The 2 bytes after the addresses contain the type field and the type is compared against the IP type. If it is an IP packet, the ip packet header will be examined. If the protocol field in the IP header is TCP, the IP source and destination addresses will be compared against a list of addresses that need to be monitored and the TCP header will be read to compare the TCP source and destination ports against a list of ports that are being monitored. If all those comparisons reveal that the packet needs to be saved, a filename based on the ip addresses and tcp source port will be opened and the packet data will be appended to the file. Program Considerations Sly is not a unique idea or implementation of that idea.
All sniffers are basically the same.
They all grab the same data. The only difference is in the analysis of the data. Sly is a decent implementation of a sniffer and could probably be extended to include more protocol types in its analysis than it currently supports the analysis for. Sly was designed to be run on the Linux platform but could probably be ported to other platforms fairly easily. Further Developments Further developments to sly may include analysis of the UDP protocol and the IPX and SPX protocols.