Ethereal - Behind The Scenes

• Ethereal uses a low-level library called "libpcap" to perform the actual packet capturing.
• But the parsing of the protocols is done inside the Ethereal application itself.
• We can use libpcap directly in programs we write.

Originally written by guy keren