wireshark/wiretap
Gilbert Ramirez 7843c01d38 Changes to compile in win32.
svn path=/trunk/; revision=515
1999-08-18 22:49:48 +00:00
..
AUTHORS I gave Guy the credit he deserves. 1998-11-20 05:54:39 +00:00
COPYING I added the LANalzyer file format to wiretap. I cleaned up some code in the 1998-11-12 06:01:27 +00:00
ChangeLog Created a new protocol tree implementation and a new display filter 1999-07-07 22:52:57 +00:00
INSTALL A lengthy patch to add the wiretap library. Wiretap is not used by default 1998-11-12 00:06:47 +00:00
Makefile * Modified Makefile.am and configure.in so that wiretap isn't built unless 1999-01-13 04:14:29 +00:00
Makefile.am Update version numbers to 0.7.0, and update win32 Makefiles. I made some 1999-08-03 20:51:41 +00:00
Makefile.nmake Changes to compile in win32. 1999-08-18 22:49:48 +00:00
NEWS A lengthy patch to add the wiretap library. Wiretap is not used by default 1998-11-12 00:06:47 +00:00
README Jun-ichiro's IPv6 patch is merged in with ethereal and now uses the new 1999-03-28 18:32:03 +00:00
acconfig.h Add an "acinclude.m4", from which "aclocal.m4" is made. 1999-03-01 21:45:54 +00:00
acinclude.m4 Add an "acinclude.m4", from which "aclocal.m4" is made. 1999-03-01 21:45:54 +00:00
buffer.c Modified code to allow compilation under IBM's C compiler for AIX. 1999-01-29 17:06:56 +00:00
buffer.h I added the LANalzyer file format to wiretap. I cleaned up some code in the 1998-11-12 06:01:27 +00:00
config.h.win32 Added support for compiling on win32 with Visual C and 'nmake'. It compiles, 1999-07-13 02:53:26 +00:00
configure.in Added support for compiling on win32 with Visual C and 'nmake'. It compiles, 1999-07-13 02:53:26 +00:00
file.c In "wtap_dump_close()", don't shove the return value of "fclose()" into 1999-08-18 17:49:34 +00:00
iptrace.c Added a patch from Olivier Abad to handle X.25 iptrace captures. 1999-07-28 01:35:34 +00:00
iptrace.h Added files to handle AIX iptrace 2.0 files in wiretap. 1999-01-03 04:30:13 +00:00
lanalyzer.c Added support for compiling on win32 with Visual C and 'nmake'. It compiles, 1999-07-13 02:53:26 +00:00
lanalyzer.h I added the LANalzyer file format to wiretap. I cleaned up some code in the 1998-11-12 06:01:27 +00:00
libpcap.c "wtap_pcap_encap_to_wtap_encap()" shouldn't return a file type if it 1999-08-18 17:08:47 +00:00
libpcap.h Add to Wiretap the ability to write capture files; for now, it can only 1999-08-18 04:17:38 +00:00
netmon.c Add to Wiretap the ability to write capture files; for now, it can only 1999-08-18 04:17:38 +00:00
netmon.h Added Guy's netmon.[ch] files to CVS for him. His firewall admins forgot 1999-01-18 21:34:54 +00:00
netxray.c Add to Wiretap the ability to write capture files; for now, it can only 1999-08-18 04:17:38 +00:00
netxray.h Add support for Cinco Networks NetXRay - which is, after their acquision 1999-02-20 06:49:27 +00:00
ngsniffer.c Check in Olivier Abad's patch to add dissectors for LAP-B and X.25, and 1999-08-02 02:04:38 +00:00
ngsniffer.h Added Guy Harris' patch to read Sniffer ATM trace files. Very nice. 1998-12-17 06:39:13 +00:00
radcom.c Olivier Abad's patch to add dissectors for LAP-B and X.25, and wiretap 1999-08-02 02:26:22 +00:00
radcom.h Olivier Abad's patch to add dissectors for LAP-B and X.25, and wiretap 1999-08-02 02:26:22 +00:00
snoop.c Added support for compiling on win32 with Visual C and 'nmake'. It compiles, 1999-07-13 02:53:26 +00:00
snoop.h Add support to wiretap for reading Sun "snoop" capture files. 1998-11-15 05:29:17 +00:00
wtap.c Add to Wiretap the ability to write capture files; for now, it can only 1999-08-18 04:17:38 +00:00
wtap.h "wtap_pcap_encap_to_wtap_encap()" shouldn't return a file type if it 1999-08-18 17:08:47 +00:00

README

$Id: README,v 1.14 1999/03/28 18:32:01 gram Exp $

Wiretap is a library that is being developed as a future replacement for
libpcap, the current standard Unix library for packet capturing. Libpcap is
great in that it is very platform independent and has a wonderful BPF
optimizing engine. But it has some shortcomings as well. These shortcomings
came to a head during the development of Ethereal (http://ethereal.zing.org),
a packet analyzer. As such, I began developing wiretap so that:

1. The library can easily be amended with new packet filtering objects.
Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects,
etc. I also want any decent programmer to be able to add new filters to the
library.

