=head1 SYNOPSYS
B<ethereal>
+S<[ B<-a> capture autostop condition ] ...>
+S<[ B<-b> number of ring buffer files ]>
S<[ B<-B> byte view height ]>
S<[ B<-c> count ]>
S<[ B<-f> capture filter expression ]>
S<[ B<-l> ]>
S<[ B<-m> font ]>
S<[ B<-n> ]>
-S<[ B<-N> resolving flags ] ...>
+S<[ B<-N> resolving flags ] >
S<[ B<-o> preference setting ] ...>
S<[ B<-p> ]>
S<[ B<-P> packet list height ]>
S<[ B<-t> time stamp format ]>
S<[ B<-v> ]>
S<[ B<-w> savefile]>
+S<[ infile ]>
=head1 DESCRIPTION
B<Ethereal> is a GUI network protocol analyzer. It lets you
interactively browse packet data from a live network or from a
-previously saved capture file. B<Ethereal> knows how to read B<libpcap>
-capture files, including those of B<tcpdump>. In addition, B<Ethereal>
-can read capture files from B<snoop> (including B<Shomiti>) and
-B<atmsnoop>, B<LanAlyzer>, B<Sniffer> (compressed or uncompressed),
-Microsoft B<Network Monitor>, AIX's B<iptrace>, B<NetXray>, B<Sniffer
-Pro>, B<Etherpeek>, B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend>
-router debug output, HP-UX's B<nettl>, the dump output from B<Toshiba's>
-ISDN routers, the output from B<i4btrace> from the ISDN4BSD project, the
-output in B<IPLog> format from the Cisco Secure Intrusion Detection
-System, and B<pppd logs> (pppdump format). There is no need to tell
+previously saved capture file. B<Ethereal>'s native capture file format
+is B<libpcap> format, which is also the format used by B<tcpdump> and
+various other tools. In addition, B<Ethereal> can read capture files
+from B<snoop> and B<atmsnoop>, Shomiti/Finisar B<Surveyor>, Novell
+B<LANalyzer>, Network General/Network Associates DOS-based B<Sniffer>
+(compressed or uncompressed), Microsoft B<Network Monitor>, AIX's
+B<iptrace>, Cinco Networks B<NetXRay>, Network Associates Windows-based
+B<Sniffer>, AG Group/WildPackets B<EtherPeek> and B<TokenPeek>,
+B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
+HP-UX's B<nettl>, the dump output from B<Toshiba's> ISDN routers, the
+output from B<i4btrace> from the ISDN4BSD project, the output in
+B<IPLog> format from the Cisco Secure Intrusion Detection System, B<pppd
+logs> (pppdump format), the output from VMS's B<TCPIPtrace> utility, the
+text output from the B<DBS Etherwatch> VMS utility, and traffic capture
+files from Visual Networks' Visual UpTime. There is no need to tell
B<Ethereal> what type of file you are reading; it will determine the
file type by itself. B<Ethereal> is also capable of reading any of
these file formats if they are compressed using gzip. B<Ethereal>
If the zlib library is not present, B<Ethereal> will compile, but will
be unable to read compressed files.
+The pathname of a capture file to be read can be specified with the
+B<-r> option or can be specified as a command-line argument.
+
=head1 OPTIONS
=over 4
+=item -a
+
+Specify a criterion that specifies when B<Tethereal> is to stop writing
+to a capture file. The criterion is of the form I<test>B<:>I<value>,
+where I<test> is one of:
+
+=for man .RS
+
+=for html <P><DL>
+
+=item duration
+
+Stop writing to a capture file after I<value> seconds have elapsed.
+
+=item filesize
+
+Stop writing to a capture file after it reaches a size of I<value>
+kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes).
+
+=for man .RE
+
+=for html </DL>
+
+=item -b
+
+If a maximum capture file size was specified, causes B<Ethereal> to run
+in "ring buffer" mode, with the specified number of files. In "ring
+buffer" mode, B<Ethereal> will write to several capture files; the name
+of the first file, while the capture is in progress, will be the name
+specified by the B<-w> flag, and subsequent files with have .I<n>
+appended, with I<n> counting up.
