Manuals / Lucent Technologies / Computer Equipment / Network Card

Lucent Technologies Ethereal manual Find Next command, Find Previous command, Down

Models: Ethereal

1 199

Download 199 pages 450 b

Page 128

Working with captured packets

You can choose the direction to be searched for:

•Up

Search upwards in the packet list (decreasing packet numbers).

•Down

Search downwards in the packet list (increasing packet numbers).

6.6.2.The "Find Next" command

"Find Next" will continue searching with the same options like in the last "Find Packet" run.

6.6.3. The "Find Previous" command

"Find Previous" will do the same thing as "Find Next", but with reverse search direction.

114

Image 128

Lucent Technologies Ethereal manual Find Next command, Find Previous command, Down

Contents

Ethereal Users Guide V2.0.2 16376 for EtherealEthereal Users Guide V2.0.2 16376 for Ethereal Page Table of Contents Page Page Page Preface ForewordWho should read this document? Acknowledgements About this document Where to get the latest copy of this document? Providing feedback about this document Preface Xiv What is Ethereal? FeaturesIntroduction Some intended purposesOpen Source Software Export files for many other capture programsMany protocol decoders What Ethereal is not Linux Platforms Ethereal runs onUnix Microsoft Windows Where to get Ethereal? Rose by any other name Brief history of Ethereal Development and maintenance of Ethereal Reporting problems and getting help FAQWebsite Wiki Mailing ListsReporting Problems Reporting Crashes on UNIX/Linux platformsReporting Crashes on Windows platforms Introduction Building and Installing Ethereal IntroductionObtaining the source and binary distributions Download all required filesBefore you build Ethereal under Unix Example 2.1. Building GTK+ from sourceExample 2.2. Building and installing libpcap Example 2.5. Installing debs under Debian Building Ethereal from source under UnixPage Installing from debs under Debian Installing the binaries under UnixInstalling from rpms under RedHat and alike Troubleshooting during the install on Unix Building from source under Windows Installing Ethereal under Windows Install EtherealInstall WinPcap Uninstall Ethereal Update EtherealUpdate WinPcap Uninstall WinPcap Building and Installing Ethereal User Interface Start Ethereal Main window Main windowUser Interface Current program state and the captured data Menu File menu Menu Item Accelerator Description OpenOpen Recent MergeMenu Item Accelerator Description Save Save AsFile Set List FilesMenu Item Accelerator Description Export Pdml fileExport Selec Ted Packet BytesEdit menu User Interface Marking packets for detailsView menu View Menu View menu itemsFields Time of Day, Date and Time of Day Seconds Since Beginning of Capture and Seconds SincePrevious Packet are mutually exclusive BeginningMenu Item Accelerator Description Zoom Zoom OutNormal Size Resize AllGo menu Menu Item Accelerator Description Last Packet Capture menu Saving filters Analyze menu Analyze Menu Analyze menu itemsFollow TCPStatistics menu Statistics menu items225 MessageTypes VoIP CallsHelp menu 10. The Help Menu Help menu itemsPage Main toolbar 11. The Main toolbar Main toolbar itemsGo Back Go ForwardFirst Packet Go To Last PackTion 9.3, Packet colorization Filter toolbar 12. The Filter toolbarPacket List pane 13. The Packet List panePacket Details pane 14. The Packet Details panePacket Bytes pane 15. The Packet Bytes paneStatusbar 17. The initial StatusbarUser Interface Capturing Live Network Data Prerequisites Start Capturing Capture Options dialog boxPrepare Capture Interfaces dialog boxPackets/s Interface Capture Options dialog boxCapture frame IP address Link-layer header typeBuffer size n megabytes Capture packets in promiscuousCapture Files frame Stop Capture... frameButtons Name Resolution frameDisplay Options frame Capture file mode selected by capture options Capture files and file modesMultiple files, continuous Multiple files, ring bufferLink-layer header type Filtering while capturing Example 4.2. Capturing all telnet traffic not fromSrcdst host host Ether srcdst host ehostGateway host host Srcdst net net maskMasklen len Tcpudp srcdst port portWhile a Capture is running Stop the running captureUsing the toolbar item Restart a running captureCapturing Live Network Data File Input / Output and Printing Open capture files Open Capture File dialog boxInput File Formats Page Saving captured packets Save Capture File As dialog boxTip