2/21    What's the best tool to convert raw network traffic captured on the
        wire into something useful?  I'm currently reading the unparsed
        output from ngrep, tcpdump and similar tools but I'd like to see that
        turned into the real thing.  For example, I want to see an output log
        that says machine X went to host/port Y/y to grab URL Z for http
        connections.  I want emails going by saved out in mbox or other
        human readable format.  Does such a thing exist?  I started to write
              \- yes, but you have to email me --psb
                 \_ why not posted it on the web?  I was looking for something
                    \- because as a general matter these anon requests are
                       annoying. i can understand for a dumb question or a
                       contentious issue but not in a case like this. i suppose
                       if you are widely disliked on sloda, that might be one
                       reason to ask for help anonymously. --psb
                       \_ maybe some people don't want their name attached
                          with looking for software to read raw network
                          traffic.  the world just isn't as open minded and
                          understanding as you are, partha.
                    like that monitoring LAN network to spot abuses on
                    company's network, mainly to spot p2p client use at the
                    office   --kngharv
                             \- if you want to look for p2p, that is a
                                matter of looking for the protocol. as a
                                general matter compliance issues are easier
                                to deal with because you can do offline rather
                                than realtime detection [offline = run on
                                tracedumps]. of course if you want to use
                                something like kazaa obliterator, then you
                                need to detect in realtime ... or not too
                                lagged batch proc. what is this "web" you
                                speak of. --psb
        my own in perl but then realised I can't be the first person to ever
        need this.  Thanks!
        \_ fantastic GUI utility called Ethereal. Available binaries for
           windows, linux, solaris. source available. I've used it only
           for reading traffic at the packet level, but perhaps if you want
           application level stuff (eg, emails as opposed to SMTP packets
           or whatever) perhaps you could write that yourself since its
           open source.                         - rory
        \_ Etherpeek
        \_ If it doesn't have to be graphical, you might want to consider
           hogwash (snort-based IDS.)  Also, although it's more of a toy
           than a tool, take a look at Etherape.  -John
           \_ use Etherape before.  I find it not as useful as I would like
              to be.  Only thing cool about it is that it color coded traffic
              from different ports.  This feature allow me to spot p2p
              client (most people uses p2p don;t bother with port changes),
              and it is pretty good for detecting infected computer which
              eat up all the bandwidth.
                \_ Like I said, it's sort of a toy, although useful to get
                   an overview of traffic patterns.  What I find really
                   hilarious (almost totally useless as a tool) is driftnet.