wireshark.org protocol dissector with Osmocom additions
Go to file
Gerald Combs e07ae47a02 Add the file encapsulation.
svn path=/trunk/; revision=22962
2007-09-25 19:52:19 +00:00
aclocal-fallback get libsmi into the picture 2007-08-25 20:27:58 +00:00
asn1 Change some additional protocols to the new build system 2007-09-25 18:02:49 +00:00
cmake/modules frederic heem: 2006-11-06 14:16:29 +00:00
codecs From Sebastien Tandel: 2007-03-23 17:49:59 +00:00
debian From Frederic Peters: 2007-07-04 07:22:57 +00:00
diameter Adjust to the latest IANA status 2007-08-22. 2007-08-29 16:10:04 +00:00
doc When -t option: Use current date or time fields for unspecified fields; Fixes bug #1836. 2007-09-20 16:12:17 +00:00
docbook Add an item for ANSI MAP. 2007-09-19 22:57:40 +00:00
dtds An old proposal from Martin, append to COL_PROTO the name taken from a matching DTD (in case the media-type actually matches it). Having the name of the root element found would be nicer. 2007-08-10 21:03:26 +00:00
epan From Gerrit Renker: 2007-09-25 19:42:46 +00:00
gtk In newer versions of GTK+ 2.x, if you have the mouse positioned above a 2007-09-25 05:12:44 +00:00
help Update before new release 2007-05-29 09:23:36 +00:00
idl rename the nspi dissector from idl (where the idl2wrs dissectors live) ro epan/dissector/pidl (where the pidl generated dce/rpc dissectors live) 2006-11-05 05:56:27 +00:00
image Make the lawyer happy - add a registered trademark symbol. 2007-07-20 21:31:19 +00:00
packaging Use GTK+ 2.12 2007-09-25 16:09:58 +00:00
plugins From Don Newton: 2007-09-24 19:56:17 +00:00
radius Add AVP:s 2007-09-11 16:57:42 +00:00
test Re-enable capture tests now that a a dumpcap problem has been corrected. 2007-08-28 17:49:16 +00:00
tools Use GTK+ 2.12 2007-09-25 16:09:58 +00:00
wiretap Allow the output of NetScreen VSI interfaces to be parsed. 2007-09-25 05:42:22 +00:00
AUTHORS From Martin Peylo: 2007-09-17 14:10:34 +00:00
CMakeLists.txt frederic.heem: 2006-10-26 15:36:50 +00:00
COPYING Removed ^L as they turn up as a strange square in About->License 2007-08-27 11:27:41 +00:00
ChangeLog Updates for 0.99.6 2007-06-15 18:31:52 +00:00
FAQ Update before new release 2007-05-29 09:23:36 +00:00
INSTALL We no longer support UCD SNMP - and *do* support Net-SNMP, and have 2006-12-09 01:37:22 +00:00
INSTALL.configure
Makefile.am Get rid of the remains of NET-SNMP in the build process. 2007-09-24 06:59:40 +00:00
Makefile.am.inc Add a script as a front-end for Flex, to work around various problems, 2007-08-04 02:13:52 +00:00
Makefile.common Put airpcap.h back in the distribution. 2007-06-27 23:42:06 +00:00
Makefile.nmake Use GTK+ 2.12 2007-09-25 16:09:58 +00:00
Makefile.nmake.inc Add a script as a front-end for Flex, to work around various problems, 2007-08-04 02:13:52 +00:00
NEWS Fix a link. 2007-02-01 20:31:59 +00:00
README Delist Windows 98 as possible platform 2007-01-29 12:38:48 +00:00
README.aix ethereal->wireshark 2006-05-22 08:21:22 +00:00
README.bsd From Stephen Fisher: add more information on configuring for BSD, 2006-08-11 00:11:11 +00:00
README.cmake Add cmake-modules URL 2006-09-06 22:14:20 +00:00
README.hpux ethereal to wireshark changes 2006-06-17 12:21:54 +00:00
README.irix ethereal->wireshark 2006-05-22 08:21:22 +00:00
README.linux ethereal to wireshark changes 2006-06-17 12:21:54 +00:00
README.macos ethereal to wireshark changes 2006-06-17 12:21:54 +00:00
README.tru64 ethereal to wireshark changes 2006-06-17 12:21:54 +00:00
README.vmware ethereal to wireshark changes 2006-06-17 12:21:54 +00:00
README.win32 deleted lot's of irrelevant/outdated content from README.win32. 2006-10-16 01:48:16 +00:00
acinclude.m4 Get rid of the remains of NET-SNMP in the build process. 2007-09-24 06:59:40 +00:00
