wireshark.org protocol dissector with Osmocom additions
Go to file
Alexis La Goutte 7dcc02efac Fix Build of PortableAPPs with Qtshark
svn path=/trunk/; revision=47833
2013-02-23 09:58:46 +00:00
aclocal-fallback Move move of the Qt checks into AM_PATH_QT. 2013-02-08 02:51:14 +00:00
asn1 include the wsutil/wsgcrypt.h instead of including gcrypt.h directly 2013-02-21 18:23:29 +00:00
cmake/modules Don't set HAVE_LIBNL1 if we have don't libnl at all. 2012-11-22 18:01:42 +00:00
codecs Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
debian More 1.9.0 → 1.9.1 changes. Release note updates. 2013-02-20 21:17:30 +00:00
diameter Add application ID:s 2013-02-11 17:38:16 +00:00
doc mention gcrypt wrapper in README.developer 2013-02-21 22:24:43 +00:00
docbook More 1.9.0 → 1.9.1 changes. Release note updates. 2013-02-20 21:17:30 +00:00
dtds
epan Convert proto_tree_add_text to proto_tree_add_item and expert_info. 2013-02-23 03:48:04 +00:00
fix Enhance FIX generator 2013-01-20 18:32:23 +00:00
help Prettify more build output. 2013-02-04 17:22:32 +00:00
idl Change wireshark_gen.py to make the operation argument to routines a 2012-12-26 10:28:03 +00:00
image Add Filter Expressions^WButton^WShortcut^WBookmark preferences. 2013-02-06 18:22:54 +00:00
macosx-support-lib-patches Patching configure.in files and regenerating them is a bag of hurt, as 2012-08-12 19:32:46 +00:00
packaging Fix Build of PortableAPPs with Qtshark 2013-02-23 09:58:46 +00:00
plugins How can I get a new tvbuff that starts at an offset within a given 2013-02-19 23:17:07 +00:00
radius From Guy Davies: 2013-02-06 13:18:25 +00:00
test tshark now accepts -Q. 2012-12-20 14:36:06 +00:00
tools Enable automatic updates for Win64. Fix a copy/paste error. 2013-02-19 22:57:40 +00:00
tpncp
ui Minor Bluetooth fixes 2013-02-21 22:00:32 +00:00
wimaxasncp
wiretap Add support for reading/writing 'sprint' lines from test scripts. 2013-02-15 23:43:30 +00:00
wsutil use pragma GCC diagnostic to work around gcrypt.h warnings 2013-02-21 18:40:48 +00:00
.bzrignore Unify the bzr and git ignore files - they're the exact same format, 2012-10-06 20:23:37 +00:00
.gitignore Remove epan/packet-ncp2222.c from .gitignore 2013-01-18 15:52:23 +00:00
AUTHORS From Michal Labedzki via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8366 2013-02-21 18:43:26 +00:00
CMakeLists.txt Reflect the move of recent.c to the ui directory. 2013-02-02 05:25:39 +00:00
CMakeOptions.txt From Jim Young, bug 7745. 2012-09-24 10:23:20 +00:00
COPYING Update GPL-2 license in COPYING 2012-06-28 23:02:28 +00:00
CPackConfig.txt Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
ChangeLog There's no sense in making everyone check out a large, old list of 2012-06-04 15:36:42 +00:00
ConfigureChecks.cmake Copy over HAVE_NL80211 from autofoo 2012-09-10 20:24:51 +00:00
INSTALL From Jim Young, bug 7745. 2012-09-24 10:23:20 +00:00
INSTALL.configure The name configure.in has been deprecated for many years. 2012-08-23 11:11:24 +00:00
Makefile.am Also build the source RPM. Clean up after ourselves when done. 2013-02-08 19:14:37 +00:00
Makefile.am.inc Remove more unnecessary defintions. 2013-02-06 21:57:16 +00:00
Makefile.common Move recent.c to the ui directory, as we did with its header file. 2013-02-02 04:49:58 +00:00
Makefile.nmake Add automatic software update checks for Win32 using WinSparkle. Add 2013-02-19 22:21:17 +00:00
Makefile.nmake.inc Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
NEWS
README
README.DECT
README.aix The name configure.in has been deprecated for many years. 2012-08-23 11:11:24 +00:00
README.bsd
README.cmake
README.hpux
README.irix The name configure.in has been deprecated for many years. 2012-08-23 11:11:24 +00:00
README.linux
README.macos Give information on command-line tools with Xcode 4. 2013-01-05 19:42:04 +00:00
README.tru64
README.vmware
README.windows
abi-descriptor.template
acinclude.m4 Add the warning flags to CFLAGS_FOR_BUILD, so any build tools we build 2013-02-04 22:23:19 +00:00
