Sniffing & Spoofingnetworksniffingtrafficextractionpcapmonitoring

Ferret-Sidejack

Ferret-sidejack monitors network traffic and extracts interesting data from it. It can feed data to the hamster tool or output to text files for analysis with indexers and grep.

Description

Ferret-sidejack is a network monitoring tool that extracts valuable information from captured traffic. It processes data in real-time or from offline files, identifying noteworthy bits for further analysis.

One primary use case is piping output to the hamster tool for additional processing. Alternatively, users can dump the extracted data into text files and employ indexers or grep commands to search and analyze the content effectively.

The tool operates within the FERRET 3.0.1 framework, supporting both live sniffing and file-based analysis, making it versatile for cybersecurity investigations involving network data.

How It Works

Ferret-sidejack uses libpcap (or winpcap) to capture packets from network adapters in live mode or reads pcap files offline. It parses the traffic to identify and extract interesting data, which can be output for tools like hamster or saved as text for grep-based analysis. Built with libpcap version 1.10.5 supporting TPACKET_V3, it handles both wired and wireless sniffing.

Installation

bash
sudo apt install ferret-sidejack

Flags

-i <adapter>Sniffs the wire(less) attached to that network adapter. Must have libpcap or winpcap installed to work.
-r <files>Read files in off-line mode. Can use wildcards, such as using "ferret -r *.pcap". Doesn't need libpcap to work.
-c <file>Reads in more advanced parameters from a file.
-hDisplays help and version information.

Examples

Displays the help menu, version (FERRET 3.0.1 - 2007-2012), build info, and libpcap details.
ferret-sidejack -h
Sniffs live traffic from the eth0 network adapter, requiring libpcap.
ferret-sidejack -i eth0
Sniffs wireless traffic from the wlan0 adapter.
ferret-sidejack -i wlan0
Reads and processes a single pcap file offline, no libpcap needed.
ferret-sidejack -r capture.pcap
Processes all pcap files in the current directory using wildcards.
ferret-sidejack -r *.pcap
Loads advanced parameters from a configuration file.
ferret-sidejack -c config.txt
Sniffs from eth0 and pipes extracted data to the hamster tool.
ferret-sidejack -i eth0 | hamster
Updated 2026-04-16kali.org ↗