aclocal-flags Make aclocal-flags executable again (hopefully fixes buildbot fc4) 2005-08-02 07:03:46 +00:00
airpcap.h Revert back to having a local copy of airpcap.h. This should fix building 2007-05-20 22:32:14 +00:00
airpcap_loader.c Instead of converting between 802.11 frequencies and channels umpteen 2007-08-17 19:34:14 +00:00
airpcap_loader.h Instead of converting between 802.11 frequencies and channels umpteen 2007-08-17 19:34:14 +00:00
alert_box.c Ethereal->Wireshark 2006-05-28 20:28:20 +00:00
alert_box.h name change 2006-05-21 05:12:17 +00:00
all.vcproj also do a distclean when doing a clean for the all target 2007-09-25 19:22:31 +00:00
autogen.sh Support for automake 1.10 (reported by Aamer Akhter) 2006-10-17 08:51:16 +00:00
capinfos.c Add the file encapsulation. 2007-09-25 19:52:19 +00:00
capture-pcap-util-int.h Have the routines to get interface lists take a pointer to a "gchar *" 2007-01-21 23:45:36 +00:00
capture-pcap-util-unix.c Have the routines to get interface lists take a pointer to a "gchar *" 2007-01-21 23:45:36 +00:00
capture-pcap-util.c Include libpcap.h so that we can use wtap_pcap_encap_to_wtap_encap() 2007-08-23 17:49:47 +00:00
capture-pcap-util.h Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
capture-wpcap.c Have the routines to get interface lists take a pointer to a "gchar *" 2007-01-21 23:45:36 +00:00
capture-wpcap.h name change 2006-05-21 05:12:17 +00:00
capture.c Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
capture.h Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
capture_errs.c Add a link to the Providence University WinPcap mirror, and a comment 2007-01-23 01:49:30 +00:00
capture_errs.h name change 2006-05-21 05:12:17 +00:00
capture_info.c And include packet-wlancap.h 2007-08-30 11:52:30 +00:00
capture_info.h name change 2006-05-21 05:12:17 +00:00
capture_loop.c For bug 1685, check for the errors reported on at least some platforms 2007-09-02 23:32:43 +00:00
capture_loop.h Fix bug 1181 by always using select() on a capture fd on linux 2007-08-24 15:34:08 +00:00
capture_opts.c Change the "--enable-setuid-install" option to install dumpcap and TShark 2007-08-30 00:24:40 +00:00
capture_opts.h Change the "--enable-setuid-install" option to install dumpcap and TShark 2007-08-30 00:24:40 +00:00
capture_stop_conditions.c fix MSVC warnings of / and set CFLAGS to block new warnings 2007-03-21 23:14:23 +00:00
capture_stop_conditions.h name change 2006-05-21 05:12:17 +00:00
capture_sync.c Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
capture_sync.h Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
capture_ui_utils.c Don't call get_interface_descriptive_name() on a NULL iface: fixes a segfault when doing Statistics->Summary when you didn't capture anything (but rather read in a file) 2007-09-04 22:13:26 +00:00
capture_ui_utils.h gcc 4 doesn't like my macro for getting the interface description: it says there's an invalid lvalue in it. I don't see what's wrong with it, but replace the macro with a function. Also: don't include the .xpm files in gtk/main.c if we're building without PCAP (as they're not used in that configuration). 2007-08-22 18:56:20 +00:00
capture_wpcap_packet.c from Gisle Vanem: 2007-03-27 21:32:14 +00:00
capture_wpcap_packet.h name change 2006-05-21 05:12:17 +00:00
cfile.c break out dfcode from the capture file structure and declare it locally where it is needed. 2007-01-01 10:23:37 +00:00
cfile.h break out dfcode from the capture file structure and declare it locally where it is needed. 2007-01-01 10:23:37 +00:00
cfilters Rename the main executable to "wireshark", along with more conversions: 2006-05-31 19:12:15 +00:00
clopts_common.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
clopts_common.h Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
