Tstat is a passive sniffer able to provide several insight on the traffic patterns at both the network and the transport levels. See http://tstat.polito.it for more details.
Traffic measurement is an applied networking research methodology aimed at understanding packet traffic on the Internet. From its humble beginnings in LAN-based measurement of network applications and protocols, network measurement research has grown in scope and magnitude, and has helped providing insight to fundamental properties of the Internet, its protocols, and its users. For example, Internet traffic measurement and monitoring serves as the basis for a wide range of IP network operations, management, engineering tasks such as trouble shooting, accounting and usage profiling, routing weight configuration, load balancing, capacity planning, and so forth.
The lack of automatic tools able to produce statistical data from network packet traces was a major motivation to develop Tstat, a tool which, starting from standard software libraries, offers to network managers and researchers audit important information about classic and novel performance indexes and statistical data about Internet traffic. Started as evolution of TCPtrace, Tstat analyzes either real-time captured packet traces, using either common PC hardware or more sophisticated ad-hoc cards such as the DAG cards. Beside live capture, Tstat can analyze previously recorded packet-level traces, supporting various dump formats, such as the one supported by the libpcap library, and many more.