Which technical characteristic do Ethereal/Wireshark, TCPDump, and Snort have in common?

All three tools are written primarily in C, not Java; Java imposes a JVM overhead that would be impractical for high-speed packet capture.

TCPDump and Wireshark are passive analysis tools that display captured data to the user and do not generate or send security alerts; only Snort as an IDS has alerting capability.

Each tool has its own independent packet analysis and dissection engine; the shared component is only the packet capture layer, not analysis logic.

All three tools use libpcap on Unix/Linux (or WinPcap/Npcap on Windows) as the common packet capture layer, which provides standardized access to raw network interfaces at the OS level. This shared dependency means each tool calls the same underlying library to obtain raw packets from the network adapter, regardless of how each tool then processes or analyzes those packets.