This is a libpcap-based program. It has two runtime modes:
1.
1)It sniffs packets and spools them straight to the disk and can daemonize itself for background packet logging. By default the file rolls over when 1 GB of data is logged.
2.
2)It sniffs packets and rewrites them to a second interface, essentially acting as a soft tap. It can also do this in daemon mode.
Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures.
Snort is a Network Intrusion Detection System (NIDS), which can view and analyse packets on a network to determine whether or not a system is being attacked by remote.