Ethereal
User's Guide
V1.1 for Ethereal 0.8.19
Richard Sharpe
NS Computer Software and Services P/L
Ed Warnicke
Copyright
© 2001 by Richard Sharpe, Ed Warnicke
Table of Contents
Foreword
Acknowledgments
Introduction
About this manual
What is
Ethereal?
The status of Ethereal
Development and maintenance of
Ethereal
A rose by any other name
A brief history of Ethereal
Platforms Ethereal runs on
Where to get Ethereal
Reporting problems and getting help
Where to get the latest copy of this document
Providing feedback
Building and Installing Ethereal
Introduction
Obtaining the source and binary distributions
Before you build
Ethereal
Building from Source under UNIX
Installing the binaries under UNIX
Installing from RPMs under Linux
Installing from debs under Debian
Building from source under Windows
Installing Ethereal under Windows
Troubleshooting during the install
Using
Ethereal
Introduction
Starting
Ethereal
The Ethereal menus
The Ethereal File menu
The Ethereal Edit menu
The Ethereal Capture menu
The Ethereal Display menu
The Ethereal Tools menu
The Ethereal Help menu
Capturing packets with
Ethereal
The Capture Preferences dialog box
Filtering while capturing
Viewing packets you have captured
Display Options
Saving captured packets
The Save Capture File As dialog box
Reading capture files
The File Open dialog box
Filtering packets while viewing
Building filter expressions
Packet colorization
Finding frames
Following TCP streams
Defining and saving filters
The Add Expression Dialog
Printing packets
Ethereal preferences
Files used by Ethereal
Troubleshooting with
Ethereal
An approach to troubleshooting with Ethereal
Capturing in the presence of switches and routers
Examples of troubleshooting
Related tools
Capturing with tcpdump for viewing with Ethereal
Tethereal, for terminal-based capturing
Using editcap
Merging multiple capture files into a single capture file with
mergecap
Converting ASCII hexdumps to network captures with
text2pcap
Creating dissectors from Corba IDL files with
idl2eth
What is it?
Why do this?
How to use idl2eth
TODO
Limitations
Notes
Ethereal Display Filter Fields
802.1q Virtual LAN (vlan)
AOL Instant Messenger (aim)
ATM (atm)
ATM LAN Emulation (lane)
Address Resolution Protocol (arp)
Andrew File System (AFS) (afs)
Appletalk Address Resolution Protocol (aarp)
Async data over ISDN (V.120) (v120)
Authentication Header (ah)
BACnet Virtual Link Control (bvlc)
Banyan Vines (vines)
Banyan Vines Fragmentation Protocol (vines_frp)
Banyan Vines SPP (vines_spp)
Blocks eXtensible eXchange Protocol (bxxp)
Boot Parameters (bootparams)
Bootstrap Protocol (bootp)
Border Gateway Protocol (bgp)
Building Automation and Control Network APDU (bacapp)
Building Automation and Control Network NPDU (bacnet)
Cisco Auto-RP (auto_rp)
Cisco Discovery Protocol (cdp)
Cisco Group Management Protocol (cgmp)
Cisco HDLC (chdlc)
Cisco Hot Standby Router Protocol (hsrp)
Cisco ISL (isl)
Cisco Interior Gateway Routing Protocol (igrp)
Cisco SLARP (slarp)
Common Open Policy Service (cops)
Common Unix Printing System (CUPS) Browsing Protocol (cups)
DCE RPC (dcerpc)
DCE/RPC Conversation Manager (conv)
DCE/RPC Endpoint Mapper (epm)
DCE/RPC Remote Management (mgmt)
DCOM OXID Resolver (oxid)
DCOM Remote Activation (remact)
