To clarify:
In windump it is possible to sniff only according to a few basic things such
as port, ip, mac address etc., without having to start dealing with offsets.
And once you want to filter according to a field which doesn't always appear
at the same offset, it's impossible. Ethereal/Tethereal on the other hand
does allow you to do this using it's display filters. It also is much more
intuitive.
However, capturing with ethereal's display filters (with tethereal) only
captures the specific packet that matches the display filter. But it would
be much more powerful to capture the whole TCP/UDP session that one of its
packets matched that read filter, instead of just the specific packet that
matched it. That way, when I sniff my computer for a URL, I won't capture
only the packet with the GET for that URL, but rather, the whole session.
In short, I'm proposing to add a stateful capability to tethereal, instead
of its currently stateless implementation.
My other idea was to add a function to ethereal to decode all the packets of
a capture file into all the different TCP/UDP sessions that were captured,
instead of just one by one using the "follow TCP stream" function.
I'm sure some of you with much more in depth knowledge of ethereal could
implement this in shorter time than I could.
--------------------------------------
* Subject: Re: [Ethereal-dev] TCP sniffing using Tethereal
* From: Ulf Lamping <ulf.lamping@xxxxxx>
* Date: Thu, 16 Sep 2004 19:22:18 +0200
Gilad Evrony wrote:
I think it would be a very powerful tool to be able to use ethereal's
read filters to sniff whole TCP/UDP sessions.
What do you mean with a read filter? A capture or a display filter?
That way, when a packet matches my filter, not only is it saved to disk
but also the whole TCP/UDP session it belongs to.
Do you mean to save all session into different files while capturing?
Also, it would be nice if the etheral could create all the TCP/UDP
streams in a file, rather than having to click one by one (Iris
does this pretty well).
Create streams in a file?
If anyone knows how to do this or can advise me how I'd appreciate it.
Please give a little more details of your thoughts, your descriptions are
very short.
Regards, ULFL
