The infamous Back Orifice has a freeware sniffer which can be a plugin for BO or run standalone. It has the clever name ButtSniffer and is found many places including the excellent Packetstorm. To run ButtSniff, download it and unzip into the directory of choice. It does not have be installed but can be run from the commandline. A filename containing a list of IP and port filter rules Read the 'readme.txt' for more information and examples.
Filters are only active on dump type 'p'.
Because ButtSniff does not have to be installed,just copy the two files buttsniff.exe and buttsniff.dll to a folder, it is tool of choice for hackers wanting to capture network packets off the network of an NT box which has been compromised by gaining a command shell with a buffer overflow vulnerability. One of the better sniffers from the Unix world is dsniff . It requires libpcap, a packet driver. Dsniff thus has to be installed using a process that requires a reboot. Its worth the effort.