Dsniff is a good tool, but it can't do everything. It is purely a password sniffer. I'm sure there are many situations when traffic needs to be captured assembled and presented. If they simply relied on dsniff they would have to use captured passwords to log on to systems and access information that could have simply been picked up off the wire. This would could tip off the person being investigated.

I'm not an expert on Carnivore, but I would have to think that Ethereal would come closer to being a replacement than DSniff. At least with ethereal they could get everything then send the capture files to appropriate programs that could parse for valid information.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/10307/30205#30205