cmakeconfig.h.in Get rid of UCD SNMP support (it's not longer supported and 2006-12-08 15:05:41 +00:00
cmdarg_err.h name change 2006-05-21 05:12:17 +00:00
color.h name change 2006-05-21 05:12:17 +00:00
color_filters.c From Florent DROUIN <florent.drouin@alcatel.fr>, bug 1518: 2007-08-21 21:15:57 +00:00
color_filters.h fix the memory leak problem mentioned lately by adding and using color_filters_cleanup() 2006-10-03 23:24:48 +00:00
colorfilters On 2nd thought: change color filter name from "Low TTL" to "TTL low or unexpected" 2007-08-28 21:24:34 +00:00
conditions.c name change 2006-05-21 05:12:17 +00:00
conditions.h name change 2006-05-21 05:12:17 +00:00
config.guess Remove svn:executable 2005-08-02 05:46:16 +00:00
config.h.win32 remove forgotten @HAVE_NET_SNMP@ 2007-09-24 12:46:02 +00:00
config.nmake Use GTK+ 2.12 2007-09-25 16:09:58 +00:00
config.sub Remove svn:executable 2005-08-02 05:46:16 +00:00
configure.in Change some additional protocols to the new build system 2007-09-25 18:02:49 +00:00
dfilter_macros The UAT gui starts to work 2007-01-29 10:23:38 +00:00
dfilters provide global default files for cfilters/colorfilters/dfilters 2005-06-09 07:43:32 +00:00
dftest.c No need to call init_plugin_dir() - it gets called, if necessary, by 2007-05-25 20:03:26 +00:00
disabled_protos.c name change 2006-05-21 05:12:17 +00:00
disabled_protos.h name change 2006-05-21 05:12:17 +00:00
doxygen.cfg.in One more Ethereal -> Wireshark name change 2006-10-20 19:19:33 +00:00
doxygen_global.cfg fix doxygen generation 2004-10-27 04:46:17 +00:00
dumpcap.c Add a "-S" flag to dumpcap, which prints out interface statistics. Use 2007-08-02 21:45:27 +00:00
dumpcap.vcproj translate some german to english 2007-09-09 14:58:02 +00:00
editcap.c This patch fixes the following two errors that appear when 2007-08-31 14:14:17 +00:00
example_snmp_users_file Add a shord description on how the snmp_users_file can be used 2007-01-23 19:56:10 +00:00
file.c As per Ulf's request add ${proto.field} macros that will use the value of the given field has in the last selected packet. 2007-07-30 23:32:47 +00:00
file.h match declaration of cf_continue_tail() with implementation 2007-03-22 23:44:48 +00:00
fileset.c Fix yet more casts of ctype.h macro arguments - and fix some cases where 2007-07-14 00:37:01 +00:00
fileset.h name change 2006-05-21 05:12:17 +00:00
filters.c Change the filter dialog (capture and display filters), so it has a real Cancel button now - the former Close button didn't reverted the changes done. 2006-10-01 17:59:30 +00:00
filters.h Change the filter dialog (capture and display filters), so it has a real Cancel button now - the former Close button didn't reverted the changes done. 2006-10-01 17:59:30 +00:00
g711.c Some 'no previous declararion' warning fixes 2005-08-14 23:25:20 +00:00
g711.h name change 2006-05-21 05:12:17 +00:00
getopt.c nikai@nikai.net: 2006-11-14 20:08:44 +00:00
getopt.h
globals.h name change 2006-05-21 05:12:17 +00:00
inet_ntop.c Fix compilation under VS6 (hopefully without breaking compilation 2007-06-11 18:26:09 +00:00
inet_pton.c Fix compilation under VS6 (hopefully without breaking compilation 2007-06-11 18:26:09 +00:00
inet_v6defs.h Fix compilation under VS6 (hopefully without breaking compilation 2007-06-11 18:26:09 +00:00
isprint.h Ethereal->Wireshark 2006-05-28 20:28:20 +00:00
log.h name change 2006-05-21 05:12:17 +00:00
main_window.h name change 2006-05-21 05:12:17 +00:00
make-authors-format.pl
make-authors-short.pl
make-faq Better update for the FAQ. We can now use the URL 2006-06-07 12:54:00 +00:00
make-manuf Remove S/A from company names 2005-08-27 15:11:00 +00:00
make-tapreg-dotc Include "register.h" in the machine-generated code to register taps, so 2005-10-10 18:16:21 +00:00
