Host

[Chris Uppal]

Yup, Ethereal/wireshark is good stuff for monitoring HTTP traffic and
more, although it may be a little harder to use (although not bad once
you know how). I prefer Proxomitron for lightweight HTTP monitoring.

Different tools for different jobs...

Proxomitron seems to be (I've never tried it) very much about general-purpose
HTTP monitoring and/or modification and (I presume) is good at that task. By
the same token, I wouldn't trust it to tell me /exactly/ what's going up and
down the wire -- things like character sets, header ordering, incorrectly
formed headers, and so on. In particular, I wouldn't trust it to tell me what
the HTTP client /would/ be sending if it were connected directly to the server,
rather than a proxy. And of course, only tool like Wireshark/Ethereal will
tell you about package boundaries, network retries, DNS lookups, etc, etc, (not
to mention other protocols). OTOH, Wireshark/Ethereal can't even make a stab
at telling you what the data going up and down an SSL link is...

But if you had to use only one (and I /do/ use only one) then
Wireshark/Ethereal wins hands-down ;-)

-- chris

 

[Martin Gregorie]

I only just recently found out about Ethereal forking off into a product
called Wireshark. The ethereal site doesn't mention Wireshark for weird
legal reasons. I believe wireshark is the more up-to-date/recent project...

I heard that the name change happened when the author of the program
changed jobs. For some reason the company had rights to the name
"Ethereal" but not to the software and wouldn't release the name.

So, yes, Wireshark is the most up-to-date version.

 

[bjeremy]

OTOH, Wireshark/Ethereal can't even make a stab

at telling you what the data going up and down an SSL link is...

Sure it will... it just won't unencrypt it for you... but if you have
time on your hands, you can determine the cipher and hash from the
record layer and then "have at it"