21–30 of 30 posts
But if you install Wireshark does it capture traffic on the LAN (ie that doesn't begin or end with the current PC). I never had any luck with that on Windows.
Not unless (a) your PC is routing traffic or (b) your PC is connected to a hub vs. a switch [1]. Unless one of these things is happening (even if your card is in promiscuous mode), those packets won't make it into your machine. [1] http://www.webopedia.com/DidYouKnow/Hardware_Software/router...
very interesting, had no idea the capability was there. Tried on my own, I see SSID beacons from my wifi card, wifi channel signal levels, then you can go up several layers and see request URI's on HTTP requests.. very nice. More detail, in a parsed format which is filterable than I would have expected.. edit : indeed, it even handles parsing SSH key exchanges.. very impressive: http://imgur.com/ijQX3Zq
I wonder why they chose to write their own packet analyzer while so much work has been put into Wireshark's one. Why not use existing software?
Both Microsoft offerings can read not just cap/pcap files but ETL that could include stack tracing, so you might be able to follow a package through the computer's networking stack.
Also Message Analyzer has more advanced parsers and shows the information in a different way than Wireshark. I guess that's one of the reasons why I can happily load a 3GB cap file in Wireshark, but I would avoid doing that in Message Analyzer :)
Earlier quoted context omitted.
Not unless (a) your PC is routing traffic or (b) your PC is connected to a hub vs. a switch [1]. Unless one of these things is happening (even if your card is in promiscuous mode), those packets won't make it into your machine. [1] http://www.webopedia.com/DidYouKnow/Hardware_Software/router...
What about wireless traffic?
Where can you hang out to find out about all the cool Windows stuff? I've been using Windows forever. Oftentimes you feel like certain things are so so much harder than on a UNIXy system and then BAM it's actually simple but nobody seems to talk about it. Seems like Windows has a big discoverability problem with dev/admin tools.
I think the key insight here is the availability of Message Analyzer app -- I haven't used it but that's a good alternative that's supported than the hoops you sometimes have to join to run Wireshark.
Look at it closely. It's neat, but it is different from the frame-oriented approach of Wireshark / Network Monitor. It's great, but... different.
Earlier quoted context omitted.
Look at it closely. It's neat, but it is different from the frame-oriented approach of Wireshark / Network Monitor. It's great, but... different.
Yeah, I'd still prefer Wireshark but this is useful to know about for a variety of situations where it'd perhaps be worthwhile to see something.. if only Microsoft just exported to pcap :P