EtherApe — Watching Network Traffic as a Graph
General Information
EtherApe is a visual network monitor that shows connections as a live diagram instead of just lines of text. Each host becomes a circle, and the traffic between them appears as links that grow thicker when more data flows. For administrators this is sometimes more intuitive than digging through counters — especially when trying to figure out which system suddenly started talking too much on the network.
How It Works
Under the hood, EtherApe uses libpcap to capture packets from an interface. Instead of storing everything, it summarizes who talks to whom and how much. Nodes on the screen grow or shrink depending on activity, and protocols are marked with different colors. A busy DNS server will look different from an overloaded web server, and that difference can be spotted almost instantly. It works both in real-time capture and with saved packet dumps, which makes it useful for both live troubleshooting and later analysis.
Functions
Feature | Description |
Real-time view | Shows active hosts and their connections while traffic flows. |
Graph display | Links scale with bandwidth, giving a quick idea of load. |
Protocol colors | Distinguishes traffic types visually (HTTP, DNS, SSH, etc.). |
Capture modes | Can analyze live interfaces or replay saved files. |
Filters | BPF filters allow focusing on specific hosts or ports. |
Unix compatibility | Runs on most Linux and BSD systems with X11. |
Installation Guide
In most Linux distributions EtherApe is already packaged.
1. Install it with the package manager (`apt install etherape` on Debian/Ubuntu, `dnf install etherape` on Fedora).
2. Start the program with root or via `sudo` to allow packet capture.
3. Pick the interface you want to monitor.
4. Apply filters if you want to watch only certain traffic.
5. The graph updates live — nodes and links will shift as packets flow.
When It’s Handy
Admins often launch EtherApe when a link is saturated and they need a quick visual answer. It’s also a good demo tool in training rooms, since students can literally watch protocols appear on the screen. In some NOCs, it’s run as a side display — giving at-a-glance awareness of unusual patterns.
What It Can’t Do
EtherApe is not a logging or alerting system. Once you close it, the graph disappears. It doesn’t scale for long-term monitoring, and since it needs a GUI, it’s not well suited for headless servers. For deep packet dissection, tools like Wireshark or tcpdump are still the standards.
Comparison
Tool | Platforms | Strengths | Typical Use |
EtherApe | Linux/Unix | Real-time graphical view, easy to spot patterns | Quick troubleshooting, teaching, visual NOC display |
Wireshark | Multi-platform | Deep protocol decoding, rich filters | Detailed packet analysis, security forensics |
Darkstat | Linux/Unix | Lightweight stats via web interface | Simple bandwidth monitoring and host stats |