Wireshark · Ethereal-users: Re: [ethereal-users] How to view packets real-time

[charlie buckheit <buckheit@xxxxxxxxxxxxxx>]

>On Sun, 18 Oct 1998, buckheit wrote:
>
>> Hi,
>>
>> Just downloaded and compiled gtk 1.0.6 & ethereal 0.4.1 on
>> PowerMac/Linuxppc. It seems to work ok (some long delays and
>> lockups...but its alpha, right???). I noticed on the web page some
>> mention of real-time viewing of packets, yet I can not figure out how to
>> do this. Can any one help me??
>>
>>
>> VR, Charlie
>>
>>
>>       \|/
>
>
>Every packet sniffer operates in the same manner.  Capture packets to
>buffer/disk, then view the contents afterward.  Ethereal seems not  to
>deviate from this modus operandi.

Hummm...I actually started to write a version using libpcap and pcapture (a
program from the same place as libpcap) that would display the packets
realtime. Snoop on the SGI does it this way, as can tcpdump. The only bad
part (or good part depending on where you stand) with snoop is that it
doesn't show the data part of the packets. Neither does tcpdump, though
older versions supposedly did. For some applications I really need to see
the data.

VR, Charlie


VR, Charlie

      \|/
      @ @
__oOO_(_)_OOo___________________________________________
|                                                       |
| Charlie Buckheit                                      |
| Instrumentation Team Leader                           |
| Air Combat Environment Test and Evaluation Facility   |
| Naval Air Warfare Center Aircraft Division            |
| Patuxent River, MD 20670 USA                          |
|                                                       |
| voice: 301-342-6366  fax: 301-342-6381                |
| work email: buckheitc%am5@xxxxxxxxxxxxxxxxxx          |
| home email: buckheit@xxxxxxxxxxxxxx                   |
| web page: http://www.macinsearch.com/users/cbuckheit/ |
|_______________________________________________________|