make-version.pl Handle case of source-dir != build-dir; 2 other minor bug fixes 2007-08-22 19:36:49 +00:00
manuf Small change about extreme EAPSv2 address and update manuf 2007-09-25 14:09:08 +00:00
manuf.tmpl add PROFINET Multicast OUI 01:0E:CF (in addition to the unicast 00:0E:CF) 2007-07-31 19:03:43 +00:00
menu.h Don't enable "Save As" if you don't have an unsaved live capture file 2007-03-14 19:30:19 +00:00
merge.c EVERYTHING IN THE BUILDBOT IS GOING TO BE RED!!! Sorry! 2005-08-24 21:31:56 +00:00
merge.h change all file offsets from long to gint64 so we can - theoretically - handle files > 2GB correct. 2006-11-05 22:46:44 +00:00
mergecap.c Ethereal->Wireshark 2006-05-28 20:28:20 +00:00
mkcap.c
mkstemp.c replace *a lot* of file related calls by their GLib counterparts. This is necessary for the switch to GTK 2.6 (at least on WIN32). 2005-11-06 22:43:25 +00:00
mkstemp.h
nio-ie5.c don't cache the downloaded file, so changes in the update file will have an effect while experimenting 2007-02-25 15:44:38 +00:00
nio-ie5.h far from being complete: 2007-01-13 14:33:46 +00:00
packaging.vcproj translate some german to english 2007-09-09 14:58:02 +00:00
packet-range.c name change 2006-05-21 05:12:17 +00:00
packet-range.h name change 2006-05-21 05:12:17 +00:00
pcapio.c OK, fix it properly by adding test after config.h has been included... 2007-02-01 12:34:28 +00:00
pcapio.h name change 2006-05-21 05:12:17 +00:00
perlnoutf.pl
print.c Remove almost all of the casts I committed recently and in place of 2007-03-28 21:55:11 +00:00
print.h Warning fix 2007-03-28 04:29:00 +00:00
print.ps Ethereal->Wireshark 2006-05-29 05:38:10 +00:00
progress_dlg.h name change 2006-05-21 05:12:17 +00:00
proto_hier_stats.c Fix for bug #1325: Protocol hierarchy display shows an empty line because of 2007-01-25 23:00:29 +00:00
proto_hier_stats.h name change 2006-05-21 05:12:17 +00:00
ps.h name change 2006-05-21 05:12:17 +00:00
randpkt.c From Mike Harvey: Support for WiMAX and the WiMAX M2M encapsulation protocol. 2007-05-25 23:40:42 +00:00
rdps.c coverity 169 dead code 2006-06-24 03:39:54 +00:00
register.h Squelch some qualifier (const vs. non-const) warnings. 2007-05-25 19:13:49 +00:00
ringbuffer.c Fix for bug 1591: 2007-05-15 07:53:37 +00:00
ringbuffer.h name change 2006-05-21 05:12:17 +00:00
services add IANA port-numbers file as a file named "services", with some minor explanations from me at the top of that file 2007-08-12 20:54:30 +00:00
simple_dialog.h name change 2006-05-21 05:12:17 +00:00
smi_modules remove (for now) the COPS PIBs from the list, as I have added a reprot_failure to give feedback about libsmi errors while loading the modules. 2007-08-28 19:11:36 +00:00
stat_menu.h experimental feature: dissector filters 2007-08-16 22:03:10 +00:00
statusbar.h Squelch some qualifier (const vs. non-const) warnings. 2007-05-25 19:13:49 +00:00
strcasecmp.c
strerror.c name change 2006-05-21 05:12:17 +00:00
strerror.h name change 2006-05-21 05:12:17 +00:00
strncasecmp.c
strptime.c
strptime.h name change 2006-05-21 05:12:17 +00:00
summary.c Change the "--enable-setuid-install" option to install dumpcap and TShark 2007-08-30 00:24:40 +00:00
summary.h change all file offsets from long to gint64 so we can - theoretically - handle files > 2GB correct. 2006-11-05 22:46:44 +00:00
svnadd little helper script that sets props after adding a file 2007-01-29 14:12:57 +00:00
sync_pipe.h ethereal->wireshark updates 2006-05-22 08:14:01 +00:00
sync_pipe_write.c Add missing include file when compiling under windows 2007-02-19 23:18:48 +00:00
tap-afpstat.c Wireshark now requires support for 64-bit types so there's no need to #ifdef 2007-04-16 04:34:07 +00:00
tap-ansi_astat.c name change 2006-05-21 05:12:17 +00:00
tap-bootpstat.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
