|
A packet analyzer (also known as a network analyzer, protocol analyzer or packet sniffer—or, for particular types of networks, an Ethernet sniffer or wireless sniffer) is a computer program or piece of computer hardware that can intercept and log traffic that passes over a digital network or part of a network. As data streams flow across the network, the sniffer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications. Packet capture is the process of intercepting and logging traffic. ==Capabilities== On wired broadcast LANs, depending on the network structure (hub or switch), one can capture traffic on all or parts of the network from a single machine on the network. However, some methods avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g., ARP spoofing). For network monitoring purposes, it may also be desirable to monitor all data packets in a LAN by using a network switch with a so-called ''monitoring port'' that mirrors all packets that pass through all ports of the switch when systems (computers) are connected to a switch port. To use a network tap is an even more reliable solution than to use a monitoring port, since taps are less likely to drop packets during high traffic load. On wireless LANs, one can capture traffic on a particular channel, or on several channels using multiple adapters. On wired broadcast and wireless LANs, to capture traffic other than unicast traffic to the machine running the sniffer, multicast traffic to a multicast group that machine is monitoring, or broadcast traffic—the network adapter capturing the traffic must be in promiscuous mode. Some sniffers support this, but not all. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the service set the adapter is configured for are usually ignored. To see those packets, the adapter must be in monitor mode. When traffic is captured, either the entire contents of packets are recorded, or the headers are recorded without recording the total content of the packet. This can reduce storage requirements, and avoid legal problems, yet provide sufficient information to diagnose problems. Captured information is decoded from raw digital form into a human-readable format that lets users easily review exchanged information. Protocol analyzers vary in their abilities to display data in multiple views, automatically detect errors, determine root causes of errors, generate timing diagrams, reconstruct TCP and UDP data streams, etc. Some protocol analyzers can also generate traffic and thus act as the reference device. These can act as protocol testers. Such testers generate protocol-correct traffic for functional testing, and may also have the ability to deliberately introduce errors to test the DUT's ability to handle errors. Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array. These devices record packets (or a slice of the packet) to a disk array. This allows historical forensic analysis of packets without users having to recreate any fault. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Packet analyzer」の詳細全文を読む スポンサード リンク
|