Wireshark Analysing Tool.

[Infiltrator]

Hi,

I would like to know, if when using Wireshark for analysing network traffic, does any one use any third party utility to make their job easier, when reviewing the traffic results. Or do you create custom filters within wireshark, to filter out a particular traffic.

Thank you.

Regards,

Infiltrator

[Sitwon]

I find Wireshark's built-in filtering capabilities to be sufficiently advanced that I have never need to look for any third party tools to sort packets.

Although I have heard of people using Splunk.

[Mr-Protocol]

There is a nice free software which takes in Pcap files. I dont remember the name, I will edit post when i find it.

Edit: Netsparker

http://www.mavitunasecurity.com/communityedition/

Edited October 9, 2010 by Mr-Protocol

[Infiltrator]

Will take a look into those suggested tools.

Thank you very much

[antonymous]

If I'm just filtering packets, I prefer to use Wireshark's filters. But Network Miner is another great tool that I use when I need to quickly carve out files from a PCAP. It's just less clunky than copying the stream and pasting the result into a hex editor.

I tried NetWitness as well (heard of both this and Network Miner on an earlier episode of Hak5), and while it wasn't quite what I wanted, it gave me a new way to visualize how different machines were talking to each other, which is always useful.

[Infiltrator]

I've heard of Network Miner name before, but never knew much about it. Will give it try and experiment with it. Thanks Antonymous