block Wireshark from being executed.

But even in those situations, put the test platform on an Ethernet hub and have another
workstation on the hub in permiscuous mode and you can still capture the packets anyway.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


From: za kAT on 11 Jun 2010 05:21
On Thu, 10 Jun 2010 20:59:02 -0400, David H. Lipman wrote:

> You'd be surprised how often I come across malware whose strings have "wireshark" (or some
> variation thereof) in them indicating they will detect if Wireshark is running and thus
> they will not do their dirty work or block Wireshark from being executed.

I am surprised, but there must be good reason for them to bother.
Interesting. Ta.

--
zakAT(a)pooh.the.cat - Sergeant Tech-Com, DN38416.
Assigned to protect you. You've been targeted for denigration!
From: Franklin on 12 Jun 2010 12:11
David H. Lipman wrote:

> From: "za kAT" <zakAT(a)super-secret-IPaddress.invalid>
>
>| On Thu, 10 Jun 2010 03:50:02 -0700 (PDT), Bob Villa wrote:
>
>>> On Jun 9, 9:12 pm, za kAT <za...(a)super-secret-IPaddress.invalid>
>>> wrote:
>>>> On Thu, 10 Jun 2010 01:32:30 +0000 (UTC), Bear Bottoms wrote:
>>>>> "David H. Lipman" <DLipman~nosp...(a)Verizon.Net> wrote in
>>>>> news:hupbga02cg3 @news4.newsguy.com:
>>>>>>
>>>>>> Wireshark 1.2.9 is now available
>>>>>
>>>>> I tried for a long time to get behind Wireshark and just can't do
>>>>> it. It is just so grotesque. I've found other similar programs just
>>>>> much easier and more enjoyable to use. Pick one.
>>>>>
>>>> Do tell us which one you used to divine my IP address...
>>>>
>>>> Wireshark isn't grotesque. Just not pointy, clicky enough for you
>>>> then... Do you seriously expect to understand the output from a
>>>> program like this without doing at least some serious study on how
>>>> networking works?
>>>>
>>>> Research isn't just a word, newbie.
>>>>
>>>> -- za...(a)pooh.the.cat - Sergeant Tech-Com, DN38416. Assigned to
>>>> protect you. You've been targeted for denigration!
>>>
>>> Is it JUST popular to attack BB? Yes, he is opinionated...but who
>>> isn't? (BTW, this is NOT BB!)
>>>
>| Wireshark is a class act. Cross platform. I don't find it that
>| difficult to use, but since when was analysing network traffic easy.
>
> Wireshark (and it's pred. Ethereal) is the "Gold Standard".
>

Of course Wireshark is the gold standard. There's a lot of good
alternatives but Wireshark is the main one. I guess it could be too
detailed for very straighforward task like trapping a URL for which aps
like URLsnooper are simpler.

http://www.donationcoder.com/Software/Mouser/urlsnooper/index.html
(registerware)

First  |  Prev  | 
Pages: 1 2 3
Prev: Flash less necessary in future
Next: Ping: franklin--at--yahoo.com.sg