aclocal-flags Work around Solaris 11's pkg-config being in /usr/ccs/bin but its 2012-09-16 01:49:59 +00:00
adns_dll.dep
adns_dll.rc
airpcap.h Get rid of zero-length array - we allow Wireshark to be compiled with 2013-02-17 21:24:31 +00:00
airpcap_loader.c Add a macro to calculate, from the size of an AirpcapKeysCollection 2013-02-17 21:14:14 +00:00
airpcap_loader.h Clean up white space (get rid of 4-space tabs). 2013-02-17 03:16:57 +00:00
all.vcproj Stop defining HAVE_CONFIG_H on Windows builds too. 2012-10-01 11:47:36 +00:00
autogen.sh
capinfos.c include the wsutil/wsgcrypt.h instead of including gcrypt.h directly 2013-02-21 18:23:29 +00:00
capture-pcap-util-int.h Hoist all the friendly-name/vendor-description stuff up into 2012-11-23 22:28:06 +00:00
capture-pcap-util-unix.c Hoist all the friendly-name/vendor-description stuff up into 2012-11-23 22:28:06 +00:00
capture-pcap-util.c "vendor_description", not "description". 2012-11-24 19:08:28 +00:00
capture-pcap-util.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture-wpcap.c Hoist all the friendly-name/vendor-description stuff up into 2012-11-23 22:28:06 +00:00
capture-wpcap.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
capture.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture_ifinfo.c Some more if_info_t updates. 2012-11-22 07:33:39 +00:00
capture_ifinfo.h On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
capture_info.c Add wtap_pseudo_header union to wtap_pkthdr structure. 2012-10-16 21:50:57 +00:00
capture_info.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture_opts.c Fix a bunch of warnings. 2012-12-26 05:57:06 +00:00
capture_opts.h On error, have capture_opts_trim_iface() return the exit status that 2012-11-21 17:14:54 +00:00
capture_stop_conditions.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
capture_stop_conditions.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture_sync.c Declare count as ssize_t instead of size_t, since read(), and thus ws_read(), can return a negative number. If that were to happen, then assigning the return value to an unsigned variable and then comparing that variable against 0 will yield incorrect/unintended results. Fixes Coverity CID 761910: Negative array index write. 2013-01-14 16:34:19 +00:00
capture_sync.h Add a few consts to fix some compiler (GCC) errors. 2012-12-29 20:56:11 +00:00
capture_ui_utils.c On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
capture_ui_utils.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
capture_unix_ifnames.c On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
capture_unix_ifnames.h On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
capture_win_ifnames.c Put the code to convert a GUID string to a GUID structure into a routine 2012-11-24 18:55:06 +00:00
capture_win_ifnames.h Put the code to convert a GUID string to a GUID structure into a routine 2012-11-24 18:55:06 +00:00
capture_wpcap_packet.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
capture_wpcap_packet.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
cfile.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
cfile.h Rename the search type menu items to more accurately reflect what we're 2012-12-15 01:04:39 +00:00
cfilters
cfutils.c On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
cfutils.h On UN*X, if an interface has a description, use it as the "friendly 2012-11-22 06:02:49 +00:00
clopts_common.c Fix a bunch of warnings. 2012-12-26 05:57:06 +00:00
clopts_common.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
cmakeconfig.h.in Fix CMake build: 2012-10-18 22:20:36 +00:00
cmdarg_err.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
color.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
color_filters.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
color_filters.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