DEC Spanning Tree Protocol (dec_stp)
DG Gryphon Protocol (gryphon)
Data (data)
Data Stream Interface (dsi)
Datagram Delivery Protocol (ddp)
Diameter Protocol (diameter)
Distance Vector Multicast Routing Protocol (dvmrp)
Domain Name Service (dns)
Dynamic DNS Tools Protocol (ddtp)
Encapsulating Security Payload (esp)
Enhanced Interior Gateway Routing Protocol (eigrp)
Ethernet (eth)
FTP Data (ftp-data)
Fiber Distributed Data Interface (fddi)
File Transfer Protocol (FTP) (ftp)
Frame (frame)
Frame Relay (fr)
GARP VLAN Registration Protocol (gvrp)
GPRS Tunneling Protocol (gtp)
General Inter-ORB Protocol (giop)
Generic Routing Encapsulation (gre)
Gnutella Protocol (gnutella)
Hummingbird NFS Daemon (hclnfsd)
Hypertext Transfer Protocol (http)
ICQ Protocol (icq)
IEEE 802.11 wireless LAN (wlan)
IEEE 802.11 wireless LAN management frame (wlan_mgt)
ILMI (ilmi)
IP Payload Compression (ipcomp)
IPX Message (ipxmsg)
IPX Routing Information Protocol (ipxrip)
ISDN Q.921-User Adaptation Layer (iua)
ISDN User Part (isup)
ISIS HELLO (isis_hello)
ISO 10589 ISIS Complete Sequence Numbers Protocol Data Unit (isis_csnp)
ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol (isis)
ISO 10589 ISIS Link State Protocol Data Unit (isis_lsp)
ISO 10589 ISIS Partial Sequence Numbers Protocol Data Unit (isis_psnp)
ISO 8073 COTP Connection-Oriented Transport Protocol (cotp)
ISO 8473 CLNP ConnectionLess Network Protocol (clnp)
ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)
ISO 9542 ESIS Routeing Information Exchange Protocol (esis)
ITU-T Recommendation H.261 (h261)
Internet Cache Protocol (icp)
Internet Control Message Protocol (icmp)
Internet Control Message Protocol v6 (icmpv6)
Internet Group Management Protocol (igmp)
Internet Message Access Protocol (imap)
Internet Printing Protocol (ipp)
Internet Protocol (ip)
Internet Protocol Version 6 (ipv6)
Internet Relay Chat (irc)
Internet Security Association and Key Management Protocol (isakmp)
Internetwork Packet eXchange (ipx)
Kerberos (kerberos)
Kernel Lock Manager (klm)
Label Distribution Protocol (ldp)
Layer 2 Tunneling Protocol (l2tp)
Lightweight Directory Access Protocol (ldap)
Line Printer Daemon Protocol (lpd)
Link Access Procedure Balanced (LAPB) (lapb)
Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
Link Access Procedure, Channel D (LAPD) (lapd)
Linux cooked-mode capture (sll)
Local Management Interface (lmi)
Logical-Link Control (llc)
Lucent/Ascend debug output (ascend)
MAPI (mapi)
MS Proxy Protocol (msproxy)
MSNIP : Multicast Source Notification of Interest Protocol (msnip)
MTP 3 User Adaptation Layer (m3ua)
MTP2 Peer Adaptation Layer (m2pa)
Malformed Frame (malformed)
Media Gateway Control Protocol (mgcp)
Message Transfer Part Level 3 (mtp3)
Microsoft Windows Browser Protocol (browser)
Microsoft Windows Lanman Protocol (lanman)
Microsoft Windows Logon Protocol (netlogon)
Mobile IP (mip)
Modbus/TCP (mbtcp)
Mount Service (mount)
MultiProtocol Label Switching Header (mpls)
Multicast Router DISCovery protocol (mrdisc)
Multicast Source Discovery Protocol (msdp)
NIS+ (nisplus)
NIS+ Callback (nispluscb)
Name Binding Protocol (nbp)
Name Management Protocol over IPX (nmpi)
NetBIOS (netbios)
NetBIOS Datagram Service (nbdgm)
NetBIOS Name Service (nbns)