+
+When the first capture file fills up, B<Ethereal> will switch to writing
+to the next file, until it fills up the last file, at which point it'll
+discard the data in the first file and start writing to that file. When
+that file fills up, B<Ethereal> will discard the data in the next file
+and start writing to it, and so on.
+
+When the capture completes, the files will be renamed to have names
+based on the number of the file and on the date and time at which
+packets most recently started being written to the file.
+
=item -B
Sets the initial height of the byte view (bottom) pane.
=item -r
-Reads packet data from I<file>.
+Reads packet data from I<infile>.
=item -R
=item Capture:Start
-Initiates a live packet capture (see L<"Capture Preferences"> below). A
+Initiates a live packet capture (see L<"Capture Options"> below). A
temporary file will be created to hold the capture. The location of the
file can be chosen by setting your TMPDIR environment variable before
starting B<Ethereal>. Otherwise, the default TMPDIR location is
while a live capture is in progress or to enable or disable translation
of addresses to names in the display.
-=item Display:Match Selected
+=item Display:Match
-Creates and applies a display filter based on the data that is currently
-highlighted in the protocol tree. If that data is a field that can be
-tested in a display filter expression, the display filter will test that
-field; otherwise, the display filter will be based on absolute offset
-within the packet, and so could be unreliable if the packet contains
-protocols with variable-length headers, such as a source-routed
-token-ring packet.
+Creates a display filter, or adds to the display filter strip at the
+bottom, a display filter based on the data currently highlighted in the
+protocol tree, and applies the filter.
+
+If that data is a field that can be tested in a display filter
+expression, the display filter will test that field; otherwise, the
+display filter will be based on absolute offset within the packet, and
+so could be unreliable if the packet contains protocols with
+variable-length headers, such as a source-routed token-ring packet.
+
+The B<Selected> option creates a display filter that tests for a match
+of the data; the B<Not Selected> option creates a display filter that
+tests for a non-match of the data. The B<And Selected>, B<Or Selected>,
+B<And Not Selected>, and B<Or Not Selected> options add to the end of
+the display filter in the strip at the bottom an AND or OR operator
+followed by the new display filter expression.
+
+=item Display:Prepare
+
+Creates a display filter, or adds to the display filter strip at the
+bottom, a display filter based on the data currently highlighted in the
+protocol tree, but doesn't apply the filter.
=item Display:Colorize Display
Selecting the I<Filter:> button lets you choose from a list of named
filters that you can optionally save. Pressing the Return or Enter
-keys will cause the filter to be applied to the current list of packets.
-Selecting the I<Reset> button clears the display filter so that all
-packets are displayed.
+keys, or selecting the I<Apply> button, will cause the filter to be
+applied to the current list of packets. Selecting the I<Reset> button
+clears the display filter so that all packets are displayed.
=back
The radio buttons at the top of the I<Printing> page allow you choose
between printing packets with the I<File:Print Packet> menu item as text
or PostScript, and sending the output directly to a command or saving it
-to a file. The I<Command:> text entry box is the command to send files
-to (usually B<lpr>), and the I<File:> entry box lets you enter the name
-of the file you wish to save to. Additionally, you can select the
-I<File:> button to browse the file system for a particular save file.
+to a file. The I<Command:> text entry box, on UNIX-compatible systems,
+is the command to send files to (usually B<lpr>), and the I<File:> entry
+box lets you enter the name of the file you wish to save to.
+Additionally, you can select the I<File:> button to browse the file
+system for a particular save file.
=item Column Preferences
=back
-=item TCP Stream Preferences
+=item TCP Streams Preferences
The I<TCP Streams> page can be used to change the color of the text
displayed in the TCP stream window. To change a color, simply select
an attribute from the "Set:" menu and use the color selector to get the
desired color. The new text colors are displayed in a sample window.
-=item GUI Preferences
+=item User Interface Preferences
-The I<GUI> page is used to modify small aspects of the GUI to your own
-personal taste:
+The I<User Interface> page is used to modify small aspects of the GUI to
+your own personal taste:
=over 6
=item Selection Bars
-The selection bar in the
-packet list and protocol tree can have either a "browse" or "select"
-behavior. If the selection bar has a "browse" behavior, the arrow keys
-will move an outline of the selection bar, allowing you to browse
-the rest of the list or tree without changing the selection
-until you press the space bar. If the selection bar has a "select"
-behavior, the arrow keys will move the selection bar and change
+The selection bar in the packet list and protocol tree can have either a
+"browse" or "select" behavior. If the selection bar has a "browse"
+behavior, the arrow keys will move an outline of the selection bar,
+allowing you to browse the rest of the list or tree without changing the
+selection until you press the space bar. If the selection bar has a
+"select" behavior, the arrow keys will move the selection bar and change
the selection to the new item in the packet list or protocol tree.
