Security Basics: Re: Sniffering and Protocol Analyzer ?

[lobo <lobo () c3a de>]

Hi Mohamed,

On Sun, 2007-07-08 at 12:59 +0300, Mohamed Farid wrote:
> I used Ethereal ( Woreshark ) but I couldn't get an easy output ...
> Can you advise what should I do ?
I would recommend to use the conversation list. You can find it in the
menu under Statistics->Conversations. Switch to the IPv4 tab and sort
the list by "Bytes" to find the host which might be the cause for that
traffic utilization.

But I also want to mention that wireshark is not always the best way
to start with, when you want to analyze large pcap files. There was
some weeks ago a good article on the TaoSecurity blog about structured
traffic analysis. If you are interested in, here is the link:
http://taosecurity.blogspot.com/2007/05/lbnlicsi-enterprise-tracing-project.html

best regards,

jochen

Attachment: signature.asc
Description: This is a digitally signed message part