NetPeek version 0.0.4
NetPeek is a GUI-based network monitoring and diagnosis tool. It captures
packets from the local network and displays them to the user in two forms:
NetPeek is covered by the terms of a BSD-style Copyright license. See the file LICENSE for details.
Getting NetPeek
Version 0.0.4 of NetPeek can be downloaded from
here.
Changes since previous versions can be found in the ChangeLog file.
Building NetPeek
You will need a fairly complete set of GTK and GNOME libraries to build
NetPeek. I use Red Hat Linux 6.0, which pre-installs all of the necessary
libraries. If you don't have these libraries, then you will need to
download them from http://www.gtk.org and
http://www.gnome.org before
building NetPeek.
Once you have all of the necessary libraries, type the following to build and install it:
By default, the "netpeek" binary will be installed into the directory "/usr/local/bin". This can be changed using the "--prefix" option on "configure". For example, to install into "/opt/local/bin", use the following commands instead:./configure make make install
Running NetPeek./configure --prefix /opt/local make make install
NetPeek and tcpdump
The packet trace file format used by NetPeek is identical to that produced
by "tcpdump". To display a NetPeek-saved packet trace with "tcpdump",
use a command such as the following:
tcpdump -r filename
You can also view packet traces saved by "tcpdump" within NetPeek.
To save a packet trace from "tcpdump", use a command such as the
following:
tcpdump -w filename
Note: by default, "tcpdump" will only capture the first 68 bytes of IP
packets. This is usually not enough to display the full packet details
when you view the packet trace with NetPeek. You may get messages such
as "Truncated Packet" if you attempt to view such trace files. To make
"tcpdump" capture more data, then use the "-s" option as follows:
tcpdump -s 2048 -w filename
New versions of libpcapFirst, change "scanner.l" by modifying the "lex_init" function to read as follows:
The call to "yyrestart" is missing from the original, and is required to allow parsing more than one filter string in NetPeek. You may get "parse error" messages if you don't make this modification.void lex_init(buf) char *buf; { in_buffer = buf; yyrestart(NULL); }
Next, if you are using a Linux system and intend to watch for packets on the loopback device, then you will need to modify the "gen_linktype" function in "gencode.c". Change the "DLT_NULL" case to read as follows:
Without this change, packet filtering won't work at all on the loopback device.case DLT_NULL: /* XXX */ if (proto == ETHERTYPE_IP) #ifdef linux return gen_true(); #else return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET))); #endif else return gen_false();
The version of "libpcap" that is distributed with NetPeek already has these changes.
To Do
The set of packet formatting rules is fairly sparse at the moment.
Contacting the Author
You can contact Rhys Weatherley at the e-mail address
rhys@nyerk.com.
The latest version of NetPeek can be downloaded from
http://www.nyerk.com.