1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
=head1 NAME
|
|
|
|
|
|
|
|
Ethereal - Interactively browse network traffic
|
|
|
|
|
|
|
|
=head1 SYNOPSYS
|
|
|
|
|
|
|
|
B<ethereal>
|
|
|
|
S<[ B<-B> byte view height ]>
|
1998-09-17 02:01:50 +00:00
|
|
|
S<[ B<-b> bold font ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-c> count ]>
|
1999-05-11 20:07:12 +00:00
|
|
|
S<[ B<-F> ]>
|
|
|
|
S<[ B<-f> filter expression ]>
|
1998-09-17 02:01:50 +00:00
|
|
|
S<[ B<-h> ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-i> interface ]>
|
1999-05-11 20:07:12 +00:00
|
|
|
S<[ B<-k> ]>
|
1998-09-17 02:01:50 +00:00
|
|
|
S<[ B<-m> font ]>
|
|
|
|
S<[ B<-n> ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-P> packet list height ]>
|
1999-05-11 20:07:12 +00:00
|
|
|
S<[ B<-Q> ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-r> infile ]>
|
1999-05-11 20:07:12 +00:00
|
|
|
S<[ B<-S> ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-s> snaplen ]>
|
|
|
|
S<[ B<-T> tree view height ]>
|
1998-09-27 22:12:47 +00:00
|
|
|
S<[ B<-t> time stamp format ]>
|
1998-09-17 02:01:50 +00:00
|
|
|
S<[ B<-v> ]>
|
1998-09-16 02:39:15 +00:00
|
|
|
S<[ B<-w> savefile]>
|
|
|
|
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
|
|
|
B<Ethereal> is a network protocol analyzer based on the B<GTK+> GUI toolkit. It lets
|
|
|
|
you interactively browse packet data from a live network or from a B<pcap>
|
|
|
|
/ B<tcpdump()> formatted capture file.
|
|
|
|
|
|
|
|
=head1 OPTIONS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
|
|
|
=item -B
|
|
|
|
|
|
|
|
Sets the initial height of the byte view (bottom) pane
|
|
|
|
|
1998-09-17 02:01:50 +00:00
|
|
|
=item -b
|
|
|
|
|
|
|
|
The bold font name used for packet fied display.
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -c
|
|
|
|
|
|
|
|
The default number of packets to read when capturing live data.
|
|
|
|
|
1999-05-11 20:07:12 +00:00
|
|
|
=item -F
|
|
|
|
|
|
|
|
Specifies that the live packet capture will be performed in a separate
|
|
|
|
process. It is then possible to open/reload the file to display the
|
|
|
|
packets actually captured.
|
|
|
|
|
|
|
|
=item -f
|
|
|
|
|
|
|
|
Sets a filter expression.
|
|
|
|
|
1998-09-17 02:01:50 +00:00
|
|
|
=item -h
|
|
|
|
|
|
|
|
Prints the version and options and exits.
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -i
|
|
|
|
|
|
|
|
The name of the interface to use for live packet capture. It should match
|
|
|
|
one of the names listed in "B<netstat -i>" or "B<ifconfig -a>".
|
|
|
|
|
1999-05-11 20:07:12 +00:00
|
|
|
=item -k
|
|
|
|
|
|
|
|
Start the capture session immediately, this option requires
|
|
|
|
the B<-i> and B<-w> parameters.
|
|
|
|
|
1998-09-17 02:01:50 +00:00
|
|
|
=item -m
|
|
|
|
|
|
|
|
The font name used by B<Ethereal>.
|
|
|
|
|
|
|
|
=item -n
|
|
|
|
|
|
|
|
Disable network object name resolution (such as hostname, TCP and UDP port
|
|
|
|
names).
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -P
|
|
|
|
|
|
|
|
Sets the initial height of the packet list (top) pane
|
|
|
|
|
1999-05-11 20:07:12 +00:00
|
|
|
=item -Q
|
|
|
|
|
|
|
|
Exit after the end of capture session (useful in batch mode with B<-c>
|
|
|
|
option for instance), this option requires the B<-i> and B<-w>
|
|
|
|
parameters.
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -r
|
|
|
|
|
|
|
|
Read packet data from I<file>. Currently, B<Ethereal> only understands
|
|
|
|
B<pcap> / B<tcpdump> formatted files.
|
|
|
|
|
1999-05-11 20:07:12 +00:00
|
|
|
=item -S
|
|
|
|
|
|
|
|
Specifies that the live packet capture will be performed in a separate
|
|
|
|
process (same as option B<-F>) and that the packet displaying should be
|
|
|
|
synchronized with the capture session without human operation
|
|
|
|
(i.e. without load/reload). This is an experimental feature.
