Beyond Linux From Scratch - Version 6.1

Chapter 19. Basic Networking Utilities

Ethereal-0.10.12

Introduction to Ethereal

The Ethereal package contains a network protocol analyzer, also known as a “sniffer”. This is useful for analyzing data captured “off the wire” from a live network connection, or data read from a capture file. Ethereal provides both GUI and TTY-mode programs for examining captured network packets from over 500 protocols, as well as the capability to read capture files from many other popular network analyzers.

Package Information

Ethereal dependencies

Required

GLib-1.2.10 or GLib-2.6.4 (to build the TTY-mode front-end only)

Recommended

libpcap-0.9.3 (required to capture data)

Optional

pkg-config-0.19, GTK+-1.2.10 or GTK+-2.6.7 (to build the GUI front-end), OpenSSL-0.9.7g, Heimdal-0.7 or MIT krb5-1.4.1, Python-2.4.1, PCRE-6.1, Net-SNMP and adns

Optional (to build additional documentation)

Doxygen-1.4.3, libxml-1.8.17, libxslt-1.1.14, FOP-0.20.5

Kernel Configuration

The kernel must have the Packet protocol enabled for Ethereal to capture live packets from the network. Enable the Packet protocol by choosing “Y” in the “Device Drivers” – “Networking support” – “Networking options” – “Packet socket” configuration parameter. Alternatively, build the af_packet module by choosing “M” in this parameter.

Installation of Ethereal

Install Ethereal by running the following commands: 

./configure --prefix=/usr --sysconfdir=/etc --enable-threads &&
make

This package does not come with a test suite.

Now, as the root user: 

make install &&
install -v -m644 doc/README.* /usr/share/ethereal &&
install -v -m644 -D ethereal.desktop \
    /usr/share/applications/ethereal.desktop &&
install -v -m644 -D image/elogo3d48x48.png \
    /usr/share/pixmaps/ethereal.png &&
install -v -m755 -d /usr/share/pixmaps/ethereal/toolbar &&
install -v -m644 image/*.{png,ico,xpm} /usr/share/pixmaps/ethereal &&
install -v -m644 image/toolbar/* /usr/share/pixmaps/ethereal/toolbar

Command Explanations

--enable-threads: This parameter enables the use of threads in ethereal.

--with-ssl: This parameter enables the use of the OpenSSL libcrypto library.

Configuring Ethereal

Config Files

/etc/ethereal.conf and ~/.ethereal/preferences

Configuration Information

Though the default configuration parameters are very sane, reference the configuration section of the Ethereal User's Guide for configuration information. Most of Ethereal's configuration can be accomplished using the menu options of the ethereal GUI interface.

[Note]

Note

If you want to look at packets, make sure you don't filter them out with iptables-1.3.3. If you want to exclude certain classes of packets, it is more efficient to do it with iptables than Ethereal.

Contents

Installed Programs: capinfos, dftest, editcap, ethereal, idl2eth, mergecap, randpkt, tethereal and text2pcap
Installed Libraries: libethereal.so, libwiretap.so and numerous dissector plugin modules
Installed Directories: /usr/lib/ethereal, /usr/share/ethereal and /usr/share/pixmaps/ethereal

Short Descriptions

capinfos

reads a saved capture file and returns any or all of several statistics about that file. It is able to detect and read any capture supported by the Ethereal package.

dftest

is a display-filter-compiler test program.

editcap

edits and/or translates the format of capture files. It knows how to read libpcap capture files, including those of tcpdump, Ethereal and other tools that write captures in that format.

ethereal

is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file.

idl2eth

takes a user specified CORBA IDL file and generates “C” source code that can be used to create an Ethereal plugin.

mergecap

combines multiple saved capture files into a single output file.

randpkt

creates random-packet capture files.

tethereal

is a TTY-mode network protocol analyzer. It lets you capture packet data from a live network or read packets from a previously saved capture file.

text2pcap

reads in an ASCII hex dump and writes the data described into a libpcap-style capture file.

libethereal.so

contains functions used by the Ethereal programs to perform filtering and packet capturing.

libwiretap.so

is a library being developed as a future replacement for libpcap, the current standard Unix library for packet capturing. For more information, see the README file in the source wiretap directory.

Last updated on 2005-08-01 13:29:19 -0600