Output File Formats Merging capture files Merge with Capture File dialog boxPage File Sets List Files dialog boxExport as PostScript File dialog box Exporting dataExport as Plain Text File dialog box Export as CSV Comma Seperated Values File dialog box Export as Psml File dialog boxExport as Pdml File dialog box Export as Psml File dialog boxExport selected packet bytes dialog box Export Selected Packet Bytes dialog boxPage Printer Printing packetsPrint dialog box Lpr -Pmypostscript Packet Range frame 10. The Packet Range framePacket Format frame 11. The Packet Format frameFile Input / Output and Printing Working with captured packets Viewing packets you have capturedFunction overview of the pop-up menus Lis Byt Menu Description Tail Decode AsNew Window Resolve name CopyMark Packet toggle Follow TCP StreamGo to Corresponding Packet Filter Field ReferenceProtocol Properties Export Selected Packet Bytes Filtering packets while viewing Filtering on the TCP protocolPage Building display filter expressions Display filter fieldsComparing values Display Filter comparison operatorsCombining expressions Display Filter Field TypesDisplay Filter Logical Operations Common mistake Filter Expression dialog box Filter Expression dialog boxCancel ValuePredefined values RangeDefining and saving filters Capture Filters and Display Filters dialog boxesNew DeleteFilter Filter nameFinding packets Find Packet dialog boxDisplay filter Hex ValueDown Find Next commandFind Previous command Go to a specific packet Marking packets Time display formats and time references Packet time referencingPage Working with captured packets 119 Advanced Features Following TCP streams Follow TCP stream dialog boxPage What is it? Reassembling is disabled by defaultPacket Reassembling How Ethereal handles itIP name resolution network layer Name ResolutionEthernet name resolution MAC layer IPX name resolution network layer TCP/UDP port name resolution transport layerAdvanced Features 126 Statistics Summary window Summary windowPage Protocol Hierarchy window Protocol Hierarchy windowPage Endpoints window What is an Endpoint?Endpoints Protocol specific Endpoint List windows What is a Conversation? ConversationsConversations window Protocol specific Conversation List windowsAxis IO Graphs windowGraphs Page Fibre Channel 225 RAS Service Response TimeService Response Time DCE-RPC window DCE-RPC Statistic for ... window Protocol specific statistics windows Statistics 140 Customizing Ethereal Start Ethereal from the command line Example 9.1. Help information available from EtherealDuration ue Filesize ueDurationue FilesizeueCapture buffer size Win32 OnlyPreference/recent settings FontName resolving flags Ethereal -o mgcp.displaydissecttreeTRUETime stamp format SavefileCapture link type Statistics-stringPacket colorization Coloring Rules dialog boxChoose color dialog box Using color filters with Ethereal Enabled Protocols dialog box Control Protocol dissectionPage User Specified Decodes Decode As dialog boxShow User Specified Decodes Decode As Show dialog boxPreferences Preferences dialog boxCustomizing Ethereal 154 Customizing Ethereal 155 Appendix A. Configuration and other Files and Folders Table A.1. Configuration files and folders overviewWindows folders Preferences/ethereal.confDisabledprotos Configuration files and folders overview. If an address isPlugins folder Windows foldersWindows profiles 98/ME with enabled user pro Windows NT/2000/XP roaming profilesWindows temporary folder 95/98/MEConfiguration and other Files Folders 161 Appendix B. Protocols and Protocol Fields Appendix C. Related command line tools Tcpdump Capturing with tcpdump for viewing with Ethereal Tethereal Terminal-based Ethereal Capinfos Print information about capture files Example C.1. Help information available from capinfosEditcap Edit capture files Example C.2. Help information available from editcapRelated command line tools Time adjustment Encap typeCapture type SnaplenMergecap Merging multiple capture files into one Example C.3. Help information available from mergecap171 Example C.4. Simple example of using mergecap Text2pcap Converting Ascii hexdumps to network captures Example C.5. Help information available for text2pcapFilename HexoctL3pid Srcport destportWhy do this? How to use idl2ethPrerequisites to using idl2eth Idl2eth Creating dissectors from Corba IDL filesTodo Limitations Related command line tools 179 Appendix D. This Documents License GPL GNU General Public License181 182 183 184 185