ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: David Frascone <dave@xxxxxxxxxxxx>
Date: Sun, 13 May 2001 18:02:37 -0500
On Sat, May 12, 2001 at 11:08:17PM -0500, Jim Garrison wrote:
> > The current version of Ethereal attempts to work around this, so its GUI
> > shouldn't freeze when capturing on a not-so-busy network.  If its GUI
> > does freeze when that happens, please send a note about this, indicating
> > which version of which distribution of Linux you're using, and which
> > version of libpcap you're using, to ethereal-dev@xxxxxxxxxxxx.
> 
> The version that comes with RH7.1 says in the Help/About dialog: 
> 
> "Ethereal 0.8.15 Compiled with GTK+ 1.2.8, with libpcap 0.4, 
> with libz 1.1.3, without SNMP".
> 
> I noticed the following on an idle network:
> 
> 1) The GUI appears to freeze during capture (windows are
>    not repainted if hidden and then re-exposed).

Sounds like a libpcap problem.  I had that one before.  To fix it, I removed
the redhat libpcap, and built and installed it from source.

> 
> 2) There's no option in the Capture Preferences to turn on 
>    live packet capture.  Only options are "Capture in promiscuous
>    mode", "Auto scrolling in live capture" and "Enable name
>    resolution".

Live packet capture is doing a normal capture.  As opposed to having a 
capture file and loading it via File/Open.

> 
> 3) The command-line "-S" option both enables live capture and
>    prevents the GUI from freezing.

Again, looks like a libpcap problem.

> 
> 4) rpm claims libpcap isn't installed (probably statically
>    linked with ethereal in the RH distribution).

Try 'locate libpcap'

I'd suggest building/installing from source.


> 
> 5) Tried downloading the latest version RPM from ethereal.com
>    but couldn't install:
> 
> > error: failed dependencies:
> >         libcrypto.so.0   is needed by ethereal-0.8.17-1
> 
>   RH7.1 comes with openssl-0.9.6-3, which defines libcrypto.so.1
>   but no .0 ... can I just create another symlink for the .0
>   version, or has libcrypto's API changed enough for .1 to break 
>   ethereal?

Ya know, that'd take less time to test, than to post :)

Let me know if it works though!!!