3 ms·
It is not only useful for security professionals. Anybody doing any kind of network programming should have it under their belt. Application level debugging onl
by praptak 14y ago
It is not only useful for security professionals. Anybody doing any kind of network programming should have it under their belt. Application level debugging only goes so far. Sooner or later you'll hit a problem like a network card sometimes sending super jumbo frames which the switch cannot handle or some weird performance problems. Packet level debugging is a must in such cases.
- ajross 14y agoIt's even useful for answering bland user questions like "Hm... is this hanging process just not honoring my proxy settings? Yup."
- mahmud 14y agoI used it several months ago to reverse engineer the data our POSes (point of sale devices) send to our licensed ERP app (bundled together by vendor) so we can use a superior POS, as they would rather force us to use their crap than publish an API.
- johngalt 14y agoAs a sysadmin, I find it's great for problem localization. Usually an application has a pile of services behind it. Where is it going wrong? Appserver? Backend database? Name resolution? network contention? misrouted? blocked by a firewall? You can cut away huge swaths of troubleshooting areas just by watching what is on the wire. There are problems you just won't find without knowing how to use a sniffer. I once had a core router dropping packets because of a flawed ACL implementation (It would treat fragmented packets as if they had port numbers at the matching payload offset). Knowing how to use a packet sniffer makes hard problems so easy it feels like cheating.
- spydum 14y agoExactly the points I was coming to make. People I work with think I am some sort of addict when my default answer when someone asks me about a problem is to fire up a packet capture. Between tcpdump, nc, and burpsuite, seems like few network gremlins can hide.