2. The library can read file formats from many packet-capturing utilities.
Libpcap only reads Libpcap files.

3. The library can capture on more than one network interface at a time, and
save this trace in one file.

4. Network names can be resolved immediately after a trace and saved in the
trace file. That way, I can ship a trace of my firewall-protected network to a
colleague, and he'll see the proper hostnames for the IP addresses in the
packet capture, even though he doesn't have access to the DNS server behind my
LAN's firewall.

5. I want to look into the possibility of compressing packet data when saved
to a file, like Sniffer.

6. The packet-filter can be optimized for the host OS. Not all OSes have BPF;
SunOS has NIT and Solaris has DLPI, which both use the CMU/Stanford
packet-filter psuedomachine. RMON has another type of packet-filter syntax
which we could support.

Wiretap is very good at reading many file formats, as per #2
above. Display filters are now appearing in wiretap, but they are
still basic. Development is continuing on the BPF compiler, so display
filters will continue to be enhanced. Please read the README.filters file for
information regarding the syntax of wiretap filters.


File Formats
============

Libpcap
-------
The "libpcap" file format was determined by reading the "libpcap" code;
wiretap reads the "libpcap" file format with its own code, rather than
using the "libpcap" library's code to read it.

Sniffer (uncompressed)
-------
The Sniffer format is documented in the Sniffer manual.  Unfortunately,
Sniffer manuals tend to document only the format for the Sniffer model
they document. Token-Ring and ethernet seems to work well, though.
If you have an ATM Sniffer file, both Guy and Gilbert would be *very*
interested in receiving a sample. (see 'AUTHORS' file for our e-mail
addresses).

ATM sniffers are claimed by the manual to record a mixture of cells and
frames; there's currently no "raw ATM" encapsulation in wiretap to allow
us to return that directly, so we assume that the traffic of interest is
all LANE or all RFC 1483 traffic, search in the file for the first AAL5
frame that's either LANE or RFC 1483, set the encapsulation based on
which of those we saw, and discard all non-AAL5 cells as well as AAL5
frames not of the specified type.  We also discard the 2-byte LANE
header at the front of the frame, leaving only the emulated Ethernet or
Token Ring frame.

Given that wiretap now returns packet encapsulation types on a
per-packet basis, we could, instead, discard all non-AAL5 cells and AAL5
frames that are neither LANE nor RFC 1483, and return the appropriate
encapsulation for the packet as we read it.

LANalyzer
---------
The LANalyzer format is available from http://www.novell.com. Search their
knowledge base for "Trace File Format". 

Network Monitor
---------------
Microsoft's Network Monitor file format is supported, at least under Ethernet
and token-ring. If you have capture files of other datalink types, please send
them to Guy.

"snoop"
-------
The Solaris 2.x "snoop" program's format is documented in RFC 1761.

"iptrace"
---------
This is the capture program that comes with AIX 3.x and 4.x.  Right now
wiretap only supports iptrace 2.0 (AIX4) because I don't have access to
an AIX3 machine.  iptrace has an undocumented, yet very simple, file
format.  The interesting thing about iptrace is that it will record
packets coming in from all network interfaces; a single iptrace file can
contain multiple datalink types.  I have tested iptrace on ethernet and
token-ring; if you can provide an iptrace file with any other datalink
type, I would appreciate a copy.  (with the output from 'ipreport' too,
if possible).

Sniffer Basic (NetXRay)/Windows Sniffer Pro
-------------------------------------------
Network Associates' Sniffer Basic (formerly NetXRay from Cinco Networks)
file format is now supported, at least for Ethernet and token-ring. 
Network Associates' Windows Sniffer Pro appears to use a variant of that
format; it's supported to the same extent.

Gilbert Ramirez <gram@verdict.uthscsa.edu>
Guy Harris <guy@netapp.com>