Driftnet

Driftnet is a tool inspired by EtherPEG that monitors network traffic and extracts images from observed TCP streams, displaying them in an X window. It can also optionally capture and play audio streams. The program is designed for environments with significant web traffic, making it interesting for passive network observation.

Use cases include running it on shared or unswitched networks to visualize images being transferred, though it blatantly invades privacy and is cautioned against for users with certain sensibilities. Images can be saved to the current directory by clicking on them in the display.

An adjunct mode allows integration with other programs, where driftnet silently manages image collection in a temporary directory, dropping excess images if a limit is set. Filter codes similar to tcpdump can refine the traffic monitored.

Driftnet listens on network interfaces or reads from pcap dump files to inspect TCP streams, extracting embedded images and optionally audio. It displays captures in a GTK-based X window and supports tcpdump-style filters prefixed with 'tcp and'. In adjunct mode, it limits images in a temporary directory for external collection processes.