-its infancy. You can compile ethereal with the wiretap library by using
-'./configure --with-wiretap'. Using wiretap will allow you to read
-pcap, Sniffer, Sun "snoop", and LANalyzer trace files, but it disables
-display filters. You can still capture packets from within ethereal
-using libpcap, and therefore use libpcap-style capture filters, however.
-
-If you can live without display filters and would like to read non-pcap
-capture files, give wiretap a try. If you want to add support for other
-packet-capture file formats, please look at the wiretap source code in the
-wiretap directory.
-
-Please report any problems that are wiretap related to
-Gilbert Ramirez <gram@verdict.uthscsa.edu>. He uses token-ring at work, so he
-is especially interested in any non-token-ring trace files you can send him.
+its infancy. However, wiretap is used in wireshark for its ability
+to read multiple file types. See the Wireshark man page or the
+Wireshark User's Guide for a list of supported file formats.
+
+In addition, it can read gzipped versions of any of those files
+automatically, if you have the zlib library available when compiling
+Wireshark. Wireshark needs a modern version of zlib to be able to use
+zlib to read gzipped files; version 1.1.3 is known to work. Versions
+prior to 1.0.9 are missing some functions that Wireshark needs and won't
+work. "./configure" should detect if you have the proper zlib version
+available and, if you don't, should disable zlib support. You can always
+use "./configure --disable-zlib" to explicitly disable zlib support.
+
+Although Wireshark can read AIX iptrace files, the documentation on
+AIX's iptrace packet-trace command is sparse. The 'iptrace' command
+starts a daemon which you must kill in order to stop the trace. Through
+experimentation it appears that sending a HUP signal to that iptrace
+daemon causes a graceful shutdown and a complete packet is written
+to the trace file. If a partial packet is saved at the end, Wireshark
+will complain when reading that file, but you will be able to read all
+other packets. If this occurs, please let the Wireshark developers know
+at wireshark-dev@wireshark.org, and be sure to send us a copy of that trace
+file if it's small and contains non-sensitive data.
+
+Support for Lucent/Ascend products is limited to the debug trace output
+generated by the MAX and Pipline series of products. Wireshark can read
+the output of the "wandsession" "wandisplay", "wannext", and "wdd"
+commands.
+
+Wireshark can also read dump trace output from the Toshiba "Compact Router"
+line of ISDN routers (TR-600 and TR-650). You can telnet to the router
+and start a dump session with "snoop dump".
+
+CoSine L2 debug output can also be read by Wireshark. To get the L2
+debug output, get in the diags mode first and then use
+"create-pkt-log-profile" and "apply-pkt-log-profile" commands under
+layer-2 category. For more detail how to use these commands, you
+should examine the help command by "layer-2 create ?" or "layer-2 apply ?".
+
+To use the Lucent/Ascend, Toshiba and CoSine traces with Wireshark, you must
+capture the trace output to a file on disk. The trace is happening inside
+the router and the router has no way of saving the trace to a file for you.
+An easy way of doing this under Unix is to run "telnet <ascend> | tee <outfile>".
+Or, if your system has the "script" command installed, you can save
+a shell session, including telnet to a file. For example, to a file named
+tracefile.out:
+
+----
+$ script tracefile.out
+Script started on <date/time>
+$ telnet router
+..... do your trace, then exit from the router's telnet session.
+$ exit
+Script done on <date/time>
+----
+
+
+Name Resolution
+---------------
+
+Wireshark will attempt to use reverse name resolution capabilities
+when decoding IPv4 and IPv6 packets.
+
+If you want to turn off name resolution while using Wireshark, start
+Wireshark with the "-n" option to turn off all name resolution (including
+resolution of MAC addresses and TCP/UDP/SMTP port numbers to names), or
+with the "-N mt" option to turn off name resolution for all
+network-layer addresses (IPv4, IPv6, IPX).
+
+You can make that the default setting by opening the Preferences dialog
+box using the Preferences item in the Edit menu, selecting "Name
+resolution", turning off the appropriate name resolution options,
+clicking "Save", and clicking "OK".
+
+
+SNMP
+----
+
+Wireshark can do some basic decoding of SNMP packets; it can also use
+the libsmi library to do more sophisticated decoding, by reading MIB
+files and using the information in those files to display OIDs and
+variable binding values in a friendlier fashion. The configure script
+will automatically determine whether you have the libsmi library on
+your system. If you have the libsmi library but _do not_ want to have
+Wireshark use it, you can run configure with the "--without-libsmi"
+option.
+
+How to Report a Bug
+-------------------
git.samba.org / metze / wireshark / wip.git / blobdiff