wireshark/wiretap
Guy Harris 42f88b6693 Remove a comment that no longer applies - we no longer seek forward in
compressed Sniffer files by sequentially moving forward, and we no
longer seek backward by seeking to the beginning and then seeking
forward to the new position, we now seek to the beginning of the
compressed block that contains the target position, if we're not already
in that block, and then move to the appropriate position in that block.

svn path=/trunk/; revision=3658
2001-07-06 00:17:36 +00:00
..
.cvsignore The Win32 build builds wiretap as a DLL and requires WinPcap 2.1. 2001-03-23 02:05:29 +00:00
AUTHORS Fix the e-mail address for Joerg Mayer (and remove it from files he 2001-04-17 00:46:06 +00:00
COPYING I added the LANalzyer file format to wiretap. I cleaned up some code in the 1998-11-12 06:01:27 +00:00
ChangeLog Created a new protocol tree implementation and a new display filter 1999-07-07 22:52:57 +00:00
INSTALL A lengthy patch to add the wiretap library. Wiretap is not used by default 1998-11-12 00:06:47 +00:00
Makefile Added support for Lucent/Ascend packet traces. The MAX and Pipeline router 1999-09-11 04:50:44 +00:00
Makefile.am Distribute wtap.def 2001-04-18 21:34:22 +00:00
Makefile.nmake Improvement of 'make clean' targets. 2001-04-12 18:07:22 +00:00
NEWS A lengthy patch to add the wiretap library. Wiretap is not used by default 1998-11-12 00:06:47 +00:00
README Change Ethereal homepage URL from etheral.zing.org to www.ethereal.com. 2000-11-22 04:07:04 +00:00
acconfig.h Wiretap no longer works with "GLib 1.0[.x]" (the version that came 2000-10-17 00:09:43 +00:00
acinclude.m4 Replace "--enable-pcap" with "--with-pcap", and if an argument is 2001-06-27 07:47:50 +00:00
ascend-grammar.y Add support for "version 7" wandess output. Actually, I think it's 2001-04-09 03:32:34 +00:00
ascend-int.h In "wdd" captures: 2000-11-11 03:15:07 +00:00
ascend-scanner.l #define YY_NEVER_INTERACTIVE to avoid reference to isatty() on Win32, 2001-04-18 03:03:42 +00:00
ascend.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
ascend.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
buffer.c The "data" member of a Buffer structure is a "u_char *"; when assigning 2001-04-16 21:59:38 +00:00
buffer.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
config.h.win32 Build with zlib. 2001-04-06 03:52:45 +00:00
configure.in Replace "--enable-pcap" with "--with-pcap", and if an argument is 2001-06-27 07:47:50 +00:00
csids.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
csids.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
etherpeek.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
etherpeek.h Etherpeek version 5, 6, and 7 support, from Daniel Thompson. 2001-02-22 22:03:31 +00:00
file.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
file_wrappers.c Add wtap-int.h. Move definitions relevant to the internal workins of wiretap 2000-05-19 23:07:04 +00:00
file_wrappers.h Always declare, and define, "file_seek()" to return a "long", as it's 2000-01-26 19:22:04 +00:00
i4b_trace.h Added Bert Driehuis <driehuis@playbeing.org>'s I4B wiretap module 1999-12-12 22:40:10 +00:00
i4btrace.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
i4btrace.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
iptrace.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
iptrace.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
lanalyzer.c GCC 2.95.1 on SPARC/Solaris, at least, is clever enough to figure out 2001-04-16 22:06:34 +00:00
lanalyzer.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
libpcap.c Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSD 2001-03-15 09:11:03 +00:00
libpcap.h Code to read capture files from some version of tcpdump from some sort 2000-09-15 07:52:43 +00:00
netmon.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
netmon.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
nettl.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
nettl.h Support for the BASE100 and GSC100BT subsystems by Jeff Foster. 2000-11-13 23:02:24 +00:00
netxray.c Patch from Chris Jepeway to use, in NetXRay 2.x captures, a field from 2001-05-09 04:42:27 +00:00
netxray.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
ngsniffer.c Remove a comment that no longer applies - we no longer seek forward in 2001-07-06 00:17:36 +00:00
ngsniffer.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
pppdump.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
pppdump.h Add support for reading pppd log files in wiretap. 2000-09-19 17:22:11 +00:00
radcom.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
radcom.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
snoop.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
snoop.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
toshiba.c Obliging every capture file reader's "open()" routine to seek to the 2001-03-10 06:33:58 +00:00
toshiba.h Miscellaneous code cleaning 2000-08-11 13:37:21 +00:00
wtap-int.h You have to define "htolell()" on little-endian platforms, too.... 2001-02-13 07:07:17 +00:00
wtap.c "open_cap_file()" in Ethereal and Tethereal don't use the FILE_T they 2001-07-05 00:34:42 +00:00
wtap.def "wtap_file()" is no longer in Wiretap, so don't try to export it from 2001-07-05 20:57:09 +00:00
wtap.h "open_cap_file()" in Ethereal and Tethereal don't use the FILE_T they 2001-07-05 00:34:42 +00:00

README

$Id: README,v 1.26 2000/11/22 04:07:04 gram Exp $

Wiretap is a library that is being developed as a future replacement for
libpcap, the current standard Unix library for packet capturing. Libpcap
is great in that it is very platform independent and has a wonderful
BPF optimizing engine. But it has some shortcomings as well. These
shortcomings came to a head during the development of Ethereal
(http://www.ethereal.com/), a packet analyzer. As such, I began developing
wiretap so that:

1. The library can easily be amended with new packet filtering objects.
Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects,
etc. I also want any decent programmer to be able to add new filters to the
library.

