Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] unauthorised stuff out

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 31 Dec 2004 17:46:03 -0800
Ray Hamono wrote:
please advise me as to exactly how to:
get your appropriate s/w
b) use it
c) use the results to find out why, when I first turn on the pc, info is
being sent out the 'door' to whoever.
I was advised by Iprimus that the slow response to a search was being
caused by this outbound or
uploaded unauthorised traffic.
Iprimus confirmed my ADSL response time as being correct ( 30-40msec)
when pc is off!

   I looked at your site & was confused by all the "download" tab info.

Well, as we're not Windows-only software - and as we offer the source code to let people modify Ethereal, or build it on platforms for which binary versions aren't available - the download information is going to be more complicated than for some simple program available only for one platform or a small number of platforms.

If your PC is running Windows, you want one of the "Windows 98/ME/2000/XP/2003 Installers" (it will also work on NT 4.0, and probably Windows 95, although some other stuff might have to be installed; also, there's a problem of some sort on Windows 98 and Me, and possibly Windows 95, with the current 0.10.8 release). The list of countries lists mirror sites; pick the one closest to you (probably Australia, from your e-mail domain name); HTTP is probably easier than FTP.

If your PC is running Red Hat Linux, try one of the "Red Hat Linux / Fedora Packages".

Otherwise, look at the "Other Platforms" and see if a binary version is there. If not, you'd have to download source and compile it.

As for using it, you should probably look at the user's guide, available from

	http://www.ethereal.com/docs/

Again, note that there are a number of mirror sites; you probably want one of the Australian ones. You have a choice of several different formats; try the "Online HTML, Multiple Pages" first.

As for finding out why information is being sent, Ethereal can probably show you the information, but it can't, by itself, figure out why it's being sent; you'd have to understand enough about networking to figure out what the traffic you're seeing is, or ask somebody you know, or ask the ethereal-users list, what it is.