Which technical characteristic do Ethereal/Wireshark, TCPDump, and Snort have in common?

All three tools are implemented primarily in C, not Java; Java is not used in any of these applications.

TCPDump and Wireshark are passive capture and analysis tools that do not generate or send security alerts; only Snort has an intrusion detection alerting function.

Each tool uses its own distinct analysis or detection layer - Snort uses a rules-based detection engine, Wireshark uses protocol dissectors, and TCPDump uses its own filter and display logic - so they do not share a packet analysis engine.

All three tools rely on the libpcap library on Unix/Linux systems (and its Windows port WinPcap or Npcap) as the standardized packet capture engine that interfaces directly with the network adapter, allowing them to receive raw frames off the wire - this shared dependency is their defining technical commonality regardless of what each tool does with the captured data afterward.