tap-camelcounter.c next try to fix includes 2007-07-13 13:20:34 +00:00
tap-camelsrt.c next try to fix includes 2007-07-13 13:20:34 +00:00
tap-dcerpcstat.c Wireshark now requires support for 64-bit types so there's no need to #ifdef 2007-04-16 04:34:07 +00:00
tap-funnel.c From Sebastien Tandel: 2007-02-13 20:57:22 +00:00
tap-gsm_astat.c name change 2006-05-21 05:12:17 +00:00
tap-h225counter.c next missing includes 2007-05-14 16:53:23 +00:00
tap-h225rassrt.c next missing includes 2007-05-14 16:53:23 +00:00
tap-httpstat.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
tap-iostat.c fix MSVC warnings of / and set CFLAGS to block new warnings 2007-03-21 23:14:23 +00:00
tap-iousers.c Change bytes counters to 64 bits and use the PRI macros to print them. 2007-04-18 04:34:10 +00:00
tap-mgcpstat.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
tap-protocolinfo.c Have separate proto_construct_match_selected_string() and 2006-11-24 18:25:23 +00:00
tap-protohierstat.c Change bytes counters to 64 bits and use the PRI macros to print them. 2007-04-18 04:34:10 +00:00
tap-radiusstat.c From Alejandro Vaquero: 2006-10-24 05:21:00 +00:00
tap-rpcprogs.c Wireshark now requires support for 64-bit types so there's no need to #ifdef 2007-04-16 04:34:07 +00:00
tap-rpcstat.c Wireshark now requires support for 64-bit types so there's no need to #ifdef 2007-04-16 04:34:07 +00:00
tap-sctpchunkstat.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
tap-sipstat.c Add 422 "Session Timer Too Small" response code from RFC 4028 2007-06-29 10:47:46 +00:00
tap-smbsids.c include emem 2006-06-18 05:41:14 +00:00
tap-smbstat.c Wireshark now requires support for 64-bit types so there's no need to #ifdef 2007-04-16 04:34:07 +00:00
tap-stats_tree.c Remove almost all of the casts I committed recently and in place of 2007-03-28 21:55:11 +00:00
tap-wspstat.c Tethereal/tethereal -> TShark/tshark. 2006-05-31 17:38:42 +00:00
tap_dfilter_dlg.h * rename REGISTER_STAT_GROUP_E -> register_stat_group_t 2006-09-27 17:12:42 +00:00
tempfile.c Win32: MSVC > 6 doesn't work well with Unicode filenames! 2007-01-12 03:05:28 +00:00
tempfile.h name change 2006-05-21 05:12:17 +00:00
text2pcap-scanner.l Add comments to various %option items to explain what they're doing. 2007-07-30 20:22:37 +00:00
text2pcap.c When -t option: Use current date or time fields for unspecified fields; Fixes bug #1836. 2007-09-20 16:12:17 +00:00
text2pcap.h remove now useless definition of NO_YY_UNPUT 2007-04-03 21:09:29 +00:00
timestats.c name change 2006-05-21 05:12:17 +00:00
timestats.h name change 2006-05-21 05:12:17 +00:00
trigcap.c From Gisle Vanem <gvanem@broadpark.no> 2007-08-25 15:15:55 +00:00
tshark.c Add routines under Windows to check if npf.sys is running, and to 2007-09-15 00:18:17 +00:00
tshark.vcproj translate some german to english 2007-09-09 14:58:02 +00:00
ui_util.h From Dustin Johnson: If "Update list of packets in real time" and 2007-07-09 16:31:39 +00:00
update.c use the right return type of update_pref(), to prevent a warning 2007-07-23 20:12:18 +00:00
util.c From Sebastien Tandel: 2007-02-13 20:57:22 +00:00
util.h name change 2006-05-21 05:12:17 +00:00
version_info.c Add routines under Windows to check if npf.sys is running, and to 2007-09-15 00:18:17 +00:00
version_info.h Add routines under Windows to check if npf.sys is running, and to 2007-09-15 00:18:17 +00:00
wireshark-gtk1.vcproj translate some german to english 2007-09-09 14:58:02 +00:00
wireshark-gtk2.vcproj translate some german to english 2007-09-09 14:58:02 +00:00
wireshark.desktop - Update to 0.9.5 (from 0.9.4) 2006-08-29 20:21:47 +00:00
wireshark.sln add a dissectors project, so MSVC "jump to error" works 2007-09-09 14:58:56 +00:00
wka.tmpl Small change about extreme EAPSv2 address and update manuf 2007-09-25 14:09:08 +00:00