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -s
|
|
|
|
|
|
|
|
The default snapshot length to use when capturing live data. No more than
|
|
|
|
I<snaplen> bytes of each network packet will be read into memory, or saved
|
|
|
|
to disk.
|
|
|
|
|
|
|
|
=item -T
|
|
|
|
|
|
|
|
Sets the initial height of the tree view (top) pane
|
|
|
|
|
1998-09-27 22:12:47 +00:00
|
|
|
=item -t
|
|
|
|
|
|
|
|
Sets the format of the packet timestamp displayed in the packet list
|
1998-12-29 04:05:38 +00:00
|
|
|
window. The format can be one of 'r' (relative), 'a' (absolute), or 'd'
|
|
|
|
(delta). The relative time is the time elapsed between the first packet
|
|
|
|
and the current packet. The absolute time is the actual date and time the
|
|
|
|
packet was captured. The delta time is the time since the previous packet
|
|
|
|
was captured. The default is relative.
|
1998-09-27 22:12:47 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=item -v
|
|
|
|
|
|
|
|
Prints the version and exits.
|
|
|
|
|
|
|
|
=item -w
|
|
|
|
|
|
|
|
Sets the default capture file name.
|
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head1 INTERFACE
|
|
|
|
|
|
|
|
=head2 MENU ITEMS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=item File:Open, File:Close, File:Reload
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
Open, close, or reload a capture file.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
=item File:Print Packet
|
|
|
|
|
|
|
|
Print a description of each protocol header found in the packet, followed
|
|
|
|
by the packet data itself. Printing options can be set with the
|
1998-10-13 02:10:57 +00:00
|
|
|
I<Edit:Preferences> menu item.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
=item File:Quit
|
|
|
|
|
|
|
|
Exits the application.
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=item Edit:Preferences
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
Sets the packet printing and filter options (see L<"Preferences"> below).
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-06-19 08:48:30 +00:00
|
|
|
=item Capture:Start
|
1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
Initiates a live packet capture (see L<"Capture Preferences"> below).
|
1999-04-06 16:35:47 +00:00
|
|
|
A temporary file will be created to hold the capture. The location of the
|
|
|
|
file can be chosen by setting your TMPDIR environment variable before
|
|
|
|
starting ethereal. Otherwise, the default TMPDIR location is system-dependent,
|
|
|
|
but is likely either /var/tmp or /tmp.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-06-19 08:48:30 +00:00
|
|
|
=item Display:Options
|
|
|
|
|
|
|
|
Sets the format of the packet timestamp displayed in the packet list
|
|
|
|
window to relative, absolute, or delta.
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=item Tools:Follow TCP Stream
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
If you have a TCP packet selected, it will display the contents of the TCP
|
|
|
|
data stream in a separate window.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
=back
|
|
|
|
|
|
|
|
=head2 WINDOWS
|
|
|
|
|
|
|
|
=over 4
|
|
|
|
|
|
|
|
=item Main Window
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The main window is split into three panes. You can resize each pane using
|
|
|
|
a "thumb" at the right end of each divider line. Below the panes is a
|
|
|
|
strip that shows the file load progress, current filter, and informational
|
|
|
|
text.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The top pane contains the list of network packets that you can scroll
|
1998-09-27 22:12:47 +00:00
|
|
|
through and select. The packet number, packet timestamp, source and
|
|
|
|
destination addresses, protocol, and description are printed for each
|
|
|
|
packet. An effort is made to display information as high up the protocol
|
|
|
|
stack as possible, e.g. IP addresses are displayed for IP packets, but the
|
|
|
|
MAC layer address is displayed for unknown packet types.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The middle pane contains a I<protocol tree> for the currently-selected
|
1998-09-16 02:39:15 +00:00
|
|
|
packet. The tree displays each field and its value in each protocol header
|
|
|
|
in the stack.
