Wireshark-users: Re: [Wireshark-users] VNC playback

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Tue, 1 May 2007 22:50:33 -0700

On Tue, May 01, 2007 at 02:05:58PM -0500, Jonathan Polacheck wrote:

> There are some open-source efforts to get VNC playback, but so far I 
> have been unable to get any of them to work. How cool would it be to 
> be able to playback VNC data right from the trace that has the 
> client/server traffic? And frame numbers to show the exact correlation 
> between traffic and desktop events!?
> 
> Wireshark does VOIP playback now.  rfbproxy does VNC playback from 
> it's own file format.  It seems like all the pieces are available.

Playing back VNC sessions from within Wireshark would be a LOT of coding 
to do and maintain and the VNC protocol isn't easy to decode (I wrote 
most of the VNC dissector in Wireshark and it still doesn't work 
perfectly for server frame buffer updates).  What about a program that 
translates the VNC traffic from a pcap file and outputs it in a format 
that rfbproxy can read in?


Steve