281 lines
6.8 KiB
Plaintext
281 lines
6.8 KiB
Plaintext
|
|
=head1 NAME
|
|
|
|
Ethereal - Interactively browse network traffic
|
|
|
|
=head1 SYNOPSYS
|
|
|
|
B<ethereal>
|
|
S<[ B<-B> byte view height ]>
|
|
S<[ B<-b> bold font ]>
|
|
S<[ B<-c> count ]>
|
|
S<[ B<-h> ]>
|
|
S<[ B<-i> interface ]>
|
|
S<[ B<-m> font ]>
|
|
S<[ B<-n> ]>
|
|
S<[ B<-P> packet list height ]>
|
|
S<[ B<-r> infile ]>
|
|
S<[ B<-s> snaplen ]>
|
|
S<[ B<-T> tree view height ]>
|
|
S<[ B<-t> time stamp format ]>
|
|
S<[ B<-v> ]>
|
|
S<[ B<-w> savefile]>
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
B<Ethereal> is a network protocol analyzer based on the B<GTK+> GUI toolkit. It lets
|
|
you interactively browse packet data from a live network or from a B<pcap>
|
|
/ B<tcpdump()> formatted capture file.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item -B
|
|
|
|
Sets the initial height of the byte view (bottom) pane
|
|
|
|
=item -b
|
|
|
|
The bold font name used for packet fied display.
|
|
|
|
=item -c
|
|
|
|
The default number of packets to read when capturing live data.
|
|
|
|
=item -h
|
|
|
|
Prints the version and options and exits.
|
|
|
|
=item -i
|
|
|
|
The name of the interface to use for live packet capture. It should match
|
|
one of the names listed in "B<netstat -i>" or "B<ifconfig -a>".
|
|
|
|
=item -m
|
|
|
|
The font name used by B<Ethereal>.
|
|
|
|
=item -n
|
|
|
|
Disable network object name resolution (such as hostname, TCP and UDP port
|
|
names).
|
|
|
|
=item -P
|
|
|
|
Sets the initial height of the packet list (top) pane
|
|
|
|
=item -r
|
|
|
|
Read packet data from I<file>. Currently, B<Ethereal> only understands
|
|
B<pcap> / B<tcpdump> formatted files.
|
|
|
|
=item -s
|
|
|
|
The default snapshot length to use when capturing live data. No more than
|
|
I<snaplen> bytes of each network packet will be read into memory, or saved
|
|
to disk.
|
|
|
|
=item -T
|
|
|
|
Sets the initial height of the tree view (top) pane
|
|
|
|
=item -t
|
|
|
|
Sets the format of the packet timestamp displayed in the packet list
|
|
window.
|
|
|
|
=item -v
|
|
|
|
Prints the version and exits.
|
|
|
|
=item -w
|
|
|
|
Sets the default capture file name.
|
|
|
|
=back
|
|
|
|
=head1 INTERFACE
|
|
|
|
=head2 MENU ITEMS
|
|
|
|
=over 4
|
|
|
|
=item File:Open, File:Close, File:Reload
|
|
|
|
Open, close, or reload a capture file.
|
|
|
|
=item File:Print Packet
|
|
|
|
Print a description of each protocol header found in the packet, followed
|
|
by the packet data itself. Printing options can be set with the
|
|
I<Edit:Preferences> menu item.
|
|
|
|
=item File:Quit
|
|
|
|
Exits the application.
|
|
|
|
=item Edit:Preferences
|
|
|
|
Sets the packet printing and filter options (see L<"Preferences"> below).
|
|
|
|
=item Tools:Capture
|
|
|
|
Initiates a live packet capture (see L<"Capture Preferences"> below).
|
|
|
|
=item Tools:Follow TCP Stream
|
|
|
|
If you have a TCP packet selected, it will display the contents of the TCP
|
|
data stream in a separate window.
|
|
|
|
=back
|
|
|
|
=head2 WINDOWS
|
|
|
|
=over 4
|
|
|
|
=item Main Window
|
|
|
|
The main window is split into three panes. You can resize each pane using
|
|
a "thumb" at the right end of each divider line. Below the panes is a
|
|
strip that shows the file load progress, current filter, and informational
|
|
text.
|
|
|
|
The top pane contains the list of network packets that you can scroll
|
|
through and select. The packet number, packet timestamp, source and
|
|
destination addresses, protocol, and description are printed for each
|
|
packet. An effort is made to display information as high up the protocol
|
|
stack as possible, e.g. IP addresses are displayed for IP packets, but the
|
|
MAC layer address is displayed for unknown packet types.
|
|
|
|
The middle pane contains a I<protocol tree> for the currently-selected
|
|
packet. The tree displays each field and its value in each protocol header
|
|
in the stack.
