There are some open-source efforts to get VNC playback, but so far I
have been unable to get any of them to work. How cool would it be to
be able to playback VNC data right from the trace that has the
client/server traffic? And frame numbers to show the exact correlation
between traffic and desktop events!?
Wireshark does VOIP playback now. rfbproxy does VNC playback from
it's own file format. It seems like all the pieces are available.
Playing back VNC sessions from within Wireshark would be a LOT of coding
to do and maintain and the VNC protocol isn't easy to decode (I wrote
most of the VNC dissector in Wireshark and it still doesn't work
perfectly for server frame buffer updates). What about a program that
translates the VNC traffic from a pcap file and outputs it in a format
that rfbproxy can read in?
Steve
Sounds better than what I have now. Some kind of timestamp/frame number
display would be very helpful.
Could we do it from a NG-style cap file? We have a lot of Network
General here and it would save me a step (cap to pcap).
vncrec (http://www.sodan.org/~penny/vncrec/) is another stab at vnc
record-and-playback and the Tightvnc java viewer can generate
rfbproxy-compatible playback files.
Jon
