-$Id: README,v 1.20 2000/02/17 21:08:14 oabad Exp $
-
Wiretap is a library that is being developed as a future replacement for
libpcap, the current standard Unix library for packet capturing. Libpcap
is great in that it is very platform independent and has a wonderful
BPF optimizing engine. But it has some shortcomings as well. These
-shortcomings came to a head during the development of Ethereal
-(http://ethereal.zing.org), a packet analyzer. As such, I began developing
+shortcomings came to a head during the development of Wireshark
+(http://www.wireshark.org/), a packet analyzer. As such, I began developing
wiretap so that:
1. The library can easily be amended with new packet filtering objects.
Wiretap is very good at reading many file formats, as per #2
above. Wiretap has no filter capability at present; it currently doesn't
support packet capture, so it wouldn't be useful there, and filtering
-when reading a capture file is done by Ethereal, using a more powerful
+when reading a capture file is done by Wireshark, using a more powerful
filtering mechanism than that provided by BPF.
wiretap reads the "libpcap" file format with its own code, rather than
using the "libpcap" library's code to read it.
-Sniffer (uncompressed)
+Sniffer (compressed and uncompressed)
-------
-The Sniffer format is documented in the Sniffer manual. Unfortunately,
-Sniffer manuals tend to document only the format for the Sniffer model
-they document. Token-Ring and ethernet seems to work well, though.
-If you have an ATM Sniffer file, both Guy and Gilbert would be *very*
-interested in receiving a sample. (see 'AUTHORS' file for our e-mail
-addresses).
+The uncompressed Sniffer format is documented in the Sniffer manual.
+Unfortunately, Sniffer manuals tend to document only the format for
+the Sniffer model they document. Token-Ring and ethernet seems to work
+well, though. If you have an ATM Sniffer file, both Guy and Gilbert
+would be *very* interested in receiving a sample. (see 'AUTHORS' file
+for our e-mail addresses).
LANalyzer
---------
# stop capture. subsystem is NS_LS_IP or SX25L2 :
nettl -tf -e subsystem
+One may be able to specify "-tn pduin pduout" rather than
+"-tn 0x30000000"; the nettl man page for HP-UX 10.30 implies that it
+should work.
+
+There is also basic support for nettl files containing NS_LS_DRIVER,
+NS_LS_TCP, NS_LS_UDP, NS_LS_LOOPBACK, unknown type 0xb9, and NS_LS_ICMP.
+However, NS_LS_ICMP will not be decoded since WTAP lacks a raw ICMP
+encapsulation type.
+
+
Toshiba ISDN Router
-------------------
An under-documented command that the router supports in a telnet session
-is "snoop" (not related to the Solaris "snoop" command). If you give it
-the "dump" option, you'll get a hex dump of all packets across the router
-(except of your own telnet session -- good thinking Toshiba!). You can
-select a certain channel to sniff (LAN, B1, B2, D), but the default is all
-channels. You save this hex dump to disk with 'script' or by 'telnet |
-tee'. Wiretap will read the ASCII hex dump and convert it to binary data.
-
-Gilbert Ramirez <gram@xiexie.org>
+is "snoop" (not related to the Solaris "snoop" command). If you give
+it the "dump" option (either by letting "snoop" query you for its next
+argument, or typing "snoop dump" on the command line), you'll get a hex
+dump of all packets across the router (except of your own telnet session
+-- good thinking Toshiba!). You can select a certain channel to sniff
+(LAN, B1, B2, D), but the default is all channels. You save this hex
+dump to disk with 'script' or by 'telnet | tee'. Wiretap will read the
+ASCII hex dump and convert it to binary data.
+
+ISDN4BSD "i4btrace" utility
+---------------------------
+Bert Driehuis
+
+Cisco Secure Intrustion Detection System iplogging facility
+-----------------------------------------------------------
+Mike Hall
+
+pppd logs (pppdump-format files)
+--------------------------------
+Gilbert
+
+VMS TCPTRACE
+------------
+Compaq VMS's TCPIPTRACE format is supported. This is the capture program
+that comes with TCP/IP or UCX as supplied by Compaq or Digital Equipment
+Corporation.
+
+Under UCX 4.x, it is invoked as TCPIPTRACE. Under TCPIP 5.x, it is invoked
+as TCPTRACE.
+
+TCPTRACE produces an ascii text based format, that has changed slightly over
+time.
+
+DBS Etherwatch (text format)
+----------------------------
+Text output from DBS Etherwatch is supported. DBS Etherwatch is available
+from: http://www.users.bigpond.com/dbsneddon/software.htm.
+
+Catapult DCT2000 (.out files)
+-----------------------------
+DCT2000 test systems produce ascii text-based .out files for ports
+that have logging enabled. When being read, the data part of the message is
+prefixed with a short header that provides some context (context+port,
+direction, original timestamp, etc).
+
+You can choose to suppress the reading of non-standard protocols
+(i.e. messages between layers rather than the well-known link-level protocols
+usually found on board ports).
+
+
+Gilbert Ramirez <gram@alumni.rice.edu>
Guy Harris <guy@alum.mit.edu>
+
+STANAG 4607
+-----------
+Initial support for the STANAG 4607 protocol. Documentation at:
+http://www.nato.int/structur/AC/224/standard/4607/4607.htm
+
git.samba.org / metze / wireshark / wip.git / blobdiff