colorfilters From Michal Labedzki via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8366 2013-02-21 18:43:26 +00:00
conditions.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
conditions.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
config.guess
config.h.win32 Add automatic software update checks for Win32 using WinSparkle. Add 2013-02-19 22:21:17 +00:00
config.nmake More 1.9.0 → 1.9.1 changes. Release note updates. 2013-02-20 21:17:30 +00:00
config.sub
configure.ac More 1.9.0 → 1.9.1 changes. Release note updates. 2013-02-20 21:17:30 +00:00
console_io.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
debian-setup.sh Try creating a script for Debian and derivatives that will grab the 2013-02-04 00:29:27 +00:00
dfilter_macros
dfilters
dftest.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
disabled_protos.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
disabled_protos.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
doxygen.cfg.in
doxygen_global.cfg
dumpcap.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
dumpcap.vcproj Stop defining HAVE_CONFIG_H on Windows builds too. 2012-10-01 11:47:36 +00:00
editcap.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
file.c Add support for writing the packet block flags for pcapng. 2012-12-22 20:38:08 +00:00
file.h Fix "file.h:56:21: warning: comma at end of enumerator list". 2013-01-02 01:35:08 +00:00
fileset.c g_strcmp0 first occures in GLIB 2.16 define it localy if it does not exist 2012-10-22 12:20:36 +00:00
fileset.h Add a capture_file * element to packet_range_t and pass it explicitly in 2012-10-05 18:52:42 +00:00
filters.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
filters.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
frame_data_sequence.c Fix potential copy-and-pasto in free_frame_data_sequence that may or may not 2012-12-01 18:19:08 +00:00
frame_data_sequence.h Implement the frame mark, ignore, and time reference actions. Update the 2012-12-17 23:03:21 +00:00
g711.c
g711.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
globals.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
iface_monitor.c OK, try including <net/if.h> iff IFF_UP isn't already defined; see if 2012-12-29 22:25:46 +00:00
iface_monitor.h Add support for listening for interface arrival/departure events on 2012-06-29 18:04:11 +00:00
ipmap.html Add wrapDateLine to support continuous longitudinal panning. 2012-09-29 15:59:32 +00:00
isprint.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
log.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
macosx-setup.sh Current version of pkg-config is 0.27. 2013-02-02 03:43:44 +00:00
make-version.pl 1.9.0 → 1.9.1. 2013-02-20 16:42:34 +00:00
manuf [Automatic manuf, services and enterprise-numbers update for 2013-02-17] 2013-02-17 15:03:20 +00:00
manuf.tmpl Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
merge.c Add boilerplate GPLv2+ license as per email response from Scott Renfro: 2013-01-15 02:17:16 +00:00
merge.h Make it possible to merge libpcap files with different encapsulation types by making the output file a pcapng file and construkting SHB and IDB 2012-08-08 14:06:29 +00:00
mergecap.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
mkcap.c From Evan Huus: 2012-07-09 01:56:27 +00:00
nio-ie5.c Fix some system header files that were #included with "" instead of <>. 2012-07-18 02:47:56 +00:00
nio-ie5.h
packaging.vcproj Set eol-style to native (just to make these files readable on *NIX). 2012-03-19 01:46:24 +00:00
packet-range.c Add a capture_file * element to packet_range_t and pass it explicitly in 2012-10-05 18:52:42 +00:00
packet-range.h Add a capture_file * element to packet_range_t and pass it explicitly in 2012-10-05 18:52:42 +00:00
pcapio.c Whitespace changes. Use 8-space indents consistently. 2013-01-02 16:25:33 +00:00
pcapio.h Allow pcap/pcapng format to be written to more than just a file (FILE*). Gives more flexibility if needed. 2013-01-02 04:01:22 +00:00
pdml2html.xsl
