decoding IP package

[snowsmart]

A sniffier software nomally just tells us what type of traffice it was and which ports it was using.

Is there a software out there which can tell what type of application it was and what was the user really doing?

things like if it is Http traffic, pages this user was viewing....
or if it is a ftp tracffic, the login id and the file name that he was traferring.


please advice

thanks

 

[cchipman]

What we tend to do is to mirror the target port (using the switch software) and then use Ethereal to gives is a detailed packet capture of what's going on. It tends to work very well.

 

[lgarner]

A "sniffer software" does exactly what you're asking for. Ethereal is a freeware one, WildPackets' Etherpeek is excellent.