</para>\r
</note>\r
<para>\r
- The name resolution feature can be en-/disabled seperately for the \r
+ The name resolution feature can be en-/disabled separately for the \r
following protocol layers:\r
</para>\r
<section><title>MAC Layer</title>\r
<warning>\r
<title>Warning!</title>\r
<para>\r
- Enabling network name resolution when your DNS server is \r
- unavailable may significantly slow ethereal while it waits \r
- for all of the DNS requests to time out. Use ADNS in that case.\r
+ Enabling network name resolution when your name server is \r
+ unavailable may significantly slow Ethereal while it waits \r
+ for all of the name server requests to time out. Use ADNS in that \r
+ case.\r
</para>\r
</warning> \r
</section>\r
</itemizedlist>\r
</para>\r
<para>\r
- Currently, only two or three Linux distributions ship ethereal, and \r
+ Currently, only two or three Linux distributions ship Ethereal, and \r
they are commonly shipping an out-of-date version. No other versions \r
of UNIX ship Ethereal so far, and Microsoft does not ship it with any \r
version of Windows. For that reason, you will need to know where to \r
<example id="Ch2Ex2">\r
<title>Building and installing libpcap</title>\r
<programlisting>\r
-gzip -dc libpcap-0.5.tar.Z | tar xvf -\r
+gzip -dc libpcap-0.8.3.tar.Z | tar xvf -\r
<much output removed>\r
-cd libpcap_0_5rel2\r
+cd libpcap_0_8_3\r
./configure\r
<much output removed>\r
make\r
</para>\r
</note>\r
<para> \r
- Under Debian you can install ethereal using apt-get. apt-get will\r
+ Under Debian you can install Ethereal using apt-get. apt-get will\r
handle any dependency issues for you. <xref linkend="Ch02Ex5"/> shows \r
how to do this.\r
<example id="Ch02Ex5">\r
</listitem>\r
<listitem>\r
<para>\r
- Change directory to the ethereal source directory.\r
+ Change directory to the Ethereal source directory.\r
</para>\r
</listitem>\r
<listitem>\r
<varlistentry><term><command>Link-layer header type</command></term>\r
<listitem>\r
<para>\r
- Unless you are in the rare case that you will need this, just keep the default.\r
- XXX - insert a better explanation here.\r
+ Unless you are in the rare case that you will need this, just keep \r
+ the default. For a detailed description, see \r
+ <xref linkend="ChCapLinkLayerHeader"/>\r
</para>\r
</listitem>\r
</varlistentry>\r
data that will be captured for each packet, and is \r
sometimes referred to as the <command>snaplen</command>. If disabled, \r
the default is 65535, which will be sufficient for most \r
- protocols. The value should be at least the MTU for the interface \r
- you are capturing on. Some rules of thumb:\r
+ protocols. Some rules of thumb:\r
</para>\r
<itemizedlist>\r
<listitem>\r
<para>\r
- If you are unsure, just keep the default value.\r
+ If you are unsure, just keep the default value.\r
</para>\r
</listitem>\r
<listitem>\r
<para>\r
- You may want to choose a small snapshot length, as it reduces CPU time \r
- for copying packets, less buffer space is required and perhaps fewer \r
- packets dropped if traffic is very heavy.\r
+ If you don't need all of the data in a packet - for example, if you\r
+ only need the link-layer, IP, and TCP headers - you might want to\r
+ choose a small snapshot length, as less CPU time is required for\r
+ copying packets, less buffer space is required for packets, and thus\r
+ perhaps fewer packets will be dropped if traffic is very heavy.\r
</para>\r
</listitem>\r
<listitem>\r
<para>\r
- You may not want a small snapshot length, as you don't get all the \r
- packet data, the stuff you want might be in the part that's \r
- dropped or reassembly might not be possible as required data for it\r
- is missing.\r
+ If you don't capture all of the data in a packet, you might find that\r
+ the packet data you want is in the part that's dropped, or that\r
+ reassembly isn't possible as the data required for reassembly is\r
+ missing.\r
</para>\r
</listitem>\r
</itemizedlist>\r
<listitem>\r
<para>\r
Multiple files only: Switch to the next file, after the given \r
- number of byte(s)/kilobyte(s)/megabyte(s)/gigabyte(s) were \r
+ number of byte(s)/kilobyte(s)/megabyte(s)/gigabyte(s) have been\r
captured. \r
</para>\r
</listitem>\r
<listitem>\r
<para>\r
Multiple files only: Switch to the next file, after the given \r
- number of second(s)/minutes(s)/hours(s)/days(s) expired.\r
+ number of second(s)/minutes(s)/hours(s)/days(s) have elapsed.\r
</para>\r
</listitem>\r
</varlistentry>\r
report context related problems (like a stream error) and keeps information\r
about context related protocols (e.g. where data is exchanged at the \r
establishing phase and only referred to in later packets). \r
- As it keeps these informations only for the loaded file, using one of \r
+ As it keeps these information only for the loaded file, using one of \r
the multiple file modes may cut these contexts, If the establishing phase \r
is saved in one file and the things you would like to see is in another, \r