NetBIOS Session Service (nbss)
NetBIOS over IPX (nbipx)
NetWare Core Protocol (ncp)
Network File System (nfs)
Network Lock Manager Protocol (nlm)
Network News Transfer Protocol (nntp)
Network Status Monitor CallBack Protocol (stat-cb)
Network Status Monitor Protocol (stat)
Network Time Protocol (ntp)
Null/Loopback (null)
Open Shortest Path First (ospf)
PPP IP Control Protocol (ipcp)
PPP Link Control Protocol (lcp)
PPP Multilink Protocol (mp)
PPP Password Authentication Protocol (pap)
PPP-over-Ethernet Discovery (pppoed)
PPP-over-Ethernet Session (pppoes)
Point-to-Point Protocol (ppp)
Point-to-Point Tunnelling Protocol (pptp)
Portmap (portmap)
Post Office Protocol (pop)
Pragmatic General Multicast (pgm)
Protocol Independent Multicast (pim)
Q.2931 (q2931)
Q.931 (q931)
Quake II Network Protocol (quake2)
Quake Network Protocol (quake)
QuakeWorld Network Protocol (quakeworld)
RFC 2250 MPEG1 (mpeg1)
RIPng (ripng)
RX Protocol (rx)
Radio Access Network Application Part (ranap)
Radius Protocol (radius)
Real Time Streaming Protocol (rtsp)
Real-Time Transport Protocol (rtp)
Real-time Transport Control Protocol (rtcp)
Remote Procedure Call (rpc)
Remote Quota (rquota)
Remote Shell (rsh)
Remote Wall protocol (rwall)
Resource ReserVation Protocol (RSVP) (rsvp)
Rlogin Protocol (rlogin)
Routing Information Protocol (rip)
Routing Table Maintenance Protocol (rtmp)
SCCP user adaptation layer light (sual)
SMB (Server Message Block Protocol) (smb)
SMB MailSlot Protocol (mailslot)
SNMP Multiplex Protocol (smux)
SPRAY (spray)
SSCOP (sscop)
Secure Socket Layer (ssl)
Sequenced Packet eXchange (spx)
Service Advertisement Protocol (ipxsap)
Service Location Protocol (srvloc)
Session Announcement Protocol (sap)
Session Description Protocol (sdp)
Session Initiation Protocol (sip)
Short Frame (short)
Simple Mail Transfer Protocol (smtp)
Simple Network Management Protocol (snmp)
Sinec H1 Protocol (h1)
Socks Protocol (socks)
Spanning Tree Protocol (stp)
Stream Control Transmission Protocol (sctp)
Syslog message (syslog)
Systems Network Architecture (sna)
TACACS (tacacs)
TACACS+ (tacplus)
TPKT (tpkt)
Telnet (telnet)
Time Protocol (time)
Token-Ring (tr)
Token-Ring Media Access Control (trmac)
Transmission Control Protocol (tcp)
Transparent Network Substrate Protocol (tns)
Trivial File Transfer Protocol (tftp)
User Datagram Protocol (udp)
Virtual Router Redundancy Protocol (vrrp)
Virtual Trunking Protocol (vtp)
Web Cache Coordination Protocol (wccp)
Wellfleet Compression (wcp)
Who (who)
Wireless Session Protocol (wap-wsp)
Wireless Transaction Protocol (wap-wsp-wtp)
Wireless Transport Layer Security (wap-wtls)
X.25 (x.25)
X.25 over TCP (xot)
X11 (x11)
Yahoo Messenger Protocol (yhoo)
Yellow Pages Bind (ypbind)
Yellow Pages Passwd (yppasswd)
Yellow Pages Service (ypserv)
Yellow Pages Transfer (ypxfr)
Zebra Protocol (zebra)
iSCSI (iscsi)
Ethereal Error Messages
Capture file format not understood
Save file error
The GNU Free Document Public Licence
Copyright
Preamble
Applicability and Definitions
Verbatim Copying
Copying in Quantity
Modifications
Combining Documents
Collections of Documents
Aggregation with Independent Works
Translation
Termination
Future Revisions of this License
V1.1 for Ethereal 0.8.19
Next >>>
Foreword