EtherApe

EtherApe — Watching Network Traffic as a Graph General Information EtherApe is a visual network monitor that shows connections as a live diagram instead of just lines of text. Each host becomes a circle, and the traffic between them appears as links that grow thicker when more data flows. For administrators this is sometimes more intuitive than digging through counters — especially when trying to figure out which system suddenly started talking too much on the network.

Facebook
Twitter
LinkedIn
Reddit
Telegram
WhatsApp

EtherApe — Watching Network Traffic as a Graph

General Information

EtherApe is a visual network monitor that shows connections as a live diagram instead of just lines of text. Each host becomes a circle, and the traffic between them appears as links that grow thicker when more data flows. For administrators this is sometimes more intuitive than digging through counters — especially when trying to figure out which system suddenly started talking too much on the network.

How It Works

Under the hood, EtherApe uses libpcap to capture packets from an interface. Instead of storing everything, it summarizes who talks to whom and how much. Nodes on the screen grow or shrink depending on activity, and protocols are marked with different colors. A busy DNS server will look different from an overloaded web server, and that difference can be spotted almost instantly. It works both in real-time capture and with saved packet dumps, which makes it useful for both live troubleshooting and later analysis.

Functions

Feature Description
Real-time view Shows active hosts and their connections while traffic flows.
Graph display Links scale with bandwidth, giving a quick idea of load.
Protocol colors Distinguishes traffic types visually (HTTP, DNS, SSH, etc.).
Capture modes Can analyze live interfaces or replay saved files.
Filters BPF filters allow focusing on specific hosts or ports.
Unix compatibility Runs on most Linux and BSD systems with X11.

Installation Guide

In most Linux distributions EtherApe is already packaged.
1. Install it with the package manager (`apt install etherape` on Debian/Ubuntu, `dnf install etherape` on Fedora).
2. Start the program with root or via `sudo` to allow packet capture.
3. Pick the interface you want to monitor.
4. Apply filters if you want to watch only certain traffic.
5. The graph updates live — nodes and links will shift as packets flow.

When It’s Handy

Admins often launch EtherApe when a link is saturated and they need a quick visual answer. It’s also a good demo tool in training rooms, since students can literally watch protocols appear on the screen. In some NOCs, it’s run as a side display — giving at-a-glance awareness of unusual patterns.

What It Can’t Do

EtherApe is not a logging or alerting system. Once you close it, the graph disappears. It doesn’t scale for long-term monitoring, and since it needs a GUI, it’s not well suited for headless servers. For deep packet dissection, tools like Wireshark or tcpdump are still the standards.

Comparison

Tool Platforms Strengths Typical Use
EtherApe Linux/Unix Real-time graphical view, easy to spot patterns Quick troubleshooting, teaching, visual NOC display
Wireshark Multi-platform Deep protocol decoding, rich filters Detailed packet analysis, security forensics
Darkstat Linux/Unix Lightweight stats via web interface Simple bandwidth monitoring and host stats

Other programs

Submit your application