BillSniff

BillSniff is a network protocol analyzer that can help with checking for network trouble by inspecting the packet exchange.

It includes support for various protocols, from IPv4, TCP, UDP, LLC, IPX or NetBios to ARP, ICMP and SMB.

The interface is organized into several sections for a better display of the captured data. It provides multiple tabs in the upper part, for viewing the captured packets, statistics, filters and logs.

Filtering options are essential for this sort of application since the volume of packets is quite large and without them reaching to the relevant information is most difficult.

These include the possibility to enable the display of specific protocols and allow turning on rules for different Internet protocols, which can be either ignored or captured. Rules are available for IP addresses, TCP, MAC addresses and ports.

From the context menu of a packet capture users can choose to copy specific details that include the time of the occurrence, the source and destination for MAC, IP and port as well as the names of the protocols.

In the lower part of the screen there is displayed a more detailed information about the captured packet.

The support for scripts allows the user to define a particular set of protocols that BillSniff recognizes in the packet data screen.

The scripts have to follow a specific syntax, which is described in the documentation paper that comes with the application.