$Id: README,v 1.2 1998/11/12 06:01:17 gram Exp $
Wiretap is a library that is being developed as a future replacement for
libpcap, the current standard Unix library for packet capturing. Libpcap is
great in that it is very platform independent and has a wonderful BPF
optimizing engine. But it has some shortcomings as well. These shortcomings
came to a head during the development of Ethereal (http://ethereal.zing.org),
a packet analyzer. As such, I began developing wiretap so that:
1. The library can easily be amended with new packet filtering objects.
Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects,
etc. I also want any decent programmer to be able to add new filters to the
library.
2. The library can read file formats from many packet-capturing utilities.
Libpcap only reads Libpcap files.
3. The library can capture on more than one network interface at a time, and
save this trace in one file.
4. Network names can be resolved immediately after a trace and saved in the
trace file. That way, I can ship a trace of my firewall-protected network to a
colleague, and he'll see the proper hostnames for the IP addresses in the
packet capture, even though he doesn't have access to the DNS server behind my
LAN's firewall.
5. I want to look into the possibility of compressing packet data when saved
to a file, like Sniffer.
Currently, only #2 is available. Wiretap doesn't even do any filtering yet. It
can only be used to read packet capture files.
File Formats
============
Libpcap
-------
Currently the libpcap file format is handled by linking in the pcap library.
Eventualy libpcap will not be linked in with wiretap as to avoid the overhead
of bringing in the libpcap packet capturing and BPF optimizing code.
Sniffer
-------
The Sniffer format has been deduced by looking at hex dumps of Sniffer trace
files. I have access to many Token-Ring Sniffer trace files, but very few
ethernet Sniffer trace files. I am guessing as to which field in the header
denotes link type. Perhaps I am wrong; perhaps only the file extension (*.enc
vs. *.trc) denotes the link type. If you have a Sniffer trace file which
doesn't work with wiretap, please send it to me. BTW, I have not yet figured
out how packet timestamps are stored in the Sniffer format.
LANalyzer
---------
The LANalyzer format is available from http://www.novell.com. Search their
knowledge base for "Trace File Format". The code in wiretap so far only dumps
the packet data; I have yet to decode the timestamp for each packet. At least
I have the format for this, so it will be supported soon.
Gilbert Ramirez
<gram@verdict.uthscsa.edu>
8efdf8a74c