EtherApe

What EtherApe is

EtherApe is a graphical network monitor for Linux that displays network activity as a map of hosts and connections. Hosts and links change size with traffic volume, while their colors indicate the most-used protocol. You can view activity at network, end-to-end IP, or port-to-port TCP level, and refine the display with network filters written in pcap syntax.

EtherApe can capture live network traffic or read saved tcpdump capture files. Live capture supports Ethernet, FDDI, PPP, SLIP, WLAN, and other encapsulated formats, including Linux cooked and PPI. Node and protocol summary dialogs provide statistics, and node statistics can be exported as XML or JSON. Name resolution uses standard libc functions, with optional ARES resolver integration.

The project describes EtherApe as open-source software under the GNU General Public License. Binary distributions are available for Linux only. EtherApe displays traffic that physically passes its network card; on switched networks, this generally means local or broadcast traffic unless traffic is mirrored to its port or the computer is placed at a gateway. The project directs users to SourceForge bug reporting, mailing lists, and discussion forums for support.

Who it suits

EtherApe suits Linux desktop users and system administrators who want a visual view of network traffic. It can analyze live captures or saved tcpdump files and export node statistics.

Getting started

1. Open the EtherApe project website.
2. Obtain a Linux binary distribution, or build from source.
3. For a source build, provide libpcap, GTK+ and GTK Builder 3.0 or above, the standard resolver library, and GooCanvas 2.
4. Launch EtherApe and select a network view or capture source.
5. Apply pcap-syntax filters as needed.
6. Export node statistics as XML or JSON if required.

Verdict

Choose EtherApe if you want a free Linux network monitor with visual traffic views, filters, and live or saved capture support. It is a poor fit when you need remote capture or broad visibility across a switched network without mirrored traffic or gateway placement.