Ethereal / Wireshark
(dst port 80 && dst net != 192.168.10) || (src port 80 && src net ! 192.168.10) || (dst port 30102 && dst net 192.168.10) || (src port 30102 && src net 192.168.10)
In this scenario, we have a proxy server listening on port 30102. The first group captures traffic from the proxy to the origin server (destination port 80 and destination address is a public IP). The second group captures traffic from the origin server to the proxy (source port 80 and source address is a public IP). Third group captures traffic from the browser to the proxy. The fourth group captures traffic from the proxy to the browser.
http://www.wireshark.org/
http://home.insight.rr.com/procana/
page revision: 2, last edited: 21 Nov 2008 14:36