+
+=item Tree Line Style
+
+Trees can be drawn with no lines, solid lines, or dotted lines between
+items, or can be drawn with "tab" headings.
+
+=item Tree Expander Style
+
+The expander item that can be clicked to show or hide items under a tree
+item can be omitted (note that this will prevent you from changing
+whether those items are shown or hidden!), or can be drawn as squares,
+triangles, or circles.
+
+=item Hex Display
+
The highlight method in the hex dump display for the selected protocol
item can be set to use either inverse video, or bold characters.
+=item Save Window Position
+
+If this item is selected, the position of the main Ethereal window will
+be saved when Ethereal exits, and used when Ethereal is started again.
+
+=item Save Window Size
+
+If this item is selected, the size of the main Ethereal window will
+be saved when Ethereal exits, and used when Ethereal is started again.
+
=item Fonts
The "Font..." button lets you select the font to be used for most text.
=back
+=item Capture Preferences
+
+The I<Capture> page lets you specify various parameters for capturing
+live packet data; these are used the first time a capture is started.
+
+The I<Interface:> combo box lets you specify the interface from which to
+capture packet data, or the name of a FIFO from which to get the packet
+data. You can specify whether the interface is to be put in promiscuous
+mode or not with the I<Capture packets in promiscuous mode> check box,
+can specify that the display should be updated as packets are captured
+with the I<Update list of packets in real time> check box, and can
+specify whether in such a capture the packet list pane should scroll to
+show the most recently captured packets with the I<Automatic scrolling
+in live capture> check box.
+
=item Protocol Preferences
There are also pages for various protocols that Ethereal dissects,
=item Save
-Saves the current filter list in F<$HOME/.ethereal/cfilters> if the list
-of filters being edited is the list of capture filters or in
-F<$HOME/.ethereal/dfilters> if the list of filters being edited is the
-list of display filters.
+Saves the current filter list in F<$HOME/.ethereal/cfilters> on
+UNIX-compatible systems, and F<%APPDATA%\Ethereal\cfilters> (or, if
+%APPDATA% isn't defined,
+F<%USERPROFILE%\Application Data\Ethereal\cfilters>)
+on Windows systems, if the list of filters being edited is the list of
+capture filters, or in F<$HOME/.ethereal/dfilters> on UNIX-compatible
+systems, and F<%APPDATA%\Ethereal\dfilters> (or, if %APPDATA% isn't
+defined, F<%USERPROFILE%\Application Data\Ethereal\dfilters>) on Windows
+systems, if the list of filters being edited is the list of display
+filters.
=item Close
=back
-=item Capture Preferences
+=item Capture Options
-The I<Capture Preferences> dialog lets you specify various parameters for
+The I<Capture Options> dialog lets you specify various parameters for
capturing live packet data.
The I<Interface:> combo box lets you specify the interface from which to
-capture packet data, or the name of a FIFO from which to get the packet
-data. The I<Count:> entry specifies the number of packets to capture.
-Entering 0 will capture packets indefinitely. The I<Filter:> entry lets
-you specify the capture filter using a tcpdump-style filter string as
-described above. The I<File:> entry specifies the file to save to, as
-in the I<Printer Options> dialog above. You can specify the maximum
-number of bytes to capture per packet with the I<Capture length> entry,
-can specify whether the interface is to be put in promiscuous mode or
-not with the I<Capture packets in promiscuous mode> check box, can
-specify that the display should be updated as packets are captured with
-the I<Update list of packets in real time> check box, can specify
-whether in such a capture the packet list pane should scroll to show the
-most recently captured packets with the I<Automatic scrolling in live
+capture packet data or a command from which to get the packet data via a
+pipe.
+
+The I<Count:> entry specifies the maximum number of packets to capture.
+0 means Ethereal will not stop capturing at some fixed number of
+captured packets.
