Compares packet captures, detects forged, dropped or mangled packets
Description
Pcapdiff is a tool developed by the EFF to compare two packet captures and
identify potentially forged, dropped, or mangled packets. Two technically-
inclined friends can set up packet captures (e.g. tcpdump or Wireshark) on
their own computers and produce network traffic between their two computers
over the Internet. Later, they can run pcapdiff on the two packet capture
files to identify suspicious packets for further investigation. See
Detecting packet injection: a guide to observing packet spoofing by ISPs
and EFF's Test Your ISP Project for more background.
