NetOtter

NetOtter is a packet sniffer for the terminal, written in C. It lists your network interfaces, captures on the ones you enable, and decodes each frame layer by layer: Ethernet, ARP, IPv4, IPv6, TCP, UDP, IGMP and MLD. Its analysis view names the hosts and the applications behind the traffic. It runs on Linux and Windows, and both read the same capture files.

This wiki documents release r1.03 (save format v17).

#19    [veth0]     4.322547  192.0.2.1:37647       -> 192.0.2.2:53          ttl 64  UDP     60 B  [DNS A?]
#20    [veth0]     4.322716  192.0.2.2:53          -> 192.0.2.1:37647       ttl 64  UDP     53 B  [DNS A 1 answer]
#25    [veth0]     4.968173  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     40 B  [SYN]
#26    [veth0]     4.968214  192.0.2.2:8080        -> 192.0.2.1:59682       ttl 64  TCP     40 B  [SYN,ACK]

Where to start

Section	For	Start with
User guide	Using NetOtter: installing it, capturing, filtering, saving.	Installation, then Getting started
Developer documentation	Reading or changing the code: architecture, build, file formats, every function.	Architecture, then the Function explorer
Learning	Understanding what a packet is made of: Ethernet, IPv4, IPv6, TCP, UDP, DNS and QUIC, byte by byte, with real captures.	Learning

In one minute

make release && make install   # Linux: build, then install to /usr/bin with cap_net_raw
netotter -l                    # the interfaces and their ids
netotter -i 2                  # capture on interface 2; type h for the commands

Every example in this wiki was captured in an isolated test network that uses the documentation address ranges (192.0.2.0/24, 2001:db8::/32, MAC addresses 00:00:5e:00:53:xx) and the example.com domain. No real host appears.

The source code is at fg.water-source.ovh/Watersrc-stack/NetOtter.