+
+The I<File size:> entry specifies the maximum size of a capture file, in
+kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes). 0 means
+Ethereal will not stop capturing at some capture file size (although the
+operating system on which Ethereal is running, or the available disk
+space, may still limit the maximum size of a capture file).
+
+The I<Duration:> entry specifies the maximum time over which to capture,
+in seconds. 0 means Ethereal will not stop capturing after some fixed
+time has elapsed.
+
+The I<Filter:> entry lets you specify the capture filter using a
+tcpdump-style filter string as described above.
+
+The I<File:> entry specifies the file to save to, as in the I<Printer
+Options> dialog above.
+
+You can specify the maximum number of bytes to capture per packet with
+the I<Capture length> entry, can specify whether the interface is to be
+put in promiscuous mode or not with the I<Capture packets in promiscuous
+mode> check box, can specify whether Ethereal should run in "ring
+buffer" mode with the I<Use ring buffer> check box and can specify the
+number of files to use with the I<Number of files> spin box, can specify
+that the display should be updated as packets are captured with the
+I<Update list of packets in real time> check box, can specify whether in
+such a capture the packet list pane should scroll to show the most
+recently captured packets with the I<Automatic scrolling in live
capture> check box, and can specify whether addresses should be
-translated to names in the display with the I<Enable MAC name resolution>,
-I<Enable network name resolution> and I<Enable transport name resolution>
-check boxes.
+translated to names in the display with the I<Enable MAC name
+resolution>, I<Enable network name resolution> and I<Enable transport
+name resolution> check boxes.
=item Display Options
The I<Plugins List> shows the name and version of each dissector plugin
module found on your system. The plugins are searched in the following
-directories: F</usr/share/ethereal/plugins>,
-F</usr/local/share/ethereal/plugins> and F<~/.ethereal/plugins>. Note
-that a dissector plugin module may support more than one protocol; there
-is not necessarily a one-to-one correspondence between dissector plugin
-modules and protocols. Protocols supported by a dissector plugin module
-are enabled and disabled using the I<Edit:Protocols> dialog box, just as
+directories: the F<lib/ethereal/plugins/$VERSION> directory under the
+main installation directory (for example,
+F</usr/local/lib/ethereal/plugins/$VERSION>),
+F</usr/lib/ethereal/plugins/$VERSION>,
+F</usr/local/lib/ethereal/plugins/$VERSION>, and
+F<$HOME/.ethereal/plugins> on UNIX-compatible systems, and in the
+F<plugins\$VERSION> directory under the main installation directory (for
+example, F<C:\Program Files\Ethereal\plugins\$VERSION>) and
+F<%APPDATA%\Ethereal\plugins\$VERSION> (or, if %APPDATA% isn't defined,
+F<%USERPROFILE%\Application Data\Ethereal\plugins\$VERSION>) on Windows
+systems; $VERSION is the version number of the plugin interface, which
+is typically the version number of Ethereal. Note that a dissector
+plugin module may support more than one protocol; there is not
+necessarily a one-to-one correspondence between dissector plugin modules
+and protocols. Protocols supported by a dissector plugin module are
+enabled and disabled using the I<Edit:Protocols> dialog box, just as
protocols built into Ethereal are.
=head1 CAPTURE FILTER SYNTAX
=head1 FILES
-F</usr/local/etc/ethereal.conf> and F<$HOME/.ethereal/preferences>
-contain system-wide and personal preference settings, respectively. The
-file contains preference settings of the form I<prefname>B<:>I<value>,
-one per line, where I<prefname> is the name of the preference (which is
-the same name that would appear in the preference file), and I<value> is
-the value to which it should be set; white space is allowed between B<:>
-and I<value>. A preference setting can be continued on subsequent lines
-by indenting the continuation lines with white space. A B<#> character
-starts a comment that runs to the end of the line.