|
|
|
|
The lowest pane contains a hex dump of the actual packet data.
|
|
Selecting a field in the I<protocol tree> highlights the corresponding
|
|
bytes in this section.
|
|
|
|
A display filter can be entered into the strip at the bottom. It must
|
|
have the same format as B<tcpdump> filter strings, since both programs use
|
|
the same underlying library. A filter for HTTP, HTTPS, and DNS traffic
|
|
might look like this:
|
|
|
|
tcp port 80 or tcp port 443 or port 53
|
|
|
|
Selecting the I<Filter:> button lets you choose from a list of named
|
|
filters that you can optionally save.
|
|
|
|
=item Preferences
|
|
|
|
The I<Preferences> dialog lets you select the output format of packets
|
|
printed using the I<File:Print Packet> menu item and configure
|
|
commonly-used filters.
|
|
|
|
=over 6
|
|
|
|
=item Printing Preferences
|
|
|
|
The radio buttons at the top of the I<Printing> page allow you choose
|
|
between printing the packets as text or PostScript, and sending the
|
|
output directly to a command or saving it to a file. The I<Command:> text
|
|
entry box is the command to send files to (usually B<lpr>), and the
|
|
I<File:> entry box lets you enter the name of the file you wish to save
|
|
to. Additinally, you can select the I<File:> button to browse the file
|
|
system for a particular save file.
|
|
|
|
=item Filters
|
|
|
|
The I<Filters> page lets you create and modify filters, and set the
|
|
default filter to use when capturing data or opening a capture file.
|
|
|
|
The I<Filter name> entry specifies a descriptive name for a filter, e.g.
|
|
B<Web and DNS traffic>. The I<Filter string> entry is the text that
|
|
actually describes the filtering action to take, as described above.The
|
|
dialog buttons perform the following actions:
|
|
|
|
=over 8
|
|
|
|
=item New
|
|
|
|
If there is text in the two entry boxes, it creates a new associated list
|
|
item.
|
|
|
|
=item Change
|
|
|
|
Modifies the currently selected list item to match what's in the entry
|
|
boxes.
|
|
|
|
=item Copy
|
|
|
|
Makes a copy of the currently selected list item.
|
|
|
|
=item Delete
|
|
|
|
Deletes the currently selected list item.
|
|
|
|
=item OK
|
|
|
|
Sets the currently selected list item as the active filter. If nothing
|
|
is selected, turns filtering off.
|
|
|
|
=item Save
|
|
|
|
Saves the current filter list in F<$HOME/.ethereal/filters>.
|
|
|
|
=item Cancel
|
|
|
|
Closes the dialog without making any changes.
|
|
|
|
=back
|
|
|
|
=back
|
|
|
|
=item Capture Preferences
|
|
|
|
The I<Capture Preferences> dialog lets you specify various parameters for
|
|
capturing live packet data.
|
|
|
|
The I<Interface:> entry box lets you specify the interface from which to
|
|
capture packet data. The I<Count:> entry specifies the number of packets
|
|
to capture. Entering 0 will capture packets indefinitely. The I<Filter:>
|
|
entry lets you specify the capture filter using a tcpdump-style filter
|
|
string as described above. The I<File:> entry specifies the file to save
|
|
to, as in the I<Printer Options> dialog above. You can choose to open the
|
|
file after capture, and you can also specify the maximum number of bytes
|
|
to capture per packet with the I<Capture length> entry.
|
|
|
|
=back
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<tcpdump(1)>, L<pcap(3)>
|
|
|
|
=head1 NOTES
|
|
|
|
The latest version of B<ethereal> can be found at
|
|
B<http://ethereal.zing.org>.
|
|
|
|
=head1 AUTHORS
|
|
|
|
Original Author
|
|
-------- ------
|
|
Gerald Combs <gerald@zing.org>
|
|
|
|
|
|
Contributors
|
|
------------
|
|
Gilbert Ramirez Jr. <gram@verdict.uthscsa.edu>
|
|
Hannes R. Boehm <hannes@boehm.org>
|
|
Mike Hall <mlh@io.com>
|
|
Bobo Rajec <bobo@bsp-consulting.sk>
|
|
Laurent Deniel <deniel@worldnet.fr>
|
|
Don Lafontaine <lafont02@cn.ca>
|
|
|
|
|
|
Alain Magloire <alainm@rcsm.ece.mcgill.ca> was kind enough to give his
|
|
permission to use his version of snprintf.c.
|
|
|
|
Dan Lasley <dlasley@promus.com> gave permission for his dumpit() hex-dump
|
|
routine to be used.
|