Manuals / Lucent Technologies / Computer Equipment / Network Card

Lucent Technologies Ethereal manual

Models: Ethereal

1 199

Download 199 pages 450 b

Page 65

User Interface

Note!

Calling a Web browser might be unsupported in your version of Ethereal. If this is the case, the corresponding menu items will be hidden.

Note!

If calling a Web browser fails on your machine, maybe because just nothing happens or the browser is started but no page is shown, have a look at the webbrowser setting in the preferences dialog.

51

Image 65

Lucent Technologies Ethereal manual

Contents

V2.0.2 16376 for Ethereal Ethereal Users GuideEthereal Users Guide V2.0.2 16376 for Ethereal Page Table of Contents Page Page Page Foreword PrefaceWho should read this document? Acknowledgements About this document Where to get the latest copy of this document? Providing feedback about this document Preface Xiv Features What is Ethereal?Introduction Some intended purposesOpen Source Software Export files for many other capture programsMany protocol decoders What Ethereal is not Linux Platforms Ethereal runs onUnix Microsoft Windows Where to get Ethereal? Rose by any other name Brief history of Ethereal Development and maintenance of Ethereal FAQ Reporting problems and getting helpWebsite Wiki Mailing ListsReporting Crashes on UNIX/Linux platforms Reporting ProblemsReporting Crashes on Windows platforms Introduction Introduction Building and Installing EtherealDownload all required files Obtaining the source and binary distributionsExample 2.1. Building GTK+ from source Before you build Ethereal under UnixExample 2.2. Building and installing libpcap Example 2.5. Installing debs under Debian Unix Building Ethereal from source underPage Installing from debs under Debian Installing the binaries under UnixInstalling from rpms under RedHat and alike Troubleshooting during the install on Unix Building from source under Windows Install Ethereal Installing Ethereal under WindowsInstall WinPcap Uninstall Ethereal Update EtherealUpdate WinPcap Uninstall WinPcap Building and Installing Ethereal User Interface Start Ethereal Main window Main windowUser Interface Current program state and the captured data Menu Menu Item Accelerator Description Open File menuOpen Recent MergeSave As Menu Item Accelerator Description SaveFile Set List FilesPdml file Menu Item Accelerator Description ExportExport Selec Ted Packet BytesEdit menu Marking packets for details User InterfaceView Menu View menu items View menuSeconds Since Beginning of Capture and Seconds Since Fields Time of Day, Date and Time of DayPrevious Packet are mutually exclusive BeginningZoom Out Menu Item Accelerator Description ZoomNormal Size Resize AllGo menu Menu Item Accelerator Description Last Packet Capture menu Saving filters Analyze Menu Analyze menu items Analyze menuTCP FollowStatistics menu items Statistics menuMessage 225Types VoIP Calls10. The Help Menu Help menu items Help menuPage 11. The Main toolbar Main toolbar items Main toolbarGo Forward Go BackFirst Packet Go To Last PackTion 9.3, Packet colorization 12. The Filter toolbar Filter toolbar13. The Packet List pane Packet List pane14. The Packet Details pane Packet Details pane15. The Packet Bytes pane Packet Bytes pane17. The initial Statusbar StatusbarUser Interface Capturing Live Network Data Prerequisites Capture Options dialog box Start CapturingPrepare Capture Interfaces dialog boxPackets/s Interface Capture Options dialog boxCapture frame Link-layer header type IP addressBuffer size n megabytes Capture packets in promiscuousStop Capture... frame Capture Files frameButtons Name Resolution frameDisplay Options frame Capture files and file modes Capture file mode selected by capture optionsMultiple files, ring buffer Multiple files, continuousLink-layer header type Example 4.2. Capturing all telnet traffic not from Filtering while capturingSrcdst host host Ether srcdst host ehostSrcdst net net mask Gateway host hostMasklen len Tcpudp srcdst port portStop the running capture While a Capture is runningRestart a running capture Using the toolbar itemCapturing Live Network Data File Input / Output and Printing Open Capture File dialog box Open capture filesInput File Formats Page Save Capture File As dialog box Saving captured packetsTip Output File Formats Merge with Capture File dialog box Merging capture filesPage List Files dialog box