NetPeek version 0.0.4

NetPeek is a GUI-based network monitoring and diagnosis tool. It captures packets from the local network and displays them to the user in two forms:

NetPeek is based around the "libpcap" packet capture library from the Lawrence Berkeley National Laboratory's Network Resource Group, which is also used by "tcpdump". A version of the library is included with this distribution in the "libpcap-0.4" directory. The latest version can be obtained from the FTP site ftp.ee.lbl.gov. If you wish to use a different version of "libpcap", then you will need to make the modifications listed in the section "New versions of libpcap" below.

NetPeek is covered by the terms of a BSD-style Copyright license. See the file LICENSE for details.

Getting NetPeek

Version 0.0.4 of NetPeek can be downloaded from here.

Changes since previous versions can be found in the ChangeLog file.

Building NetPeek

You will need a fairly complete set of GTK and GNOME libraries to build NetPeek. I use Red Hat Linux 6.0, which pre-installs all of the necessary libraries. If you don't have these libraries, then you will need to download them from http://www.gtk.org and http://www.gnome.org before building NetPeek.

Once you have all of the necessary libraries, type the following to build and install it:

./configure
make
make install
By default, the "netpeek" binary will be installed into the directory "/usr/local/bin". This can be changed using the "--prefix" option on "configure". For example, to install into "/opt/local/bin", use the following commands instead:
./configure --prefix /opt/local
make
make install
Running NetPeek

Because NetPeek needs to capture packets off the network, you will need to be root when you run the program. If you save packet traces from NetPeek, then you can view them with NetPeek as a regular non-root user.

NetPeek and tcpdump

The packet trace file format used by NetPeek is identical to that produced by "tcpdump". To display a NetPeek-saved packet trace with "tcpdump", use a command such as the following:

tcpdump -r filename
You can also view packet traces saved by "tcpdump" within NetPeek. To save a packet trace from "tcpdump", use a command such as the following:
tcpdump -w filename
Note: by default, "tcpdump" will only capture the first 68 bytes of IP packets. This is usually not enough to display the full packet details when you view the packet trace with NetPeek. You may get messages such as "Truncated Packet" if you attempt to view such trace files. To make "tcpdump" capture more data, then use the "-s" option as follows:
tcpdump -s 2048 -w filename
New versions of libpcap

If you download a new version of "libpcap", then you will need to make some modifications to the code to make it work with NetPeek.

First, change "scanner.l" by modifying the "lex_init" function to read as follows:

void
lex_init(buf)
        char *buf;
{
        in_buffer = buf;
        yyrestart(NULL);
}
The call to "yyrestart" is missing from the original, and is required to allow parsing more than one filter string in NetPeek. You may get "parse error" messages if you don't make this modification.

Next, if you are using a Linux system and intend to watch for packets on the loopback device, then you will need to modify the "gen_linktype" function in "gencode.c". Change the "DLT_NULL" case to read as follows:

    case DLT_NULL:
    /* XXX */
    if (proto == ETHERTYPE_IP)
#ifdef linux
        return gen_true();
#else
        return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET)));
#endif
    else
        return gen_false();
Without this change, packet filtering won't work at all on the loopback device.

The version of "libpcap" that is distributed with NetPeek already has these changes.

To Do

The set of packet formatting rules is fairly sparse at the moment.

Contacting the Author

You can contact Rhys Weatherley at the e-mail address rhys@nyerk.com. The latest version of NetPeek can be downloaded from http://www.nyerk.com.