Need a Packet Sniffer for Windows 3.11 or Dos.....

Shinobi · Post by **Shinobi** » Tue Jun 17, 2003 2:42 pm

I have a 386 laptop that I have hooked up to my network, I use
it for IRC , ICQ and Email . What I want to do it put it "outside" my firewall, and to display packets in real time or to a dump file.
Tks,
Shinobi

Norm · Post by **Norm** » Tue Jun 17, 2003 6:27 pm

The Gobbler

About a third way down the page.

I've never used it, but it sounds like a good one.

Stu · Post by **Stu** » Tue Jun 17, 2003 8:32 pm

My vote is to get Ethereal. The TCP Stream stuff alone makes it worth the download.

Shinobi · Post by **Shinobi** » Tue Jun 17, 2003 11:25 pm

Norm:

The Gobbler

About a third way down the page.

I've never used it, but it sounds like a good one.

Tks Norm, I tried that Gobbler program once before and had a tough time getting the thing to work, but I'll try to D/L it again off of the URL you provided.

Stu:

My vote is to get Ethereal. The TCP Stream stuff alone makes it worth the download.

Windows 3.11 runs mainly 16 bit apps, and has very limited Win32 app support.... and thats a add on.
so I don't think that Ethereal prog will help me out. Tks anyway though for your help.

Later,
Shinobi

greEd · Post by **greEd** » Thu Jun 19, 2003 11:42 am

Good Dos sniffers:

Etherload
http://www.netreach.net/~anthonyd/Sniff ... load20.zip

Fergie
http://www.dsinet.org/tools/network-sniffers/fergie.zip

Snoop (My personal Favorite for DOS)
http://www.polylith.com/~jerparks/EE/ee464/snoop/

regards,
greEd

Shinobi · Post by **Shinobi** » Thu Jun 19, 2003 9:45 pm

greEd Tks for the link to snoop.exe, it great!
However, can you please tell me the correct "switch" to add to the
.EXE so that I can see "I.P." address, instead of just MAC Address? I've ried every -e* and i* that's in the man/help files.

Thanks, now it time to eat my Frosty.

Shinobi

greEd · Post by **greEd** » Fri Jun 20, 2003 9:01 am

The last time I used that program was about 7 years ago and at that time I was more interested in what was contained in the TCP field of packets to find out what was popular on the wire of that specific network ... if you catch my drift

What you are seeing pass up on your screen is just verbose, but none the less captured packets. The -e and -i options are for filtering based on packets received. You could change the source for rarp to resolve ip based on mac for output.

Shinobi · Post by **Shinobi** » Fri Jun 20, 2003 5:30 pm

greEd:

You could change the source for rarp to resolve ip based on mac for output.

That's the part I don't know how to do...