File SetsExport as PostScript File dialog box Exporting dataExport as Plain Text File dialog box Export as Psml File dialog box Export as CSV Comma Seperated Values File dialog boxExport as Psml File dialog box Export as Pdml File dialog boxExport Selected Packet Bytes dialog box Export selected packet bytes dialog boxPage Printer Printing packetsPrint dialog box Lpr -Pmypostscript 10. The Packet Range frame Packet Range frame11. The Packet Format frame Packet Format frameFile Input / Output and Printing Viewing packets you have captured Working with captured packetsFunction overview of the pop-up menus Decode As Lis Byt Menu Description TailNew Window Resolve name CopyFollow TCP Stream Mark Packet toggleGo to Corresponding Packet Filter Field ReferenceProtocol Properties Export Selected Packet Bytes Filtering on the TCP protocol Filtering packets while viewingPage Display filter fields Building display filter expressionsComparing values Display Filter comparison operatorsDisplay Filter Field Types Combining expressionsDisplay Filter Logical Operations Common mistake Filter Expression dialog box Filter Expression dialog boxValue CancelPredefined values RangeCapture Filters and Display Filters dialog boxes Defining and saving filtersDelete NewFilter Filter nameFind Packet dialog box Finding packetsDisplay filter Hex ValueDown Find Next commandFind Previous command Go to a specific packet Marking packets Packet time referencing Time display formats and time referencesPage Working with captured packets 119 Advanced Features Follow TCP stream dialog box Following TCP streamsPage Reassembling is disabled by default What is it?Packet Reassembling How Ethereal handles itIP name resolution network layer Name ResolutionEthernet name resolution MAC layer TCP/UDP port name resolution transport layer IPX name resolution network layerAdvanced Features 126 Statistics Summary window Summary windowPage Protocol Hierarchy window Protocol Hierarchy windowPage Endpoints window What is an Endpoint?Endpoints Protocol specific Endpoint List windows Conversations What is a Conversation?Conversations window Protocol specific Conversation List windowsAxis IO Graphs windowGraphs Page Fibre Channel 225 RAS Service Response TimeService Response Time DCE-RPC window DCE-RPC Statistic for ... window Protocol specific statistics windows Statistics 140 Customizing Ethereal Example 9.1. Help information available from Ethereal Start Ethereal from the command lineDuration ue Filesize ueFilesizeue DurationueCapture buffer size Win32 OnlyFont Preference/recent settingsName resolving flags Ethereal -o mgcp.displaydissecttreeTRUESavefile Time stamp formatCapture link type Statistics-stringColoring Rules dialog box Packet colorizationChoose color dialog box Using color filters with Ethereal Control Protocol dissection Enabled Protocols dialog boxPage Decode As dialog box User Specified DecodesDecode As Show dialog box Show User Specified DecodesPreferences dialog box PreferencesCustomizing Ethereal 154 Customizing Ethereal 155 Table A.1. Configuration files and folders overview Appendix A. Configuration and other Files and FoldersPreferences/ethereal.conf Windows foldersConfiguration files and folders overview. If an address is DisabledprotosPlugins folder Windows foldersWindows profiles Windows NT/2000/XP roaming profiles 98/ME with enabled user proWindows temporary folder 95/98/MEConfiguration and other Files Folders 161 Appendix B. Protocols and Protocol Fields Appendix C. Related command line tools Tcpdump Capturing with tcpdump for viewing with Ethereal Tethereal Terminal-based Ethereal Example C.1. Help information available from capinfos Capinfos Print information about capture filesExample C.2. Help information available from editcap Editcap Edit capture filesRelated command line tools Encap type Time adjustmentCapture type SnaplenExample C.3. Help information available from mergecap Mergecap Merging multiple capture files into one171 Example C.4. Simple example of using mergecap Example C.5. Help information available for text2pcap Text2pcap Converting Ascii hexdumps to network capturesHexoct FilenameSrcport destport L3pidHow to use idl2eth Why do this?Prerequisites to using idl2eth Idl2eth Creating dissectors from Corba IDL filesTodo Limitations Related command line tools 179 GNU General Public License Appendix D. This Documents License GPL181 182 183 184 185