print.c Revert SVN #47724, #47726 & #47727. 2013-02-18 05:41:13 +00:00
print.h Allow TShark to specify columns as fields with -e option (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2892) 2012-12-08 02:42:40 +00:00
print.ps Add back the "%!" removed in r33773; otherwise, for some unknown reason, only 1 page will be viewable. (Tested w/gsview 5.0 and ghostscript 9.06) 2012-10-19 18:05:02 +00:00
proto_hier_stats.c Add wtap_pseudo_header union to wtap_pkthdr structure. 2012-10-16 21:50:57 +00:00
proto_hier_stats.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
ps.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
randpkt.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
rawshark.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
register.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
reordercap.c Fill some phdr values also when doing random read 2012-10-17 20:28:22 +00:00
ringbuffer.c fclose() and fflush() are standard C routines, so there's no need for 2012-12-20 20:00:06 +00:00
ringbuffer.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
services [Automatic manuf, services and enterprise-numbers update for 2013-02-17] 2013-02-17 15:03:20 +00:00
smi_modules
stat_menu.h
summary.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
summary.h Fix a bunch of warnings. 2012-12-26 05:57:06 +00:00
sync_pipe.h Suggest fancier ways to communicate with the capture process. 2013-01-07 16:26:45 +00:00
sync_pipe_write.c pipe_write_header() should return ssize_t, as it returns the return 2012-12-26 12:14:59 +00:00
tap-megaco-common.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
tap-megaco-common.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
tap-rtp-common.c Try to detect duplicated packets due to mirroring/span ports by comparing src MAC addresses. 2013-01-28 15:41:45 +00:00
tap-rtp-common.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
tempfile.c The const was important, take a copy of the suffix to sanitize instead. 2013-01-26 15:51:01 +00:00
tempfile.h The const was important, take a copy of the suffix to sanitize instead. 2013-01-26 15:51:01 +00:00
text2pcap-scanner.l Add %option noinput to some Flex files, as we aren't using the input() 2013-02-10 20:21:05 +00:00
text2pcap.c When any of our executables start on Windows create or open a "Wireshark 2013-02-20 01:19:42 +00:00
text2pcap.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
timestats.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
timestats.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
trigcap.c replace "unsigned" datatype with "guint". Some mpeg files needed "unsigned int" instead. 2013-01-04 05:22:43 +00:00
tshark.c From Edwin Groothuis via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8353 : Document http-related '-z' statistics; also add document -z help. 2013-02-20 03:06:46 +00:00
tshark.vcproj Stop defining HAVE_CONFIG_H on Windows builds too. 2012-10-01 11:47:36 +00:00
u3.c Fix a bunch of warnings. 2012-12-26 05:57:06 +00:00
u3.h Fix a bunch of warnings. 2012-12-26 05:57:06 +00:00
update.c We always HAVE_CONFIG_H so don't bother checking whether we have it or not. 2012-09-20 01:29:52 +00:00
version_info.c Try using cpuid also for __x86_64__ if compiled with GCC. 2013-02-08 14:51:49 +00:00
version_info.h Update Free Software Foundation address. 2012-06-28 22:56:06 +00:00
wireshark-mime-package.xml Add MIME types for more capture file formats Wireshark understands: 2013-02-09 02:44:11 +00:00
wireshark.desktop Add MIME types for more capture file formats Wireshark understands: 2013-02-09 02:44:11 +00:00
wireshark.sln
wireshark.vcproj Stop defining HAVE_CONFIG_H on Windows builds too. 2012-10-01 11:47:36 +00:00
wka.tmpl Broadcom "donated" one of their OUIs for use in Fibre Channel over 2012-12-05 03:45:11 +00:00
ws80211_utils.c From Pontus Fuchs: 2013-02-06 13:29:08 +00:00
ws80211_utils.h Add a few consts to fix some compiler (GCC) errors. 2012-12-29 20:56:11 +00:00