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The lowest pane contains a hex dump of the actual packet data.
|
|
|
|
Selecting a field in the I<protocol tree> highlights the corresponding
|
|
|
|
bytes in this section.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-07-12 05:47:29 +00:00
|
|
|
A display filter can be entered into the strip at the bottom. (XXX -
|
|
|
|
put in syntax of display filter here?). A filter for HTTP, HTTPS, and
|
|
|
|
DNS traffic might look like this:
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-07-12 05:47:29 +00:00
|
|
|
tcp.port == 80 || tcp.port == 443 || tcp.port == 53
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
Selecting the I<Filter:> button lets you choose from a list of named
|
1999-07-12 05:47:29 +00:00
|
|
|
filters that you can optionally save. Pressing the Return or Enter
|
|
|
|
keys will cause the filter to be applied to the current list of packets.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=item Preferences
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The I<Preferences> dialog lets you select the output format of packets
|
|
|
|
printed using the I<File:Print Packet> menu item and configure
|
|
|
|
commonly-used filters.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=over 6
|
|
|
|
|
|
|
|
=item Printing Preferences
|
|
|
|
|
|
|
|
The radio buttons at the top of the I<Printing> page allow you choose
|
|
|
|
between printing the packets as text or PostScript, and sending the
|
|
|
|
output directly to a command or saving it to a file. The I<Command:> text
|
|
|
|
entry box is the command to send files to (usually B<lpr>), and the
|
|
|
|
I<File:> entry box lets you enter the name of the file you wish to save
|
|
|
|
to. Additinally, you can select the I<File:> button to browse the file
|
|
|
|
system for a particular save file.
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-12-29 04:05:38 +00:00
|
|
|
=item Filter Preferences
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
The I<Filters> page lets you create and modify filters, and set the
|
1998-09-16 02:39:15 +00:00
|
|
|
default filter to use when capturing data or opening a capture file.
|
|
|
|
|
|
|
|
The I<Filter name> entry specifies a descriptive name for a filter, e.g.
|
|
|
|
B<Web and DNS traffic>. The I<Filter string> entry is the text that
|
1998-10-13 02:10:57 +00:00
|
|
|
actually describes the filtering action to take, as described above.The
|
|
|
|
dialog buttons perform the following actions:
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-12-29 04:05:38 +00:00
|
|
|
=over 6
|
1998-09-16 02:39:15 +00:00
|
|
|
|
|
|
|
=item New
|
|
|
|
|
|
|
|
If there is text in the two entry boxes, it creates a new associated list
|
|
|
|
item.
|
|
|
|
|
|
|
|
=item Change
|
|
|
|
|
|
|
|
Modifies the currently selected list item to match what's in the entry
|
|
|
|
boxes.
|
|
|
|
|
|
|
|
=item Copy
|
|
|
|
|
|
|
|
Makes a copy of the currently selected list item.
|
|
|
|
|
|
|
|
=item Delete
|
|
|
|
|
|
|
|
Deletes the currently selected list item.
|
|
|
|
|
|
|
|
=item OK
|
|
|
|
|
|
|
|
Sets the currently selected list item as the active filter. If nothing
|
|
|
|
is selected, turns filtering off.
|
|
|
|
|
|
|
|
=item Save
|
|
|
|
|
|
|
|
Saves the current filter list in F<$HOME/.ethereal/filters>.
|
|
|
|
|
|
|
|
=item Cancel
|
|
|
|
|
|
|
|
Closes the dialog without making any changes.
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=back
|
|
|
|
|
1998-12-29 04:05:38 +00:00
|
|
|
=item Column Preferences
|
|
|
|
|
|
|
|
The I<Columns> page lets you specify the number, title, and format
|
|
|
|
of each column in the packet list.
|
|
|
|
|
|
|
|
The I<Column title> entry is used to specify the title of the column
|
|
|
|
displayed at the top of the packet list. The type of data that the column
|
|
|
|
displays can be specified using the I<Column format> option menu. The row
|
|
|
|
of buttons on the left perform the following actions:
|
|
|
|
|
|
|
|
=over 6
|
|
|
|
|
|
|
|
=item New
|
|
|
|
|
|
|
|
Adds a new column to the list.
|
|
|
|
|
|
|
|
=item Change
|
|
|
|
|
|
|
|
Modifies the currently selected list item.
|
|
|
|
|
|
|
|
=item Delete
|
|
|
|
|
|
|
|
Deletes the currently selected list item.
|
|
|
|
|
|
|
|
=item Up / Down
|
|
|
|
|
|
|
|
Moves the selected list item up or down one position.
|
|
|
|
|
|
|
|
=item OK
|
|
|
|
|
|
|
|
Currently has no effect.
|
|
|
|
|
|
|
|
=item Save
|
|
|
|
|
|
|
|
Saves the current column format as the default.
|
|
|
|
|
|
|
|
=item Cancel
|
|
|
|
|
|
|
|
Closes the dialog without making any changes.
