Which technical characteristic do Ethereal/Wireshark, TCPDump, and Snort have in common?

None of the three tools are written in Java; Wireshark, TCPDump, and Snort are all written in C.

TCPDump and Wireshark are passive analysis tools that do not send alerts to security monitors; only Snort has a rules-based alerting engine.

Each tool uses its own distinct analysis engine - Wireshark uses a dissector framework, Snort uses a rules-matching engine, and TCPDump uses BPF filter expressions - they do not share an analysis engine.

All three tools use libpcap on Unix/Linux systems (and WinPcap/Npcap on Windows) to read raw packets directly from network interfaces. This shared packet capture library provides the common foundation for obtaining frames off the wire, regardless of how each tool subsequently processes or displays the data.