README

$Id$

General Information
------- -----------

Wireshark is a network traffic analyzer, or "sniffer", for Unix and
Unix-like operating systems.  It uses GTK+, a graphical user interface
library, and libpcap, a packet capture and filtering library.

The Wireshark distribution also comes with Tshark, which is a
line-oriented sniffer (similar to Sun's snoop, or tcpdump) that uses the
same dissection, capture-file reading and writing, and packet filtering
code as Wireshark, and with editcap, which is a program to read capture
files and write the packets from that capture file, possibly in a
different capture file format, and with some packets possibly removed
from the capture.

The official home of Wireshark is

    http://www.wireshark.org

The latest distribution can be found in the subdirectory

    http://www.wireshark.org/distribution


Installation
------------

Wireshark is known to compile and run on the following systems:

  - Linux (2.0 and later kernels, various distributions)
  - Solaris (2.5.1 and later)
  - FreeBSD (2.2.5 and later)
  - NetBSD
  - OpenBSD
  - Mac OS X (10.2 and later)
  - HP-UX (10.20, 11.00, 11.11)
  - Sequent PTX v4.4.5  (Nick Williams <njw@sequent.com>)
  - Tru64 UNIX (formerly Digital UNIX) (3.2 and later)
  - Irix (6.5)
  - AIX (4.3.2, with a bit of work)
  - Win32 (NT, 2000, 2003, XP)

and possibly on other versions of those OSes.  It should run on other
Unix-ish systems without too much trouble.

NOTE: the Makefile appears to depend on GNU "make"; it doesn't appear to
work with the "make" that comes with Solaris 7 nor the BSD "make".
Perl is also needed to create the man page.

If you decide to modify the yacc grammar or lex scanner, then
you need "flex" - it cannot be built with vanilla "lex" -
and either "bison" or the Berkeley "yacc". Your flex
version must be 2.5.1 or greater. Check this with 'flex -V'.

If you decide to modify the NetWare Core Protocol dissector, you
will need python, as the data for packet types is stored in a python
script, ncp2222.py.

You must therefore install Perl, GNU "make", "flex", and either "bison" or
Berkeley "yacc" on systems that lack them.

