How to Sniff Network Traffic

How-to

We will use WireShark to sniff the network traffic
so we will need to install the WireShark by

yum instal wireshark

Due to Wireshark is GUI base, we only eed to use one of its Wireshark function which is Tshark

tshark -V -R "filter"

-V will show all the details
-R “filter” will apply the filter rule

Example
If you want to sniff MSN chat, then you need to input:

tshark -V -R "msnms"

If you want to sniff google talk chat, then you need to input:

tshark -V -R "jabber"

If you want to capture all the traffic in the network, then you need to input:

tshark -V

If you want to capture traffic only to a specific destination such as talk.google.com, then you need to input:

tshark -V -R "ip.dst == talk.google.com"
  

due to a lot of traffic, it will be very hard to see so fast, so you will need to record it down to a document for easy reading

tshark -V -R "msnms" > data
vi data

Note

If the chat message is encrypted, it will show as encrypted or truncated
Please refer to the reference below for more filter list

Reference

• http://www.codealias.info/technotes/the_tshark_capture_and_filter_example_page - example
• http://www.manpagez.com/man/4/wireshark-filter/ - filter list