You can start Ethereal from the command line, but it can also be started from most Window managers as well. In this section we will look at starting it from the command line.
Ethereal supports a large number of command line parameters. To see what they are, simply enter the command ethereal -h and the help information shown in Example 9.1, “Help information available from Ethereal” (or something similar) should be printed.
Example 9.1. Help information available from Ethereal
This is GNU ethereal 0.10.11 (C) 1998-2005 Gerald Combs <gerald@ethereal.com> Compiled with GTK+ 2.4.14, with GLib 2.4.7, with WinPcap (version unknown), with libz 1.2.2, with libpcre 4.4, with Net-SNMP 5.1.2, with ADNS. Running with WinPcap version 3.1 beta4 (packet.dll version 3, 1, 0, 24), based o n libpcap version 0.8.3 on Windows XP Service Pack 1, build 2600. ethereal [ -vh ] [ -klLnpQS ] [ -a <capture autostop condition> ] ... [ -b <capture ring buffer option> ] ...] [ -B capture buffer size (Win32 only) ] [ -c <capture packet count> ] [ -f <capture filter> ] [ -g <packet number> ] [ -i <capture interface> ] [ -m <font> ] [ -N <name resolving flags> ] [ -o <preference/recent setting> ] ... [ -r <infile> ] [ -R <read (display) filter> ] [ -s <capture snaplen> ] [ -t <time stamp format> ] [ -w <savefile> ] [ -y <capture link type> ] [ -z <statistics> ] [ <infile> ]
We will examine each of the command line options in turn.
The first thing to notice is that issuing the command ethereal by itself will bring up Ethereal. However, you can include as many of the command line parameters as you like. Their meanings are as follows ( in alphabetical order ): XXX - is the alphabetical order a good choice? Maybe better task based?
Specify a criterion that specifies when Ethereal is to stop writing to a capture file. The criterion is of the form test:value, where test is one of:
Stop writing to a capture file after value of seconds have elapsed.
Stop writing to a capture file after it reaches a size of value kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes). If this option is used together with the -b option, Ethereal will stop writing to the current capture file and switch to the next one if filesize is reached.
Stop writing to capture files after value number of files were written.
If a maximum capture file size was specified, cause Ethereal to run in "ring buffer" mode, with the specified number of files. In "ring buffer" mode, Ethereal will write to several capture files. Their name is based on the number of the file and on the creation date and time.
When the first capture file fills up, Ethereal will switch to writing to the next file, until it fills up the last file, at which point it'll discard the data in the first file (unless 0 is specified, in which case, the number of files is unlimited) and start writing to that file and so on.
If the optional duration is specified, Ethereal will switch also to the next file when the specified number of seconds has elapsed even if the current file is not completely fills up.
Switch to the next file after value seconds have elapsed, even if the current file is not completely filled up.
Switch to the next file after it reaches a size of value kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes).
Begin again with the first file after value number of files were written (form a ring buffer).
Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the the capture driver to buffer packet data until that data can be written to disk. If you encounter packet drops while capturing, try to increase this size.
This option specifies the maximum number of packets to capture when capturing live data. It would be used in conjunction with the -k option.
This option sets the initial capture filter expression to be used when capturing packets.
After reading in a capture file using the -r flag, go to the given packet number.
The -h option requests Ethereal to print its version and usage instructions (as shown above) and exit.
The -i option allows you to specify, from the command line, which interface packet capture should occur on if capturing packets.
An example would be: ethereal -i eth0.
To get a listing of all the interfaces you can capture on, use the command ifconfig -a or netstat -i. Unfortunately, some versions of UNIX do not support ifconfig -a, so you will have to use netstat -i in these cases.
The -k option specifies that Ethereal should start capturing packets immediately. This option requires the use of the -i parameter to specify the interface that packet capture will occur from.
This option turns on automatic scrolling if the packet list pane is being updated automatically as packets arrive during a capture ( as specified by the -S flag).
List the data link types supported by the interface and exit.
This option sets the name of the font used for most text displayed by Ethereal. XXX - add an example!
Disable network object name resolution (such as hostname, TCP and UDP port names).
Turns on name resolving for particular types of addresses and port numbers; the argument is a string that may contain the letters m to enable MAC address resolution, n to enable network address resolution, and t to enable transport-layer port number resolution. This overrides -n if both -N and -n are present. The letter C enables concurrent (asynchronous) DNS lookups.
Sets a preference or recent value, overriding the default value and any value read from a preference/recent file. The argument to the flag is a string of the form prefname:value, where prefname is the name of the preference (which is the same name that would appear in the preference/recent file), and value is the value to which it should be set. Multiple instances of -o <preference settings> can be given on a single command line.
An example of setting a single preference would be:
ethereal -o mgcp.display_dissect_tree:TRUE
An example of setting multiple preferences would be:
ethereal -o mgcp.display_dissect_tree:TRUE -o mgcp.udp.callagent_port:2627
![]() | Tip! |
---|---|
You can get a list of all available preference strings from the preferences file, see Appendix A, Configuration (and other) Files and Folders. |
Don't put the interface into promiscuous mode. Note that the interface might be in promiscuous mode for some other reason; hence, -p cannot be used to ensure that the only traffic that is captured is traffic sent to or from the machine on which Ethereal is running, broadcast traffic, and multicast traffic to addresses received by that machine.
This option forces Ethereal to exit when capturing is complete. It can be used with the -c option. It must be used in conjunction with the -i and -w options.
This option provides the name of a capture file for Ethereal to read and display. This capture file can be in one of the formats Ethereal understands.
This option specifies a display filter to be applied when reading packets from a capture file. The syntax of this filter is that of the display filters discussed in Section 6.2, “Filtering packets while viewing”. Packets not matching the filter are discarded.
This option specifies the snapshot length to use when capturing packets. Ethereal will only capture <snaplen> bytes of data for each packet.
This option specifies that Ethereal will display packets as it captures them. This is done by capturing in one process and displaying them in a separate process. This is the same as "Update list of packets in real time" in the Capture Options dialog box.
This option sets the format of packet timestamps that are displayed in the packet list window. The format can be one of:
r relative, which specifies timestamps are displayed relative to the first packet captured.
a absolute, which specifies that actual times be displayed for all packets.
ad absolute with date, which specifies that actual dates and times be displayed for all packets.
d delta, which specifies that timestamps are relative to the previous packet.
The -v option requests Ethereal to print out its version information and exit.
This option sets the name of the savefile to be used when saving a capture file.
If a capture is started from the command line with -k, set the data link type to use while capturing packets. The values reported by -L are the values that can be used.
Get Ethereal to collect various types of statistics and display the result in a window that updates in semi-real time. XXX - add more details here!