![Guy Harris](/assets/img/avatar_default.png)
and outgoing PDUs, rather than specifying a numerical mask with pduin and pduout (0x30000000). svn path=/trunk/; revision=1649
130 lines
5.2 KiB
Text
130 lines
5.2 KiB
Text
$Id: README,v 1.21 2000/02/19 08:49:16 guy Exp $
|
|
|
|
Wiretap is a library that is being developed as a future replacement for
|
|
libpcap, the current standard Unix library for packet capturing. Libpcap
|
|
is great in that it is very platform independent and has a wonderful
|
|
BPF optimizing engine. But it has some shortcomings as well. These
|
|
shortcomings came to a head during the development of Ethereal
|
|
(http://ethereal.zing.org), a packet analyzer. As such, I began developing
|
|
wiretap so that:
|
|
|
|
1. The library can easily be amended with new packet filtering objects.
|
|
Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects,
|
|
etc. I also want any decent programmer to be able to add new filters to the
|
|
library.
|
|
|
|
2. The library can read file formats from many packet-capturing utilities.
|
|
Libpcap only reads Libpcap files.
|
|
|
|
3. The library can capture on more than one network interface at a time, and
|
|
save this trace in one file.
|
|
|
|
4. Network names can be resolved immediately after a trace and saved in the
|
|
trace file. That way, I can ship a trace of my firewall-protected network to a
|
|
colleague, and he'll see the proper hostnames for the IP addresses in the
|
|
packet capture, even though he doesn't have access to the DNS server behind my
|
|
LAN's firewall.
|
|
|
|
5. I want to look into the possibility of compressing packet data when saved
|
|
to a file, like Sniffer.
|
|
|
|
6. The packet-filter can be optimized for the host OS. Not all OSes have BPF;
|
|
SunOS has NIT and Solaris has DLPI, which both use the CMU/Stanford
|
|
packet-filter pseudomachine. RMON has another type of packet-filter syntax
|
|
which we could support.
|
|
|
|
Wiretap is very good at reading many file formats, as per #2
|
|
above. Wiretap has no filter capability at present; it currently doesn't
|
|
support packet capture, so it wouldn't be useful there, and filtering
|
|
when reading a capture file is done by Ethereal, using a more powerful
|
|
filtering mechanism than that provided by BPF.
|
|
|
|
|
|
File Formats
|
|
============
|
|
|
|
Libpcap
|
|
-------
|
|
The "libpcap" file format was determined by reading the "libpcap" code;
|
|
wiretap reads the "libpcap" file format with its own code, rather than
|
|
using the "libpcap" library's code to read it.
|
|
|
|
Sniffer (uncompressed)
|
|
-------
|
|
The Sniffer format is documented in the Sniffer manual. Unfortunately,
|
|
Sniffer manuals tend to document only the format for the Sniffer model
|
|
they document. Token-Ring and ethernet seems to work well, though.
|
|
If you have an ATM Sniffer file, both Guy and Gilbert would be *very*
|
|
interested in receiving a sample. (see 'AUTHORS' file for our e-mail
|
|
addresses).
|
|
|
|
LANalyzer
|
|
---------
|
|
The LANalyzer format is available from http://www.novell.com. Search
|
|
their knowledge base for "Trace File Format".
|
|
|
|
Network Monitor
|
|
---------------
|
|
Microsoft's Network Monitor file format is supported, at least under
|
|
Ethernet and token-ring. If you have capture files of other datalink
|
|
types, please send them to Guy.
|
|
|
|
"snoop"
|
|
-------
|
|
The Solaris 2.x "snoop" program's format is documented in RFC 1761.
|
|
|
|
"iptrace"
|
|
---------
|
|
This is the capture program that comes with AIX 3.x and 4.x. AIX 3 uses
|
|
the iptrace 1.0 file format, while AIX4 uses iptrace 2.0. iptrace has
|
|
an undocumented, yet very simple, file format. The interesting thing
|
|
about iptrace is that it will record packets coming in from all network
|
|
interfaces; a single iptrace file can contain multiple datalink types.
|
|
|
|
Sniffer Basic (NetXRay)/Windows Sniffer Pro
|
|
-------------------------------------------
|
|
Network Associates' Sniffer Basic (formerly NetXRay from Cinco Networks)
|
|
file format is now supported, at least for Ethernet and token-ring.
|
|
Network Associates' Windows Sniffer Pro appears to use a variant of that
|
|
format; it's supported to the same extent.
|
|
|
|
RADCOM WAN/LAN Analyzers
|
|
------------------------
|
|
Olivier Abad has added code to read Ethernet and LAPB captures from
|
|
RADCOM WAN/LAN Analyzers (see http://www.radcom-inc.com/).
|
|
|
|
Lucent/Ascend access products
|
|
-----------------------------
|
|
Gerald
|
|
|
|
HP-UX nettl
|
|
-----------
|
|
nettl is used on HP-UX to trace various streams based subsystems. Wiretap
|
|
can read nettl files containing IP frames (NS_LS_IP subsystem) and LAPB
|
|
frames (SX25L2 subsystem). It has been tested with files generated on
|
|
HP-UX 9.04 and 10.20.
|
|
Use the following commands to generate a trace :
|
|
# IP capture. 0x30000000 means PDU in and PDU out :
|
|
nettl -tn 0x30000000 -e NS_LS_IP -f tracefile
|
|
# X25 capture. You must specify an interface :
|
|
nettl -tn 0x30000000 -e SX25l2 -d /dev/x25_0 -f tracefile
|
|
# stop capture. subsystem is NS_LS_IP or SX25L2 :
|
|
nettl -tf -e subsystem
|
|
|
|
One may be able to specify "-tn pduin pduout" rather than
|
|
"-tn 0x30000000"; the nettl man page for HP-UX 10.30 implies that it
|
|
should work.
|
|
|
|
Toshiba ISDN Router
|
|
-------------------
|
|
An under-documented command that the router supports in a telnet session
|
|
is "snoop" (not related to the Solaris "snoop" command). If you give it
|
|
the "dump" option, you'll get a hex dump of all packets across the router
|
|
(except of your own telnet session -- good thinking Toshiba!). You can
|
|
select a certain channel to sniff (LAN, B1, B2, D), but the default is all
|
|
channels. You save this hex dump to disk with 'script' or by 'telnet |
|
|
tee'. Wiretap will read the ASCII hex dump and convert it to binary data.
|
|
|
|
Gilbert Ramirez <gram@xiexie.org>
|
|
Guy Harris <guy@alum.mit.edu>
|