you might not see some of the valuable context related information.\r
</varlistentry>\r
</variablelist>\r
</section>\r
- \r
+\r
+ <section id="ChCapLinkLayerHeader"><title>Link-layer header type</title>\r
+ <para>\r
+ In the usual case, you won't have to choose this link-layer header type. \r
+ The following paragraphs will describe the exceptional cases, where\r
+ selecting this type is possible, so you will have a guide what to do:\r
+ </para>\r
+ <para>\r
+ If you are capturing on an 802.11 device on some versions of BSD, this \r
+ might offer a choice of "Ethernet" or "802.11". "Ethernet" will cause \r
+ the captured packets to have fake Ethernet headers; "802.11" will cause \r
+ them to have IEEE 802.11 headers. Unless the capture needs to be read by \r
+ an application that doesn't support 802.11 headers, you should select \r
+ "802.11".\r
+ </para>\r
+ <para>\r
+ If you are capturing on an Endace DAG card connected to a synchronous \r
+ serial line, this might offer a choice of "PPP over serial" or \r
+ "Cisco HDLC"; if the protocol on the serial line is PPP, select \r
+ "PPP over serial", and if the protocol on the serial line is Cisco HDLC, \r
+ select "Cisco HDLC".\r
+ </para>\r
+ <para>\r
+ If you are capturing on an Endace DAG card connected to an ATM network, \r
+ this might offer a choide of "RFC 1483 IP-over-ATM" or "Sun raw ATM". \r
+ If the only traffic being captured is RFC 1483 LLC-encapsulated IP, or if \r
+ the capture needs to be read by an application that doesn't support SunATM \r
+ headers, select "RFC 1483 IP-over-ATM", otherwise select "Sun raw ATM".\r
+ </para>\r
+ <para>\r
+ If you are capturing on an Ethernet device, this might offer a choice of \r
+ "Ethernet" or "DOCSIS". If you are capturing traffic from a Cisco Cable \r
+ Modem Termination System that is putting DOCSIS traffic onto the Ethernet \r
+ to be captured, select "DOCSIS", otherwise select "Ethernet".\r
+ </para>\r
+ </section>\r
+\r
<section id="ChCapCaptureFilterSection"><title>Filtering while capturing</title>\r
<para>\r
Ethereal uses the libpcap filter language for capture filters. \r
This is explained in the tcpdump man page, which can be hard to \r
- understand, so it's explained here to some extend.\r
+ understand, so it's explained here to some extent.\r
</para>\r
<para>\r
You enter the capture filter into the Filter field of the Ethereal \r
dissected.\r
</para>\r
<para>\r
- Each protocol has it's own dissector, so dissecting a packet will \r
+ Each protocol has its own dissector, so dissecting a packet will \r
typically involve several dissectors. As Ethereal tries to find the \r
right dissector for each packet (using static "routes" and heuristics \r
"guessing"), it might choose the wrong dissector in your specific \r
This page allows you to select which columns appear in the \r
"Packet List" Pane.\r
</para>\r
+ <note><title>Note!</title>\r
+ <para>\r
+ Unlike all other preference changes, you will have to save the \r
+ preferences and restart Ethereal in order to take column changes to \r
+ take effect! \r
+ </para>\r
+ </note>\r
</section>\r
\r
<section><title>The "User Interface: Font" page</title>\r
<section>\r
<title>Live capture from many different network media</title>\r
<para>\r
- Unlike it's name suggests, Ethereal can capture traffic from \r
+ Unlike its name suggests, Ethereal can capture traffic from \r
some other network media than Ethernet too. Which media types are \r
supported, depends on many things like the operating system you are \r
using. An overview of the supported media types can be found at: \r
</para>\r
<para>\r
You are welcome to call it what you like, as long as you find it \r
- useful, the FAQ gives the official pronounciation as "e-the-real".\r
+ useful. The FAQ gives the official pronounciation as "e-the-real".\r
</para>\r
</section>\r
\r
<section><title>Reporting Crashes on UNIX/Linux platforms</title>\r
<para>\r
When reporting crashes with Ethereal, it is helpful if you supply the \r
- traceback information (beside the informations mentioned in "Reporting \r
+ traceback information (beside the information mentioned in "Reporting \r
Problems").\r
</para>\r
<para>\r
Ethereal uses the open dialog box from the version of the GTK+ \r
toolkit that it's using. This dialog was completely redesigned in \r
the GTK version 2.4. Depending on the installed GTK version, \r
- your dialog box might be looking different. However, as the \r
+ your dialog box might look different. However, as the \r
functionality remains almost the same, much of this description \r
will work with your version of Ethereal.\r
</para>\r
</para>\r
<note><title>Note!</title>\r
<para>\r
- It may not be possible to read some formats dependant on the packet types \r
+ It may not be possible to read some formats dependent on the packet types \r
captured. Ethernet captures are usually supported for most file formats, \r
but other packet types (e.g. token ring packets) may not be possible to \r
