ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] Modest tapping plugins to watch WAP, HTTP and DHCP traffic

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "jean-michel.fayard" <jmfayard@xxxxxxxxxxxxxxx>
Date: Tue, 2 Sep 2003 15:12:34 +0200 (DST)

Hello,
this is a following of my previous mail. I separate it, because
this set of patches is very independant of the previous one.

This use the powerful TAP system mechanism for both ethereal and
tethereal for  the HTTP, WSP (wap) and DHCP (bootp)  protocols. It
allows us to have some statistics that we canot have with only my
previous patch : the HTTP, WSP (wap) and DHCP are respectivly well
summarized by the values of the (http.response.method and
http.request.method) fields, the DHCP message type
(DHCPDISCOVER,DHCPACK,...)  and the (http.request.methods (GET,...) and
http.response.method (404: page not found) fields )).

What values took these fields ? It's not something I can get
with a filter. That's why I wrote that.

To use it :
$ tethereal -z http,stat,<filter> -z bootp,stat,<filter>
              -z wsp,stat,<filter> ....
$ ethereal -z http,stat,<filter> -z bootp,stat,<filter>
              -z wsp,stat,<filter> ....
or use the GUI

This tap mechanism is great : they are simple to write, and
the windows update them in real time (If not, my patch would
have no interest), and if some tapping plugin doesn't interest
you, it doesn't hurt you (no more memory, no GUI bloat,...)

The two bad things I found are
* $ ethereal -z http,stat,<filter> -z bootp,stat,<filter>
     currently only start the last window (bootp).
     It is a bug in my programs or in the mechanism itself ?
* There is a lot of duplication between the code for
     ethereal, and the code for tethereal.


My code is in the archive of my previous mail , together with the 3
patches of my previous mail. I also attached minimalistic capture files
so you can test it.


Ethereal was very useful for us ; I hope this can be useful
for the ethereal community.


PS: Sorry for my english.

-- 
Jean-Michel FAYARD <Jean-Michel.Fayard@xxxxxxxxxx>
ALCATEL Vlizy - France