Ethereal User's Guide

V2.0.2 (15155) for Ethereal 0.10.12

Richard Sharpe

NS Computer Software and Services P/L

Ed Warnicke


Ulf Lamping


Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.

All logos and trademarks in this document are property of their respective owner.


Table of Contents

Preface
1. Foreword
2. Who should read this document?
3. Acknowledgements
4. About this document
5. Where to get the latest copy of this document?
6. Providing feedback about this document
1. Introduction
1.1. What is Ethereal?
1.1.1. Some intended purposes
1.1.2. Features
1.1.3. Live capture from many different network media
1.1.4. Import files from many other capture programs
1.1.5. Export files for many other capture programs
1.1.6. Many protocol decoders
1.1.7. Open Source Software
1.1.8. What Ethereal is not
1.2. Platforms Ethereal runs on
1.2.1. Unix
1.2.2. Linux
1.2.3. Microsoft Windows
1.3. Where to get Ethereal?
1.4. A rose by any other name
1.5. A brief history of Ethereal
1.6. Development and maintenance of Ethereal
1.7. Reporting problems and getting help
1.7.1. Website
1.7.2. Wiki
1.7.3. FAQ
1.7.4. Mailing Lists
1.7.5. Reporting Problems
1.7.6. Reporting Crashes on UNIX/Linux platforms
1.7.7. Reporting Crashes on Windows platforms
2. Building and Installing Ethereal
2.1. Introduction
2.2. Obtaining the source and binary distributions
2.3. Before you build Ethereal under UNIX
2.4. Building Ethereal from source under UNIX
2.5. Installing the binaries under UNIX
2.5.1. Installing from rpm's under RedHat and alike
2.5.2. Installing from deb's under Debian
2.6. Troubleshooting during the install on Unix
2.7. Building from source under Windows
2.8. Installing Ethereal under Windows
2.8.1. Ethereal Installer
2.8.2. Ethereal Installer Settings
2.8.3. Install WinPcap
2.8.4. Update
2.8.5. Uninstall Ethereal
3. User Interface
3.1. Introduction
3.2. Start Ethereal
3.3. The Main window
3.4. The Menu
3.5. The "File" menu
3.6. The "Edit" menu
3.7. The "View" menu
3.8. The "Go" menu
3.9. The "Capture" menu
3.10. The "Analyze" menu
3.11. The "Statistics" menu
3.12. The "Help" menu
3.13. The "Main" toolbar
3.14. The "Filter" toolbar
3.15. The "Packet List" pane
3.16. The "Packet Details" pane
3.17. The "Packet Bytes" pane
3.18. The Statusbar
4. Capturing Live Network Data
4.1. Introduction
4.2. Prerequisites
4.3. Start Capturing
4.4. The "Capture Interfaces" dialog box
4.5. The "Capture Options" dialog box
4.5.1. Capture frame
4.5.2. Capture File(s) frame
4.5.3. Stop Capture... frame
4.5.4. Display Options frame
4.5.5. Name Resolution frame
4.5.6. Buttons
4.6. Capture files and file modes
4.7. Link-layer header type
4.8. Filtering while capturing
4.9. While a Capture is running ...
4.9.1. Stop the running capture
4.9.2. Restart a running capture
5. File Input / Output and Printing
5.1. Introduction
5.2. Open capture files
5.2.1. The "Open Capture File" dialog box
5.2.2. Input File Formats
5.3. Saving captured packets
5.3.1. The "Save Capture File As" dialog box
5.3.2. Output File Formats
5.4. Merging capture files
5.4.1. The "Merge with Capture File" dialog box
5.5. File Sets
5.5.1. The "List Files" dialog box
5.6. Exporting data
5.6.1. The "Export as Plain Text File" dialog box
5.6.2. The "Export as PostScript File" dialog box
5.6.3. The "Export as CSV (Comma Seperated Values) File" dialog box
5.6.4. The "Export as PSML File" dialog box
5.6.5. The "Export as PDML File" dialog box
5.6.6. The "Export selected packet bytes" dialog box
5.7. Printing packets
5.7.1. The "Print" dialog box
5.8. The Packet Range frame
5.9. The Packet Format frame
6. Working with captured packets
6.1. Viewing packets you have captured
6.2. Filtering packets while viewing
6.3. Building display filter expressions
6.3.1. Display filter fields
6.3.2. Comparing values
6.3.3. Combining expressions
6.3.4. A common mistake
6.4. The "Filter Expression" dialog box
6.5. Defining and saving filters
6.6. Finding packets
6.6.1. The "Find Packet" dialog box
6.6.2. The "Find Next" command
6.6.3. The "Find Previous" command
6.7. Go to a specific packet
6.7.1. The "Go Back" command
6.7.2. The "Go Forward" command
6.7.3. The "Go to Packet" dialog box
6.7.4. The "Go to Corresponding Packet" command
6.7.5. The "Go to First Packet" command
6.7.6. The "Go to Last Packet" command
6.8. Marking packets
6.9. Time display formats and time references
6.9.1. Packet time referencing
7. Advanced Features
7.1. Introduction
7.2. Following TCP streams
7.2.1. The "Follow TCP stream" dialog box
7.3. Packet Reassembling
7.3.1. What is it?
7.3.2. How Ethereal handles it
7.3.3. Reassembling is disabled by default!
7.4. Name Resolution
7.4.1. Ethernet name resolution (MAC layer)
7.4.2. IP name resolution (network layer)
7.4.3. IPX name resolution (network layer)
7.4.4. TCP/UDP port name resolution (transport layer)
8. Statistics
8.1. Introduction
8.2. The "Summary" window
8.3. The "Protocol Hierarchy" window
8.4. Endpoints
8.4.1. What is an Endpoint?
8.4.2. The "Endpoints" window
8.4.3. The protocol specific "Endpoint List" windows
8.5. Conversations
8.5.1. What is a Conversation?
8.5.2. The "Conversations" window
8.5.3. The protocol specific "Conversation List" windows
8.6. The "IO Graphs" window
8.7. Service Response Time
8.7.1. The "Service Response Time DCE-RPC" window
8.8. The protocol specific statistics windows
9. Customizing Ethereal
9.1. Introduction
9.2. Start Ethereal from the command line
9.3. Packet colorization
9.4. Control Protocol dissection
9.4.1. The "Enabled Protocols" dialog box
9.4.2. User Specified Decodes
9.4.3. Show User Specified Decodes
9.5. Preferences
A. Configuration (and other) Files and Folders
A.1. Windows folders
A.1.1. Windows profiles
A.1.2. Windows NT/2000/XP roaming profiles
A.1.3. Windows temporary folder
B. Protocols and Protocol Fields
C. Related command line tools
C.1. Introduction
C.2. tcpdump: Capturing with tcpdump for viewing with Ethereal
C.3. tethereal: Terminal-based Ethereal
C.4. capinfos: Print information about capture files
C.5. editcap: Edit capture files
C.6. mergecap: Merging multiple capture files into one
C.7. text2pcap: Converting ASCII hexdumps to network captures
C.8. idl2eth: Creating dissectors from Corba IDL files
C.8.1. What is it?
C.8.2. Why do this?
C.8.3. How to use idl2eth
C.8.4. TODO
C.8.5. Limitations
C.8.6. Notes
D. This Document's License (GPL)