2. The library can read file formats from many packet-capturing utilities.
Libpcap only reads Libpcap files.

3. The library can capture on more than one network interface at a time, and
save this trace in one file.

4. Network names can be resolved immediately after a trace and saved in the
trace file. That way, I can ship a trace of my firewall-protected network to a
colleague, and he'll see the proper hostnames for the IP addresses in the
packet capture, even though he doesn't have access to the DNS server behind my
LAN's firewall.

5. I want to look into the possibility of compressing packet data when saved
to a file, like Sniffer.

6. The packet-filter can be optimized for the host OS. Not all OSes have BPF;
SunOS has NIT and Solaris has DLPI, which both use the CMU/Stanford
packet-filter pseudomachine. RMON has another type of packet-filter syntax
which we could support.

Wiretap is very good at reading many file formats, as per #2
above. Wiretap has no filter capability at present; it currently doesn't
support packet capture, so it wouldn't be useful there, and filtering
when reading a capture file is done by Ethereal, using a more powerful
filtering mechanism than that provided by BPF.


File Formats
============

Libpcap
-------
The "libpcap" file format was determined by reading the "libpcap" code;
wiretap reads the "libpcap" file format with its own code, rather than
using the "libpcap" library's code to read it.

Sniffer (compressed and uncompressed)
-------
The uncompressed Sniffer format is documented in the Sniffer manual.
Unfortunately, Sniffer manuals tend to document only the format for
the Sniffer model they document. Token-Ring and ethernet seems to work
well, though.  If you have an ATM Sniffer file, both Guy and Gilbert
would be *very* interested in receiving a sample. (see 'AUTHORS' file
for our e-mail addresses).

LANalyzer
---------
The LANalyzer format is available from http://www.novell.com. Search
their knowledge base for "Trace File Format".

Network Monitor
---------------
Microsoft's Network Monitor file format is supported, at least under
Ethernet and token-ring. If you have capture files of other datalink
types, please send them to Guy.

"snoop"
-------
The Solaris 2.x "snoop" program's format is documented in RFC 1761.

"iptrace"
---------
This is the capture program that comes with AIX 3.x and 4.x.  AIX 3 uses
the iptrace 1.0 file format, while AIX4 uses iptrace 2.0.  iptrace has
an undocumented, yet very simple, file format.  The interesting thing
about iptrace is that it will record packets coming in from all network
interfaces; a single iptrace file can contain multiple datalink types.

Sniffer Basic (NetXRay)/Windows Sniffer Pro
-------------------------------------------
Network Associates' Sniffer Basic (formerly NetXRay from Cinco Networks)
file format is now supported, at least for Ethernet and token-ring. 
Network Associates' Windows Sniffer Pro appears to use a variant of that
format; it's supported to the same extent.

RADCOM WAN/LAN Analyzers
------------------------
Olivier Abad has added code to read Ethernet and LAPB captures from
RADCOM WAN/LAN Analyzers (see http://www.radcom-inc.com/).

Lucent/Ascend access products
-----------------------------
Gerald

HP-UX nettl
-----------
nettl is used on HP-UX to trace various streams based subsystems.  Wiretap
can read nettl files containing IP frames (NS_LS_IP subsystem) and LAPB
frames (SX25L2 subsystem). It has been tested with files generated on
HP-UX 9.04 and 10.20.
Use the following commands to generate a trace :
# IP capture. 0x30000000 means PDU in and PDU out :
nettl -tn 0x30000000 -e NS_LS_IP -f tracefile
# X25 capture. You must specify an interface :
nettl -tn 0x30000000 -e SX25l2 -d /dev/x25_0 -f tracefile
# stop capture. subsystem is NS_LS_IP or SX25L2 :
nettl -tf -e subsystem

One may be able to specify "-tn pduin pduout" rather than
"-tn 0x30000000"; the nettl man page for HP-UX 10.30 implies that it
should work.

Toshiba ISDN Router
-------------------
An under-documented command that the router supports in a telnet session
is "snoop" (not related to the Solaris "snoop" command). If you give
it the "dump" option (either by letting "snoop" query you for its next
argument, or typing "snoop dump" on the command line), you'll get a hex
dump of all packets across the router (except of your own telnet session
-- good thinking Toshiba!). You can select a certain channel to sniff
(LAN, B1, B2, D), but the default is all channels.  You save this hex
dump to disk with 'script' or by 'telnet | tee'. Wiretap will read the
ASCII hex dump and convert it to binary data.

ISDN4BSD "i4btrace" utility
---------------------------
Bert Driehuis

Cisco Secure Intrustion Detection System iplogging facility
-----------------------------------------------------------
Mike Hall

pppd logs (pppdump-format files)
--------------------------------
Gilbert


Gilbert Ramirez <gram@xiexie.org>
Guy Harris <guy@alum.mit.edu>