SmartSniff 用於擷取 TCP/IP 封包，輕巧精悍、實用便利；提供了三種擷取方式：原始通訊端 (Windows 2000/XP)、WinPcap 封包擷取驅動程式、網路監視器驅動程式；採用上下層窗格的方式，使您可以即時查閱 TCP/IP 的對話內! 容，同時也提供了三種檢視模式：自動、ASCII 以及 16 進位傾印模式。
由於修改 [內容] 對話方塊中的字型 Patch 了些代碼，雖然目前測試使用正常，但不保證沒有隱含的潛在性問題存在，如果出錯，有勞反應；直接對程式進行本地化，在 XML 的儲存上，會導致部份文字亂碼，您可以至官方下載原始版本使用 (官方也有語言檔)。SmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump. (for non-text base protocols, like DNS)
SmartSniff provides 3 methods for capturing TCP/IP packets : 1. Raw Sockets (Only for Windows 2000/XP or greater): Allows you to capture TCP/IP packets on your network without installing a capture driver. This method has some limitations and problems.
2. WinPcap Capture Driver: Allows you to capture TCP/IP packets on all Windows operating systems. (Windows 98/ME/NT/2000/XP/2003/Vista) In order to use it, you have to download and install WinPcap Capture Driver from this Web site. (WinPcap is a free open-source capture driver.)
This method is generally the preferred way to capture TCP/IP packets with SmartSniff, and it works better than the Raw Sockets method.
3. Microsoft Network Monitor Driver (Only for Windows 2000/XP/2003): Microsoft provides a free capture driver under Windows 2000/XP/2003 that can be used by SmartSniff, but this driver is not installed by default, and you have to manually install it, by using one of the following options:
* Option 1: Install it from the CD-ROM of Windows 2000/XP according to the instructions in Microsoft Web site
* Option 2 (XP Only) : Download and install the Windows XP Service Pack 2 Support Tools. One of the tools in this package is netcap.exe. When you run this tool in the first time, the Network Monitor Driver will automatically be installed on your system. Notice: If WinPcap is installed on your system, and you want to use the Microsoft Network Monitor Driver method, it's recommended to run SmartSniff with /NoCapDriver, because the Microsoft Network Monitor Driver may not work properly when WinPcap is loaded too. Version 1.40:‧Added local/remote MAC addresses (relevant only for local network, and it doesn't work with raw sockets)
‧Added IPNetInfo integration - When you put IPNetInfo utility in the same folder of SmartSniff, You can view the information about the remote IP addresses.
‧Added IP Country columns to display the country name of IP addresses. (requires to download an external file from http://software77.net/cgi-bin/ip-country/geo-ip.pl )
http://www.nirsoft.net/utils/smsniff.html哇哇評:擷取網路封包來看是一件好玩的事情但是我還是習慣用wireshark(前身ethereal)來幹壞事沒有啦～其實看封包還頗無聊的若沒有真的是專門在做網路的工作～我想沒必要去看封包的但是的確可以去學習一下封包裡面有哪些怪東西^^