README

$Id$

General Information
------- -----------

Wireshark is a network traffic analyzer, or "sniffer", for Unix and
Unix-like operating systems.  It uses GTK+, a graphical user interface
library, and libpcap, a packet capture and filtering library.

The Wireshark distribution also comes with TShark, which is a
line-oriented sniffer (similar to Sun's snoop, or tcpdump) that uses the
same dissection, capture-file reading and writing, and packet filtering
code as Wireshark, and with editcap, which is a program to read capture
files and write the packets from that capture file, possibly in a
different capture file format, and with some packets possibly removed
from the capture.

The official home of Wireshark is

    http://www.wireshark.org

The latest distribution can be found in the subdirectory

    http://www.wireshark.org/download


Installation
------------

Wireshark is known to compile and run on the following systems:

  - Linux (2.0 and later kernels, various distributions)
  - Solaris (2.5.1 and later)
  - FreeBSD (2.2.5 and later)
  - NetBSD
  - OpenBSD
  - Mac OS X (10.2 and later)
  - HP-UX (10.20, 11.00, 11.11)
  - Sequent PTX v4.4.5  (Nick Williams <njw@sequent.com>)
  - Tru64 UNIX (formerly Digital UNIX) (3.2 and later)
  - Irix (6.5)
  - AIX (4.3.2, with a bit of work)
  - Windows (2003, XP, Vista, 7)

and possibly on other versions of those OSes.  It should run on other
Unix-ish systems without too much trouble.

If you have an older version of the operating systems listed above, it
might be supported by an older version of Wireshark. In particular,
Windows 2000 is supported by Wireshark 1.2.x, Windows NT 4.0 is supported by
Wireshark 0.99.4, and Windows 95, 98, and ME are supported by Ethereal 0.99.0.

NOTE: the Makefile appears to depend on GNU "make"; it doesn't appear to
work with the "make" that comes with Solaris 7 nor the BSD "make".
Perl is also needed to create the man page.

If you decide to modify the yacc grammar or lex scanner, then
you need "flex" - it cannot be built with vanilla "lex" -
and either "bison" or the Berkeley "yacc". Your flex
version must be 2.5.1 or greater. Check this with 'flex -V'.

If you decide to modify the NetWare Core Protocol dissector, you
will need python, as the data for packet types is stored in a python
script, ncp2222.py.

You must therefore install Perl, GNU "make", "flex", and either "bison" or
Berkeley "yacc" on systems that lack them.

Full installation instructions can be found in the INSTALL file.
         
See also the appropriate README.<OS> files for OS-specific installation
instructions.

Usage
-----          

In order to capture packets from the network, you need to make the
dumpcap program set-UID to root, or you need to have access to the
appropriate entry under /dev if your system is so inclined (BSD-derived
systems, and systems such as Solaris and HP-UX that support DLPI,
typically fall into this category).  Although it might be tempting to
make the Wireshark and TShark executables setuid root, or to run them as
root please don't.  The capture process has been isolated in dumpcap;
this simple program is less likely to contain security holes, and thus
safer to run as root.

Please consult the man page for a description of each command-line
option and interface feature.


Multiple File Types
-------------------

The wiretap library is a packet-capture library currently under
development parallel to wireshark.  In the future it is hoped that
wiretap will have more features than libpcap, but wiretap is still in
its infancy. However, wiretap is used in wireshark for its ability
to read multiple file types.  See the Wireshark man page or the
Wireshark User's Guide for a list of supported file formats.

In addition, it can read gzipped versions of any of those files
automatically, if you have the zlib library available when compiling
Wireshark. Wireshark needs a modern version of zlib to be able to use
zlib to read gzipped files; version 1.1.3 is known to work.  Versions
prior to 1.0.9 are missing some functions that Wireshark needs and won't
work.  "./configure" should detect if you have the proper zlib version
available and, if you don't, should disable zlib support. You can always
use "./configure --disable-zlib" to explicitly disable zlib support.

Although Wireshark can read AIX iptrace files, the documentation on
AIX's iptrace packet-trace command is sparse.  The 'iptrace' command
starts a daemon which you must kill in order to stop the trace. Through
experimentation it appears that sending a HUP signal to that iptrace
daemon causes a graceful shutdown and a complete packet is written
to the trace file. If a partial packet is saved at the end, Wireshark
will complain when reading that file, but you will be able to read all
other packets.  If this occurs, please let the Wireshark developers know
at wireshark-dev@wireshark.org, and be sure to send us a copy of that trace
file if it's small and contains non-sensitive data.

Support for Lucent/Ascend products is limited to the debug trace output
generated by the MAX and Pipline series of products.  Wireshark can read
the output of the "wandsession" "wandisplay", "wannext", and "wdd"
commands. 

