Ethereal-users: Re: [Ethereal-users] reading a libpcap file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 21 Nov 2004 23:06:45 -0800
Melanie Mercan wrote:

I am in a class that gave a libpcap capture as a homework assignment. I am very new to this, and having problems downloading Ethereal to my Mac. Is there any other program I can use to read a libpcap file?

There's tcpdump, which comes as a standard part of OS X (which is what I'll assume you're running; I don't know what software, if any, can read libpcap files on pre-OS X versions of Mac OS, and Ethereal definitely doesn't run on pre-OS X versions, unless somebody's done a port that they haven't told me about).

Or anyone knowledgeable on downloading and running Ethereal on a Mac? I have searched the site and FAQa but still no luck (it is probably my own operator error).

We could probably tell you whether it's operator error - and what the error is - if we knew what wasn't working.

The first thing to note is that you need to have X11 running.

On Panther, look in the "Utilities" directory of the "Applications" directory (see the sidebar in the Finder window, which should list "Applications") for an application named "X11". (If it's not there, you might have to install it from the CD-ROM that came with the system; I don't know whether it's installed by default or not.)

In pre-Panther releases, you'll have to install it from Fink.

You can set your system up to run X11 when you log in. In System Preferences, select Accounts, select your account, and select Startup Items; you can drag and drop X11 into that.

X11 will start up an xterm window by default; if your shell path is set to include the directory in which Ethereal is located, you can just run "ethereal" from the command line to start it. In a Terminal window, you can run it, but you need to make sure that the environment variable DISPLAY is set to ":.0.0".

If you're not familiar with the UN*X command line, you can add Ethereal to the application menu for X11. Select "Customize..." from the Applications menu for X11 (if you've started X11, click on the X11 icon in the Dock to get its menu), click the Add Item button, and add an entry with "Ethereal" as the name and either "ethereal", or the full path to Ethereal, as the command. The Applications menu for X11, and for the X11 icon in the Doc, will have an entry for Ethereal.