Ethereal-dev: Re: [Ethereal-dev] [Fwd: ClearSight Analyzer's use of Ethereal decode engine]
On Jan 7, 2004, at 3:10 PM, Gerald Combs wrote:
I received this email earlier today. After downloading a demo of
ClearSight Anayzer, it's clear that they've DLL-ified Ethereal and
call it directly from their application. A copy of the default decode
engine (DecodeEngine.dll) resides in "DecodeEngines\Ethereal\". A
string analysis of the DLL indicates that it contains Ethereal's
dissector code plus epan, and possibly more of Ethereal's components.
I sent an email to ClearSight, and am waiting for a response.
As long as they're stealing from us, it might be interesting to steal
from them - the column headings above the lines in the hex dump pane
might be useful, for example; see figure 7-4 in their Getting Started
Guide:
http://www.clearsightnetworks.com/files/docs/Clearsight%20GSG(10
-03).pdf
(The information in the summary line in that figure looks certainly
looks familiar, as does the detail pane in figure 7-5....)
"Working with Trace Files" in chapter 7 says they can read "Generic
capture files (*.cap)". I'm not sure what that means, as I don't know
of any file format for "generic capture files", although i do know of
several different formats that use ".cap" (Windows Sniffer, Network
Monitor, and I think Shomiti Surveyor) - are they also using Wiretap?
If so, I guess they have to give us code to read AppDancer files
(assuming they're not just using some existing capture file format that
we already read).
But as they say you can only save trace files in AppDancer or DOS
Sniffer format, perhaps they're *not* using Wiretap - if they were,
they could save in other formats as well.
(Then again, their display filter capability isn't as powerful as ours;
I guess they didn't want to force their users to confront display
filters in their full glory, although Microsoft provides a scheme of
equivalent power in Network Monitor - in fact, the "Add Expression"
dialog box in Ethereal is modeled after the NetMon box, although we
don't have a GUI for constructing a full expression tree as NetMon
does.)
