Ethereal -> Wireshark. Update the FAQ.

svn path=/trunk/; revision=18380
This commit is contained in:
Gerald Combs 2006-06-07 04:37:26 +00:00
parent 477bd8006a
commit c2e72cf272
7 changed files with 1293 additions and 2014 deletions

View File

@ -1,4 +1,4 @@
## Makefile for building ethereal.exe with Microsoft C and nmake
## Makefile for building wireshark.exe with Microsoft C and nmake
## Use: $(MAKE) /$(MAKEFLAGS) -f makefile.nmake
#
# $Id$

View File

@ -2,7 +2,7 @@ Filtering packets while capturing
---------------------------------
Capture Filters are used to filter out uninteresting packets already at capture time. This is done to reduce the size of the resulting capture (file) and is especially useful on high traffic networks or for long term capturing.
Ethereal uses the pcap (libpcap/WinPcap) filter language for capture filters. This language is explained in the tcpdump man page under "expression" (http://www.tcpdump.org and search for "selects which").
Wireshark uses the pcap (libpcap/WinPcap) filter language for capture filters. This language is explained in the tcpdump man page under "expression" (http://www.tcpdump.org and search for "selects which").
Note: This capture filter language is different from the one used for the Wireshark display filters!

View File

@ -51,7 +51,7 @@ Please note: this will slow down capturing, so increased packet drops might appe
High performance capturing
--------------------------
When your network traffic is high, you might need to take some steps to ensure Ethereal doesn't get behind on its capture, particularly if you're running it on a slow computer.
When your network traffic is high, you might need to take some steps to ensure Wireshark doesn't get behind on its capture, particularly if you're running it on a slow computer.
When Etheral cannot keep up, packets are dropped. To help avoid this as much as possible:
@ -62,9 +62,9 @@ b) Close other programs that might slow down your system, such as virus scanner
c) It might be a good idea not to use a capture filter. This will depend on the task you have to do.
As a rule of thumb: if you want to see most of the packets and only filter a small number out, don't use a capture filter (you can use a display filter later). If you only want to capture a small proportion of the packets, it might be better to set a capture filter, as this will reduce the number of packets that have to be saved.
d) If you still get packet drops, it might be an idea to use a tool dedicated to packet capturing and only use Ethereal for displaying and analyzing the packets.
d) If you still get packet drops, it might be an idea to use a tool dedicated to packet capturing and only use Wireshark for displaying and analyzing the packets.
Have a look at tshark, the command line variant of ethereal, which is included in this package.
Have a look at tshark, the command line variant of wireshark, which is included in this package.
XXX: add a list of possibly useful standalone capture programs.

View File

@ -1,6 +1,6 @@
Filtering packets while viewing
-------------------------------
After capturing packets or loading some network traffic from a file, Ethereal will display the packet data immediately on the screen.
After capturing packets or loading some network traffic from a file, Wireshark will display the packet data immediately on the screen.
Using display filters, you can choose which packets should (not) be shown on the screen. This is useful to reduce the "noise" usually on the network, showing only the packets you want to. So you can concentrate on the things you are really interested in.
@ -8,7 +8,7 @@ The display filter will not affect the data captured, it will only select which
Everytime you change the filter string, all packets will be reread from the capture file (or from memory), and processed by the display filter "machine". Packet by packet, this "machine" is asked, if this particular packet should be shown or not.
Ethereal offers a very powerful display filter language for this. It can be used for a wide range of purposes, from simply: "show only packets from a specific IP address", or on the other hand, to very complex filters like: "find all packets where a special application specific flag is set".
Wireshark offers a very powerful display filter language for this. It can be used for a wide range of purposes, from simply: "show only packets from a specific IP address", or on the other hand, to very complex filters like: "find all packets where a special application specific flag is set".
Note: This display filter language is different from the one used for the Wireshark capture filters!

File diff suppressed because it is too large Load Diff

View File

@ -1,11 +1,11 @@
Getting started
---------------
This text will try to take you though the first steps of using Ethereal.
This text will try to take you though the first steps of using Wireshark.
Display
-------
When you start Ethereal, you will see the program window vertically divided into the following parts:
When you start Wireshark, you will see the program window vertically divided into the following parts:
-window title
-menu
@ -15,7 +15,7 @@ When you start Ethereal, you will see the program window vertically divided into
-packet bytes (empty)
-statusbar (with filter toolbar)
As Ethereal has no packet data when started, most of the program's window is just empty.
As Wireshark has no packet data when started, most of the program's window is just empty.
Many of the features available in the menu will also be on the main toolbar.
@ -83,6 +83,6 @@ Conclusion
----------
There are a lot more features than described here. Just have a look at the menus to see them all. :-)
For more information about Ethereal, see: "http://www.wireshark.org". You can get a user's guide and other useful information there.
For more information about Wireshark, see: "http://www.wireshark.org". You can get a user's guide and other useful information there.
We hope this helped you with the first steps of using Ethereal and that you will enjoy using this program.
We hope this helped you with the first steps of using Wireshark and that you will enjoy using this program.

View File

@ -4,7 +4,7 @@ It lets you interactively browse packet data from a live network or from a previ
See: http://www.wireshark.org for new versions, documentation, ...
Ethereal's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. So Ethereal can read capture files from:
Wireshark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. So Wireshark can read capture files from:
-libpcap/WinPcap, tcpdump and various other tools using tcpdump's capture format
-snoop and atmsnoop
@ -33,4 +33,4 @@ Ethereal's native capture file format is libpcap format, which is also the forma
-Endace Measurement Systems' ERF format captures
-Linux Bluez Bluetooth stack hcidump -w traces
There is no need to tell Ethereal what type of file you are reading; it will determine the file type by itself. Wireshark is also capable of reading any of these file formats if they are compressed using gzip. Ethereal recognizes this directly from the file; the '.gz' extension is not required for this purpose.
There is no need to tell Wireshark what type of file you are reading; it will determine the file type by itself. Wireshark is also capable of reading any of these file formats if they are compressed using gzip. Wireshark recognizes this directly from the file; the '.gz' extension is not required for this purpose.