On Wed, 06 Jul 2016 04:26:43 -0400, Paul wrote:

This is what Wireshark with its included copy
of WinPCAP is for. And yes, I have captured transactions
to News servers with it - every time the server
stops working :-) And port 119 is the only port
that makes sense, as it's plaintext and easily
readable. Even the summary window tells a tail,
and the process is not hard to follow.

Wireshark is multi-platform, so some details
underneath will change from one platform to
another. On MacOSX, only certain versions of
Wireshark, work with each version of MacOSX,
and the web site doesn't map it out for you.
Leaving you with a horrendous testing task.
On an OS with a working Repository, it should
be easier to get working materials.

I had already downloaded WinPCap and WinDump and I was working on
downloading the WinPcap-recommended Riverbed airpcap for Microsoft Windows.
http://www.riverbed.com/hk/products/...d-airpcap.html

The problem, as a novice, is if people don't say, there are always a
billion gotchas (like having to compile tcpdump and needing the pcap
program).

There is always the additional gotcha, especially with Windows, that you
end up with the "wrong" (sneaky) version which is filled with adware and
such.

So it always helps to confirm that the "canonical" site is being used.

It seems RIVERBED is the replacement for WIRESHARK based on the fact that
wireshark isn't mentioned on the WinDump site but Riverbed has its own
link.

Is that a correct assumption?

Or should I forgoe Riverbed in favor of Wireshark?
https://www.wireshark.org/download.html