libpcap is a platform independant API for capture of network data from several types of link-layers. libpcap was originally developed at Lawrence Berkeley National Laboratory The original version is here. DOS-libpcap supports Ethernet only. Currently only packet-drivers are considered stable to use. However, preparation for directly accessing an Ethernet board is built-in; refer ./pcap/device16.c for 16-bit devices (pkt-drvr and NDIS2) and ./pcap/device32.c for 32-bit devices (3c509 etc.).
tcpdump is a tool for network monitoring using libpcap to capture data. The original distribution is available at LBL or www.tcpdump.org. Changes include detailed analysis of NetBIOS, SMB, SNMP, DECnet and IPv6 protocols. It may write to file, stdout or directly to screen (with option -C) for faster tracing. It can also read and analyse dump-files at real pace to simulate original network rate. It prints data contents in hex and/or ascii.
![[tcpdump screen]](tcpdump.png)
Figure 1: shows output of tcpdump -Cq ip
A C library for portable packet creation. Written by Mike D. Schiffman. Original version available here. Libnet is an API to help with the construction and handling of network packets. It provides a portable framework for low-level network packet writing and handling (use libnet in conjunction with libpcap and you can write some really cool stuff). Libnet includes packet creation at the IP layer and at the link layer as well as a host of supplementary and complementary functionality. Libnet is very handy with which to write network tools and network test code. See the manpage and sample test code for more detailed information. Don't confuse this libnet with the djgpp/Winsock library or Perl module of the same name.
Libnids is a library for Network Intrusion Detection Systems. Little testing has been done on this DOS/djgpp port. Take care... The primary libnids site is PacketFactory. Original coders are Dug Song and Nergal.
This is a nice tool for showing summary of network activity. Total packets / bytes received, average packet size, sorted on most active link / network -layer protocols. Originally made for Linux by Scott Parish. Requires SLang screen library.
![[nettop screen]](nettop.png)
A grep tool for filtering network data. Filter using regular expressions or the BPF filter language built into libpcap. Author is Jordan Ritter.
An advanced curses-based network monitor with features such as: TCP connection view, tcpdump style filter expressions,
statistics per host etc. This program originally made for Linux by Gerard Paul Java. Note: this version doesn't have reverse address lookup.
![[IPtraf config screen]](iptraf.png)
ntop is a tool that shows the network usage, similar to what the popular top command on Unix does. Written by Luca Deri. Look here for more information and latest version.
Similar to tcpdump, but tcpflow reconstructs the actual data streams and stores each flow (session) in a separate file for later analysis. The tool is of limited use on DOS because of the very long filenames produced. A fix is under way. Made by Jeremy Elson. For the latest information on tcpflow, please go here.
tcpshow reads a raw tcpdump save-file and decodes headers and data of Ethernet, IP, ICMP, UDP and TCP packets. BPF filter expression can be used on packet stream. Made by Mike Ryan.
tcpslice extract pieces of and/or glue together tcpdump save-files. Copies to stdout all packets from its input file(s) whose timestamps fall within a given range. Author is Vern Paxson, of Lawrence Berkeley National Laboratory. The current version is available here.
tcptrace is a TCP connection analysis tool. It can tell you detailed information about TCP connections by sifting through dump files. Various dump file formats is supported. This version does not yet support plotting of graphs. Made by Shawn Ostermann. Check out http://jarok.cs.ohiou.edu/software/tcptrace/tcptrace.html for latest version.