JAYRAY  Being familiar with tools such as tcpflow/tcpdump/ethereal etc. gives you another important benefit too: portability. You can use them in the same way whether you're sitting in front of an OS X, Linux, Solaris or HP-UX box and whether or not you have a window manager available. You also don't need to be sitting near the box you're monitoring - you just telnet/ssh over there and execute the capture remotely.

However, none of these tools fully decode HTTP. Say you want to see what HTML your webserver or appserver is spitting out, but the server's using GZIP content encoding. You'll just get gibberish being printed out.

Try doing 'sudo tcpflow -c' and point your browser at slashdot.org or google.com and you'll see what I mean!

As well as extra decoding, HTTP Scoop gives you a UI which does things like HTML/XML syntax highlighting, hex dumps etc. Maybe not essential, but nice to have.

I'm not knocking tcpflow etc; just pointing out that they're different tools for different jobs... but then again, I'm not entirely unbiased ;-)

James

Tuffcode Ltd  
(Version 1.1)