Full installation instructions can be found in the INSTALL file.
         
See also the appropriate README.<OS> files for OS-specific installation
instructions.

Usage
-----          

In order to capture packets from the network, you need to be running as
root, or have access to the appropriate entry under /dev if your system
is so inclined (BSD-derived systems, and systems such as Solaris and
HP-UX that support DLPI, typically fall into this category).  Although
it might be tempting to make the Wireshark executable setuid root, please
don't - alpha code is by nature not very robust, and liable to contain
security holes.

Please consult the man page for a description of each command-line
option and interface feature.


Multiple File Types
-------------------

The wiretap library is a packet-capture library currently under
development parallel to wireshark.  In the future it is hoped that
wiretap will have more features than libpcap, but wiretap is still in
its infancy. However, wiretap is used in wireshark for its ability
to read multiple file types. You can read the following file
formats:

libpcap (tcpdump -w, etc.) - this is Wireshark's native format
snoop and atmsnoop
Shomiti/Finisar Surveyor
Novell LANalyzer
Network General/Network Associates DOS-based Sniffer (compressed and
    uncompressed)
Microsoft Network Monitor
AIX's iptrace
Cinco Networks NetXRray
Network Associates Windows-based Sniffer
AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp
RADCOM's WAN/LAN Analyzer
Lucent/Ascend access products
HP-UX's nettl
Toshiba's ISDN routers
ISDN4BSD "i4btrace" utility
Cisco Secure Intrustion Detection System iplogging facility
pppd logs (pppdump-format files)
VMS's TCPIPtrace utility
DBS Etherwatch for VMS
Traffic captures from Visual Networks' Visual UpTime
CoSine L2 debug output
Output from Accellent's 5Views LAN agents
Endace Measurement Systems' ERF format
Linux Bluez Bluetooth stack "hcidump -w" traces
Network Instruments Observer version 9
Trace files for the EyeSDN USB S0

In addition, it can read gzipped versions of any of these files
automatically, if you have the zlib library available when compiling
Wireshark. Wireshark needs a modern version of zlib to be able to use
zlib to read gzipped files; version 1.1.3 is known to work.  Versions
prior to 1.0.9 are missing some functions that Wireshark needs and won't
work.  "./configure" should detect if you have the proper zlib version
available and, if you don't, should disable zlib support. You can always
use "./configure --disable-zlib" to explicitly disable zlib support.

Although Wireshark can read AIX iptrace files, the documentation on
AIX's iptrace packet-trace command is sparse.  The 'iptrace' command
starts a daemon which you must kill in order to stop the trace. Through
experimentation it appears that sending a HUP signal to that iptrace
daemon causes a graceful shutdown and a complete packet is written
to the trace file. If a partial packet is saved at the end, Wireshark
will complain when reading that file, but you will be able to read all
other packets.  If this occurs, please let the Wireshark developers know
at wireshark-dev@wireshark.org, and be sure to send us a copy of that trace
file if it's small and contains non-sensitive data.

Support for Lucent/Ascend products is limited to the debug trace output
generated by the MAX and Pipline series of products.  Wireshark can read
the output of the "wandsession" "wandisplay", "wannext", and "wdd"
commands.  For detailed information on use of these commands, please refer
the following pages:

"wandsession", "wandisplay", and "wannext" on the Pipeline series:
  http://aos.ascend.com/aos:/gennavviewer.html?doc_id=0900253d80006c79

"wandsession", "wandisplay", and "wannext" on the MAX series:
  http://aos.ascend.com/aos:/gennavviewer.html?doc_id=0900253d80006972

"wdd" on the Pipeline series:
  http://aos.ascend.com/aos:/gennavviewer.html?doc_id=0900253d80006877

Wireshark can also read dump trace output from the Toshiba "Compact Router"
line of ISDN routers (TR-600 and TR-650). You can telnet to the router
and start a dump session with "snoop dump".

CoSine L2 debug output can also be read by Wireshark. To get the L2
debug output, get in the diags mode first and then use
"create-pkt-log-profile" and "apply-pkt-log-profile" commands under
layer-2 category. For more detail how to use these commands, you
should examine the help command by "layer-2 create ?" or "layer-2 apply ?".