+The F<ethereal.conf> file, which is installed in the F<etc> directory
+under the main installation directory (for example, F</usr/local/etc>)
+on UNIX-compatible systems, and in the main installation directory (for
+example, F<C:\Program Files\Ethereal>) on Windows systems, and the
+personal preferences file, which is F<$HOME/.ethereal/preferences> on
+UNIX-compatible systems and F<%APPDATA%\Ethereal\preferences> (or, if
+%APPDATA% isn't defined,
+F<%USERPROFILE%\Application Data\Ethereal\preferences>) on
+Windows systems, contain system-wide and personal preference settings,
+respectively. The file contains preference settings of the form
+I<prefname>B<:>I<value>, one per line, where I<prefname> is the name of
+the preference (which is the same name that would appear in the
+preference file), and I<value> is the value to which it should be set;
+white space is allowed between B<:> and I<value>. A preference setting
+can be continued on subsequent lines by indenting the continuation lines
+with white space. A B<#> character starts a comment that runs to the
+end of the line.
The system-wide preference file is read first, if it exists, overriding
B<Ethereal>'s default values; the personal preferences file is then
system-wide preference file.
Note that whenever the preferences are saved by using the I<Save> button
-in the I<Edit:Preferences> dialog box, F<$HOME/.ethereal/preferences>
+in the I<Edit:Preferences> dialog box, your personal preferences file
will be overwritten with the new settings, destroying any comments that
were in the file.
-F</etc/ethers> is consulted to correlate 6-byte hardware addresses to
-names. If an address is not found in F</etc/ethers>, the
-F<$HOME/.ethereal/ethers> file is consulted next. Each line contains
-one hardware address and name, separated by whitespace. The digits of
-the hardware address are separated by either a colon (:), a dash (-), or
-a period (.). The following three lines are valid lines of an ethers
-file:
+The F<ethers> file, which is found in the F</etc> directory on
+UNIX-compatible systems, and in the main installation directory (for
+example, F<C:\Program Files\Ethereal>) on Windows systems, is consulted
+to correlate 6-byte hardware addresses to names. If an address is not
+found in the F<ethers> file, the F<$HOME/.ethereal/ethers> file on
+UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ethers> file (or, if
+%APPDATA% isn't defined, the
+F<%USERPROFILE%\Application Data\Ethereal\ethers> file) on Windows
+systems is consulted next. Each line contains one hardware
+address and name, separated by whitespace. The digits of the hardware
+address are separated by either a colon (:), a dash (-), or a period
+(.). The following three lines are valid lines of an ethers file:
ff:ff:ff:ff:ff:ff Broadcast
c0-00-ff-ff-ff-ff TR_broadcast
00.00.00.00.00.00 Zero_broadcast
-F</usr/local/etc/manuf> matches the 3-byte vendor portion of a 6-byte
-hardware address with the manufacturer's name. The format of the file
-is the same as the F</etc/ethers> file, except that each address is
-three bytes instead of six.
-
-F</etc/ipxnets> and F<$HOME/.ethereal/ipxnets> correlate 4-byte IPX
-network numbers to names. The format is the same as the F</etc/ethers>
-file, except that each address if four bytes instead of six.
+The F<manuf> file, which is installed in the F<etc> directory under the
+main installation directory (for example, F</usr/local/etc>) on
+UNIX-compatible systems, and in the main installation directory (for
+example, F<C:\Program Files\Ethereal>) on Windows systems, matches the
+3-byte vendor portion of a 6-byte hardware address with the
+manufacturer's name. The format of the file is the same as the
+F<ethers> file, except that each address is three bytes instead of six.
+
+The F<ipxnets> file, which is found in the F</etc> directory on
+UNIX-compatible systems, and in the main installation directory (for
+example, F<C:\Program Files\Ethereal>) on Windows systems, correlates
+4-byte IPX network numbers to names. If a network number is not found
+in the F<ipxnets> file, the F<$HOME/.ethereal/ipxnets> file on
+UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ipxnets> file (or,
+if %APPDATA% isn't defined, the
+F<%USERPROFILE%\Application Data\Ethereal\ipxnets> file)
+on Windows systems, is consulted next. The format is the same as the
+F<ethers> file, except that each address if four bytes instead of six.
Additionally, the address can be represented a single hexadecimal
number, as is more common in the IPX world, rather than four hex octets.
For example, these four lines are valid lines of an ipxnets file.
