netsniff-ng

What netsniff-ng is

netsniff-ng is a free, open-source Linux network analyzer and toolkit for network development, debugging, analysis, auditing, and reconnaissance. It captures, analyzes, replays, and redirects network traffic using zero-copy packet mechanisms. Users can capture traffic live from the command line, apply packet filters, and analyze saved traces offline. It captures and reads pcap files, including tcpdump-capable formats with nanosecond resolution, Alexey Kuznetzov's pcap, and netsniff-ng pcap. Its dissector covers protocols and link types such as Ethernet, WLAN, ARP, VLAN, IPv4, IPv6, TCP, and UDP. The toolkit also includes trafgen, mausezahn, ifpps, curvetun, astraceroute, flowtop, and bpfc. It is licensed under GNU GPL version 2.0. The project marks mausezahn and curvetun experimental and advises against production use; it also makes no guarantee that the tools are free of bugs. Release verification instructions use Git tags and GPG signatures, and the project points users to a mailing list and online FAQ.

Who it suits

netsniff-ng suits Linux users who need command-line capture, packet filtering, or offline trace analysis. Its toolkit also covers network development, debugging, auditing, and reconnaissance.

Limits

The project identifies mausezahn and curvetun as experimental and advises against using them in production. It also provides no guarantee that its tools are free of bugs.

Getting started

1. Visit the netsniff-ng website.
2. Use a Linux system, the listed supported platform.
3. Start with the free netsniff-ng toolkit plan.
4. Consult the project's online FAQ or mailing list for questions.

Verdict

netsniff-ng brings capture, filtering, protocol analysis, and trace replay into a Linux toolkit. Note that two utilities are marked experimental and the project does not guarantee bug-free tools.