Protocol Analyzers

A network protocol analyzer is a vital part of a network administrator's toolkit. Network protocol analysis is the truth serum of network communications. If you want to find out why a network device is functioning in a certain way, use a protocol analyzer to sniff the traffic and expose the data and protocols that pass along the wire. You can use a network protocol analyzer to

* troubleshoot hard-to-solve problems
* detect and identify malicious software (malware)
* gather information, such as baseline traffic patterns and network-utilization metrics
* identify unused protocols so that you can remove them from the network
* generate traffic for penetration testing
* work with an Intrusion Detection System (IDS) or a honeypot
* eavesdrop on traffic (e.g., locate unauthorized Instant Messaging—IM—traffic or wireless Access Points—APs)
* learn about networking

If you manage a network and don't yet have a protocol analyzer, you need one. To help you find the network protocol analyzer that suits your environment, I first survey some typical features of software-based protocol analyzers. Then, I examine and compare these features in six popular network protocol analyzers. . . .