Contributors
------------
- Gilbert Ramirez <gram[AT]xiexie.org>
+ Gilbert Ramirez <gram[AT]alumni.rice.edu>
Hannes R. Boehm <hannes[AT]boehm.org>
Mike Hall <mlh[AT]io.com>
Bobo Rajec <bobo[AT]bsp-consulting.sk>
Kevin Shi <techishi[AT]ms22.hinet.net>
Mike Frisch <mfrisch[AT]saturn.tlug.org>
Burke Lau <burke_lau[AT]agilent.com>
- Martti Kuparinen <martti.kuparinen[AT]nomadiclab.com>
+ Martti Kuparinen <martti.kuparinen[AT]iki.fi>
David Hampton <dhampton[AT]mac.com>
Kent Engström <kent[AT]unit.liu.se>
Ronnie Sahlberg <rsahlber[AT]bigpond.net.au>
Randy McEoin <rmceoin[AT]pe.net>
Edgar Iglesias <edgar.iglesias[AT]axis.com>
Martina Obermeier <Martina.Obermeier[AT]icn.siemens.de>
- Mark Burton <markb[AT]ordern.com>
Javier Achirica <achirica[AT]ttd.net>
B. Johannessen <bob[AT]havoq.com>
Thierry Pelle <thierry.pelle[AT]rd.francetelecom.fr>
Terje Krogdahl <tekr[AT]nextra.com>
Jean-Francois Mule <jfmule[AT]clarent.com>
Thomas Wittwer <thomas.wittwer[AT]iclip.ch>
+ Matthias Nyffenegger <matthias.nyffenegger[AT]iclip.ch>
Palle Lyckegaard <Palle[AT]lyckegaard.dk>
+ Nicolas Balkota <balkota[AT]mac.com>
+ Tom Uijldert <Tom.Uijldert[AT]cmg.nl>
+ Endoh Akira <endoh[AT]netmarks.co.jp>
+ Graeme Hewson <graeme.hewson[AT]oracle.com>
+ Pasi Eronen <pasi.eronen[at]nixu.com>
+ Georg von Zezschwitz <gvz[AT]2scale.net>
+ Steffen Weinreich <steve[AT]weinreich.org>
+ Marc Milgram <mmilgram[AT]arrayinc.com>
+ Gordon McKinney <gordon[AT]night-ray.com>
+ Tim Farley <tfarley[AT]iss.net>
+ Daniel Thompson <daniel.thompson[AT]st.com>
+ Chris Jepeway <thai-dragon[AT]eleven29.com>
+ Pavel Novotny <Pavel.Novotny[AT]icn.siemens.de>
+ Shinsuke Suzuki <suz[AT]kame.net>
+ Andrew C. Feren <aferen[AT]cetacean.com>
+ Tomas Kukosa <tomas.kukosa[AT]anfdata.cz>
+ Andreas Stockmeier <a.stockmeier[AT]avm.de>
+ Pekka Nikander <pekka.nikander[AT]nomadiclab.com>
+ Hamish Moffatt <hamish[AT]cloud.net.au>
+ Kazushi Sugyo <k-sugyou[AT]nwsl.mesh.ad.jp>
+ Tim Potter <tpot[AT]samba.org>
+ Raghu Angadi <rangadi[AT]inktomi.com>
+ Taisuke Sasaki <sasaki[AT]soft.net.fujitsu.co.jp>
+ Tim Newsham <newsham[AT]lava.net>
+ Tom Nisbet <Tnisbet[AT]VisualNetworks.com>
+ Darren New <dnew[AT]san.rr.com>
+ Pavel Mores <pvl[AT]uh.cz>
+ Bernd Becker <bb[AT]bernd-becker.de>
+ Heinz Prantner <Heinz.Prantner[AT]radisys.com>
+ Irfan Khan <ikhan[AT]qualcomm.com>
+ Jayaram V.R <vjayar[AT]cisco.com>
+ Dinesh Dutt <ddutt[AT]cisco.com>
+ Nagarjuna Venna <nvenna[AT]Brixnet.com>
+ Jirka Novak <j.novak[AT]netsystem.cz>
+ Ricardo Barroetaveña <rbarroetavena[AT]veufort.com>
+ Alan Harrison <alanharrison[AT]mail.com>
Alain Magloire <alainm[AT]rcsm.ece.mcgill.ca> was kind enough to give his
permission to use his version of snprintf.c.
git.samba.org / obnox / wireshark / wip.git / blobdiff