|
|
|
|
|
|
|
|
=back
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=back
|
|
|
|
|
|
|
|
=item Capture Preferences
|
|
|
|
|
|
|
|
The I<Capture Preferences> dialog lets you specify various parameters for
|
|
|
|
capturing live packet data.
|
|
|
|
|
|
|
|
The I<Interface:> entry box lets you specify the interface from which to
|
|
|
|
capture packet data. The I<Count:> entry specifies the number of packets
|
|
|
|
to capture. Entering 0 will capture packets indefinitely. The I<Filter:>
|
|
|
|
entry lets you specify the capture filter using a tcpdump-style filter
|
|
|
|
string as described above. The I<File:> entry specifies the file to save
|
|
|
|
to, as in the I<Printer Options> dialog above. You can choose to open the
|
|
|
|
file after capture, and you can also specify the maximum number of bytes
|
|
|
|
to capture per packet with the I<Capture length> entry.
|
|
|
|
|
1999-06-19 08:48:30 +00:00
|
|
|
=item Display Options
|
|
|
|
|
|
|
|
The I<Display Options> dialog lets you specify the format of the time stamp
|
|
|
|
in the packet list. You can select "Time of day" for absolute time stamps,
|
|
|
|
"Seconds since beginning of capture" for relative time stamps, or
|
|
|
|
"Seconds since previous frame" for delta time stamps.
|
|
|
|
|
1998-10-13 02:10:57 +00:00
|
|
|
=back
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
=head1 SEE ALSO
|
|
|
|
|
|
|
|
L<tcpdump(1)>, L<pcap(3)>
|
|
|
|
|
|
|
|
=head1 NOTES
|
|
|
|
|
|
|
|
The latest version of B<ethereal> can be found at
|
|
|
|
B<http://ethereal.zing.org>.
|
|
|
|
|
|
|
|
=head1 AUTHORS
|
|
|
|
|
|
|
|
Original Author
|
|
|
|
-------- ------
|
|
|
|
Gerald Combs <gerald@zing.org>
|
|
|
|
|
|
|
|
|
|
|
|
Contributors
|
|
|
|
------------
|
1999-04-06 16:24:50 +00:00
|
|
|
Gilbert Ramirez <gramirez@tivoli.com>
|
|
|
|
Hannes R. Boehm <hannes@boehm.org>
|
|
|
|
Mike Hall <mlh@io.com>
|
|
|
|
Bobo Rajec <bobo@bsp-consulting.sk>
|
|
|
|
Laurent Deniel <deniel@worldnet.fr>
|
|
|
|
Don Lafontaine <lafont02@cn.ca>
|
|
|
|
Guy Harris <guy@netapp.com>
|
|
|
|
Simon Wilkinson <sxw@dcs.ed.ac.uk>
|
|
|
|
Joerg Mayer <jmayer@telemation.de>
|
|
|
|
Martin Maciaszek <fastjack@i-s-o.net>
|
|
|
|
Didier Jorand <Didier.Jorand@alcatel.fr>
|
|
|
|
Jun-ichiro itojun Hagino <itojun@iijlab.net>
|
|
|
|
Richard Sharpe <sharpe@ns.aus.com>
|
1999-05-12 06:04:47 +00:00
|
|
|
John McDermott <jjm@jkintl.com>
|
1999-06-11 15:30:55 +00:00
|
|
|
Jeff Jahr <jjahr@shastanets.com>
|
|
|
|
Brad Robel-Forrest <bradr@watchguard.com>
|
1999-06-11 16:45:02 +00:00
|
|
|
Ashok Narayanan <ashokn@cisco.com>
|
1999-06-22 22:02:39 +00:00
|
|
|
Aaron Hillegass <aaron@classmax.com>
|
1999-07-08 04:23:28 +00:00
|
|
|
Jason Lango <jal@netapp.com>
|
|
|
|
Johan Feyaerts <Johan.Feyaerts@siemens.atea.be>
|
1999-06-11 15:30:55 +00:00
|
|
|
|
1998-09-17 02:01:50 +00:00
|
|
|
Alain Magloire <alainm@rcsm.ece.mcgill.ca> was kind enough to give his
|
1998-09-16 02:39:15 +00:00
|
|
|
permission to use his version of snprintf.c.
|
|
|
|
|
|
|
|
Dan Lasley <dlasley@promus.com> gave permission for his dumpit() hex-dump
|
|
|
|
routine to be used.
|