This is an open source protocol analyzer (Packet Sniffer) that's great for troubleshooting network problems.  This type of application used to be expensive, but Ethereal is free!

I've used this utility several times over the past couple of years, and have really gotten to like it.  Besides troubleshooting problems with VoIP phones and other network devices, I've used it for testing to see if a particular application is passing passwords as plain text.

I've always liked the philosophy that states, "Trust, but verify!"  In other words, if you are told that a particular application encrypts a user's credentials, don't just take vendor's word for it, test it yourself.  Ethereal helps with this strategy. 

For example, I was told that DotNetNuke passes the user name and password as plain text.  However, I verified this for myself by installing Ethereal on my laptop and capturing the traffic as I logged into the DotNetNuke site at The Community Foundation of Sarasota County.  Sure enough, my user name and password went flying by in the network traffic!  Wee!  So then I purchased and installed SSL Redirect from Sanibel Logic (see my DotNetNuke page for more details about SSL Redirect) to encrypt the login and registration pages at CFSC's web site.  When I was done installing SSL Redirect, I didn't just assume that the traffic was encrypted just because Sanibel Logic said so.  I ran Ethereal again as I logged into the DNN site, and verified that the password and user name were no longer hanging out there in space as plain text.

If you run a mail server where users have POP3 accounts using Port 110, using Ethereal can be a real "eye opener".  If you capture the traffic between the users and the mail server, you'll soon see their user names and passwords as their Outlook (or other email application) checks for new messages.  This can be especially dangerous in an Exchange environment where the mailbox credentials match a domain account!  You can use SSL to encrypt POP3 traffic so that this isn't an issue, but even if you do, you can use Ethereal to verify that the encryption is actually working.

If you want more information, go to http://www.ethereal.com/.