read from all file formats.\r
Ethereal uses the open dialog box from the version of the GTK+ \r
toolkit that it's using. This dialog was completely redesigned in \r
the GTK version 2.4. Depending on the installed GTK version, \r
- your dialog box might be looking different. However, as the \r
+ your dialog box might look different. However, as the \r
functionality remains almost the same, much of this description \r
will work with your version of Ethereal.\r
</para>\r
<para>\r
Export packet data into PostScript, much like the format used \r
to print packets.\r
+ <tip><title>Tip!</title>\r
+ <para>\r
+ You can easily convert PostScript files to PDF files using ghostscript.\r
+ For example: export to a file named foo.ps and then call: \r
+ <command>ps2pdf foo.ps</command>\r
+ </para>\r
+ </tip>\r
<figure>\r
<title>The "Export as PostScript File" dialog box</title>\r
<graphic entityref="EtherealExportPSDialog" format="PNG"/>\r
<listitem>\r
<para>\r
<command>Packet summary line</command> enable the output of the \r
- summary line, just like in the "Packet List" pane.\r
+ summary line, just as in the "Packet List" pane.\r
</para>\r
</listitem>\r
<listitem>\r
</para>\r
<section id="ChStatEndpointDefinition"><title>What is an Endpoint?</title>\r
<para>\r
- A network endpoint is the logical endpoint of seperate protocol traffic of \r
+ A network endpoint is the logical endpoint of separate protocol traffic of \r
a specific protocol layer. The endpoint statistics of Ethereal will take \r
the following endpoints into account:\r
</para>\r
<title>The protocol specific "Endpoint List" windows</title>\r
<para>\r
Before the combined window described above was available, each of its \r
- pages were shown as seperate windows. Even as the combined window is \r
- much more convenient to use, these seperate windows are still \r
+ pages were shown as separate windows. Even as the combined window is \r
+ much more convenient to use, these separate windows are still \r
available. The main reason is, they might process faster for \r
very large capture files. However, as the functionality is exactly the \r
same as in the combined window, they won't be discussed in detail here.\r
<title>The protocol specific "Conversation List" windows</title>\r
<para>\r
Before the combined window described above was available, each of its \r
- pages were shown as seperate windows. Even as the combined window is \r
- much more convenient to use, these seperate windows are still \r
+ pages were shown as separate windows. Even as the combined window is \r
+ much more convenient to use, these separate windows are still \r
available. The main reason is, they might process faster for \r
very large capture files. However, as the functionality is exactly the \r
same as in the combined window, they won't be discussed in detail here.\r
<entry><command>Endpoint List</command></entry>\r
<entry></entry>\r
<entry><para>\r
- Display a list of endpoints, obsoleted be the combined window \r
+ Display a list of endpoints, obsoleted by the combined window \r
of Endpoints above, see \r
<xref linkend="ChStatEndpointListWindow"/>.\r
</para></entry>\r
the "Packet Details" and "Packet Bytes" panes.\r
</para>\r
<para>\r
- While dissecting a packet, Ethereal will place informations from the \r
+ While dissecting a packet, Ethereal will place information from the \r
protocol dissectors into the columns. As higher level protocols might\r
overwrite information from lower levels, you will typically see the \r
information from the highest possible level only. \r
<para> \r
For example, let's look at a packet containing TCP inside IP inside\r
an Ethernet packet. The Ethernet dissector will write its data (like the \r
- Ethernet addresses), the IP dissector will overwrite this by it's own \r
+ Ethernet addresses), the IP dissector will overwrite this by its own \r
(like the IP addresses), the TCP dissector will overwrite the IP \r
information and so on.\r
</para>\r
<note>\r
<title>Note!</title>\r
<para>\r
- All filter expressions are entered in lowercase. Also, don't \r
+ All protocol and field names are entered in lowercase. Also, don't \r
forget to press enter after entering the filter expression.\r
</para>\r
</note>\r
<para>\r
Then they use <command>ip.addr != 1.2.3.4</command> to see all packets \r
not containing the IP address 1.2.3.4 in it. Unfortunately, this does \r
- *not* do the expected.\r
+ <command>not</command> do the expected.\r
</para>\r
<para>\r
Instead, that expression will even be true for packets where either\r
<!ENTITY DocumentCopyrightYear "2004">\r
\r
<!ENTITY DocumentEdition "Third ">\r
- <!ENTITY DocumentVersion "V1.91">\r
+ <!ENTITY DocumentVersion "V1.92">\r
<!ENTITY DocumentPubDate "2004">\r
\r
<!ENTITY DocumentLegalNotice "<para>Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts.</para><para>All logos and trademarks in this document are property of their respective owner.</para>">\r
git.samba.org / metze / wireshark / wip.git / commitdiff