List of Figures

1.1. Ethereal captures packets and allows you to examine their content.
3.1. The Main window
3.2. The Menu
3.3. The "File" Menu
3.4. The "Edit" Menu
3.5. The "View" Menu
3.6. The "Go" Menu
3.7. The "Capture" Menu
3.8. The "Analyze" Menu
3.9. The "Statistics" Menu
3.10. The "Help" Menu
3.11. The "Main" toolbar
3.12. The "Filter" toolbar
3.13. The "Packet List" pane
3.14. The "Packet Details" pane
3.15. The "Packet Bytes" pane
3.16. The "Packet Bytes" pane with tabs
3.17. The initial Statusbar
3.18. The Statusbar with a loaded capture file
3.19. The Statusbar with a selected protocol field
4.1. The "Capture Interfaces" dialog box
4.2. The "Capture Options" dialog box
4.3. The "Capture Info" dialog box
5.1. The "Open Capture File" Dialog box
5.2. The "Save Capture File As" dialog box
5.3. The "Merge with Capture File" dialog box
5.4. The "Export as Plain Text File" dialog box
5.5. The "Export as PostScript File" dialog box
5.6. The "Export as PSML File" dialog box
5.7. The "Export as PDML File" dialog box
5.8. The "Export Selected Packet Bytes" dialog box
5.9. The "Print" dialog box
5.10. The "Packet Range" frame
5.11. The "Packet Format" frame
6.1. Ethereal with a TCP packet selected for viewing
6.2. Viewing a packet in a separate window
6.3. Pop-up menu of "Packet List" pane
6.4. Pop-up menu of "Packet Details" pane
6.5. Pop-up menu of "Packet Bytes" pane
6.6. Filtering on the TCP protocol
6.7. The "Filter Expression" dialog box
6.8. The "Capture Filters" and "Display Filters" dialog boxes
6.9. The "Find Packet" dialog box
6.10. The "Go To Packet" dialog box
6.11. Ethereal showing a time referenced packet
7.1. The "Follow TCP Stream" dialog box
8.1. The "Summary" window
8.2. The "Protocol Hierarchy" window
8.3. The "Endpoints" window
8.4. The "Conversations" window
8.5. The "IO Graphs" window
8.6. The "Compute DCE-RPC statistics" window
8.7. The "DCE-RPC Statistic for ..." window
9.1. The "Coloring Rules" dialog box
9.2. The "Edit Color Filter" dialog box
9.3. The "Choose color" dialog box
9.4. Using color filters with Ethereal
9.5. The "Enabled Protocols" dialog box
9.6. The "Decode As" dialog box
9.7. The "Decode As: Show" dialog box
9.8. The preferences dialog box

List of Tables

3.1. File menu items
3.2. Edit menu items
3.3. View menu items
3.4. Go menu items
3.5. Capture menu items
3.6. Analyze menu items
3.7. Statistics menu items
3.8. Help menu items
3.9. Main toolbar items
4.1. Capture file mode selected by capture options
6.1. Function overview of the pop-up menus
6.2. Display Filter comparison operators
6.3. Display Filter Field Types
6.4. Display Filter Logical Operations
A.1. Configuration files and folders overview

List of Examples

2.1. Building GTK+ from source
2.2. Building and installing libpcap
2.3. Errors while installing the libpcap include files
2.4. Installing required RPMs under RedHat Linux 6.2 and beyond
2.5. Installing debs under Debian
4.1. A capture filter for telnet than captures traffic to and from a particular host
4.2. Capturing all telnet traffic not from 10.0.0.5
9.1. Help information available from Ethereal
C.1. Help information available from capinfos
C.2. Help information available from editcap
C.3. Help information available from mergecap
C.4. Simple example of using mergecap
C.5. Help information available for text2pcap