To use the Lucent/Ascend, Toshiba and CoSine traces with Wireshark, you must 
capture the trace output to a file on disk.  The trace is happening inside 
the router and the router has no way of saving the trace to a file for you.
An easy way of doing this under Unix is to run "telnet <ascend> | tee <outfile>".
Or, if your system has the "script" command installed, you can save
a shell session, including telnet to a file. For example, to a file named
tracefile.out:

$ script tracefile.out
Script started on <date/time>
$ telnet router
..... do your trace, then exit from the router's telnet session.
$ exit
Script done on <date/time>



IPv6
----
If your operating system includes IPv6 support, wireshark will attempt to
use reverse name resolution capabilities when decoding IPv6 packets.

If you want to turn off name resolution while using wireshark, start
wireshark with the "-n" option to turn off all name resolution (including
resolution of MAC addresses and TCP/UDP/SMTP port numbers to names), or
with the "-N mt" option to turn off name resolution for all
network-layer addresses (IPv4, IPv6, IPX).

You can make that the default setting by opening the Preferences dialog
box using the Preferences item in the Edit menu, selecting "Name
resolution", turning off the appropriate name resolution options,
clicking "Save", and clicking "OK".

If you would like to compile wireshark without support for IPv6 name
resolution, use the "--disable-ipv6" option with "./configure".  If you
compile wireshark without IPv6 name resolution, you will still be able to
decode IPv6 packets, but you'll only see IPv6 addresses, not host names.


SNMP
----
Wireshark can do some basic decoding of SNMP packets; it can also use
the Net-SNMP library to do more sophisticated decoding, by reading MIB
files and using the information in those files to display OIDs and
variable binding values in a friendlier fashion.  The configure script
will automatically determine whether you have the Net-SNMP library on
your system.  If you have the Net-SNMP library but _do not_ want to have
wireshark use it, you can run configure with the "--without-net-snmp"
option.

How to Report a Bug
-------------------
Wireshark is still under constant development, so it is possible that you will
encounter a bug while using it. Please report bugs to wireshark-dev@wireshark.org.
Be sure you tell us:

	1) Operating System and version (the command 'uname -sr' may
	   tell you this, although on Linux systems it will probably
	   tell you only the version number of the Linux kernel, not of
	   the distribution as a whole; on Linux systems, please tell us
	   both the version number of the kernel, and which version of
	   which distribution you're running)
	2) Version of GTK+ (the command 'gtk-config --version' will tell you)
	3) Version of Wireshark (the command 'wireshark -v' will tell you,
	   unless the bug is so severe as to prevent that from working,
	   and should also tell you the versions of libraries with which
	   it was built)
	4) The command you used to invoke Wireshark, and the sequence of
	   operations you performed that caused the bug to appear

If the bug is produced by a particular trace file, please be sure to send
a trace file along with your bug description. Please don't send a trace file
greater than 1 MB when compressed. If the trace file contains sensitive
information (e.g., passwords), then please do not send it.

If Wireshark died on you with a 'segmentation violation', 'bus error',
'abort', or other error that produces a UNIX core dump file, you can
help the developers a lot if you have a debugger installed.  A stack
trace can be obtained by using your debugger ('gdb' in this example),
the wireshark binary, and the resulting core file.  Here's an example of
how to use the gdb command 'backtrace' to do so.

$ gdb wireshark core
(gdb) backtrace
..... prints the stack trace
(gdb) quit
$

The core dump file may be named "wireshark.core" rather than "core" on
some platforms (e.g., BSD systems).  If you got a core dump with
Tshark rather than Wireshark, use "tshark" as the first argument to
the debugger; the core dump may be named "tshark.core".

Disclaimer
----------

There is no warranty, expressed or implied, associated with this product.
Use at your own risk.


Gerald Combs <gerald@wireshark.org>
Gilbert Ramirez <gram@alumni.rice.edu>
Guy Harris <guy@alum.mit.edu>