# need special sniffer

## tbart

Hello!

Does anyone of you have a suggestion of what sniffer to use for:

1) huge traffic amounts (speaking of several GB per hour)

2) capture to file and not ram

3) trigger start and stop events (when packet containing xxx detected, start sniffing until yyy)

4) standard capture format (pcap preferred)

5) optionally some fancy coloured graphs to show top-management ;-> (though i can do that with other sw once it's in pcap format)

i heard that etherpeek for windows might do that (and i dislike windows and paying 1000 EUR for it) and a sniffer called ksnuffle might do that, too. but there's no ebuild, and it was initially designed for kde 2.x, so i don't know if it will compile on an actual system.

i am gonna have a try at it, but if someone knows of another solution, this would be very nice.

tia!

tbart

----------

## d4rkwingduck

Have you tried ethereal ?

----------

## ph03n1x

Hmm maybe snort is something for you?

Otherwise ethereal is the standard sniffer...

----------

## Voorhees51

I use ethereal and snort to do what you are describing and it works great

----------

## tbart

wow!

3 answers over night!

1) i love and use ethereal, but it can't do triggers.

2) i know snort can do triggering, but how do you combine snort's triggering with ethereal's capture features?

so, if snort can do all this, could anyone give me a hint on how to start/stop using triggers? especially various stop options (until packet xx occurs OR for yy minutes/seconds OR .... )

btw: ksnuffle seems to be impossible to build under kde3/qt-3.3, it needs several old symbols and libraries..

----------

## Voorhees51

just use snort and have it do logging to a file ... check www.snort.org/docs/  look at the Users manual it shows how to do it.

  Thats what I do have snort monitor and log the traffic, and then read and analize it with ethereal

----------