Wireshark can also read dump trace output from the Toshiba "Compact Router"
line of ISDN routers (TR-600 and TR-650). You can telnet to the router
and start a dump session with "snoop dump".

CoSine L2 debug output can also be read by Wireshark. To get the L2
debug output, get in the diags mode first and then use
"create-pkt-log-profile" and "apply-pkt-log-profile" commands under
layer-2 category. For more detail how to use these commands, you
should examine the help command by "layer-2 create ?" or "layer-2 apply ?".

To use the Lucent/Ascend, Toshiba and CoSine traces with Wireshark, you must 
capture the trace output to a file on disk.  The trace is happening inside 
the router and the router has no way of saving the trace to a file for you.
An easy way of doing this under Unix is to run "telnet <ascend> | tee <outfile>".
Or, if your system has the "script" command installed, you can save
a shell session, including telnet to a file. For example, to a file named
tracefile.out:

$ script tracefile.out
Script started on <date/time>
$ telnet router
..... do your trace, then exit from the router's telnet session.
$ exit
Script done on <date/time>



IPv6
----
If your operating system includes IPv6 support, wireshark will attempt to
use reverse name resolution capabilities when decoding IPv6 packets.

If you want to turn off name resolution while using wireshark, start
wireshark with the "-n" option to turn off all name resolution (including
resolution of MAC addresses and TCP/UDP/SMTP port numbers to names), or
with the "-N mt" option to turn off name resolution for all
network-layer addresses (IPv4, IPv6, IPX).

You can make that the default setting by opening the Preferences dialog
box using the Preferences item in the Edit menu, selecting "Name
resolution", turning off the appropriate name resolution options,
clicking "Save", and clicking "OK".

If you would like to compile wireshark without support for IPv6 name
resolution, use the "--disable-ipv6" option with "./configure".  If you
compile wireshark without IPv6 name resolution, you will still be able to
decode IPv6 packets, but you'll only see IPv6 addresses, not host names.


SNMP
----
Wireshark can do some basic decoding of SNMP packets; it can also use
the libsmi library to do more sophisticated decoding, by reading MIB
files and using the information in those files to display OIDs and
variable binding values in a friendlier fashion.  The configure script
will automatically determine whether you have the libsmi library on
your system.  If you have the libsmi library but _do not_ want to have
Wireshark use it, you can run configure with the "--without-libsmi"
option.

How to Report a Bug
-------------------
Wireshark is still under constant development, so it is possible that you will
encounter a bug while using it. Please report bugs at http://bugs.wireshark.org.
Be sure you enter into the bug:

	1) the complete build information from the "About Wireshark"
	   item in the Help menu or the output of "wireshark -v" for
	   Wireshark bugs and the output of "tshark -v" for TShark bugs;

	2) if the bug happened on Linux, the Linux distribution you were
	   using, and the version of that distribution;

	3) the command you used to invoke Wireshark, if you ran
	   Wireshark from the command line, or TShark, if you ran
	   TShark, and the sequence of operations you performed that
	   caused the bug to appear.

If the bug is produced by a particular trace file, please be sure to
attach to the bug a trace file along with your bug description.  If the
trace file contains sensitive information (e.g., passwords), then please
do not send it.

If Wireshark died on you with a 'segmentation violation', 'bus error',
'abort', or other error that produces a UNIX core dump file, you can
help the developers a lot if you have a debugger installed.  A stack
trace can be obtained by using your debugger ('gdb' in this example),
the wireshark binary, and the resulting core file.  Here's an example of
how to use the gdb command 'backtrace' to do so.

$ gdb wireshark core
(gdb) backtrace
..... prints the stack trace
(gdb) quit
$

The core dump file may be named "wireshark.core" rather than "core" on
some platforms (e.g., BSD systems).  If you got a core dump with
TShark rather than Wireshark, use "tshark" as the first argument to
the debugger; the core dump may be named "tshark.core".

Disclaimer
----------

There is no warranty, expressed or implied, associated with this product.
Use at your own risk.


Gerald Combs <gerald@wireshark.org>
Gilbert Ramirez <gram@alumni.rice.edu>
Guy Harris <guy@alum.mit.edu>