Wireshark · Ethereal-users: [Ethereal-users] isssue sample code for TCP/IP decoding

["sagun maini" <sagunmaini@xxxxxxxxx>]

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------



---------- Forwarded message ----------
From: sagun maini <sagunmaini@xxxxxxxxx>
Date: Sep 15, 2006 5:23 PM
Subject: Re: Ethereal-users Digest, Vol 41, Issue 13
To: ethereal-users@xxxxxxxxxxxx

Spahseebah
But i would be grateful if send me a sample code of how to decode TCP/IP data.......packet by packet and also a code of how to correlate services.....

sagun
 

On 9/14/06, ethereal-users-request@xxxxxxxxxxxx < ethereal-users-request@xxxxxxxxxxxx> wrote:

Send Ethereal-users mailing list submissions to
       ethereal-users@xxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
       http://www.ethereal.com/mailman/listinfo/ethereal-users
or, via email, send a message with subject or body 'help' to
       ethereal-users-request@xxxxxxxxxxxx

You can reach the person managing the list at
       ethereal-users-owner@xxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Ethereal-users digest..."


Reply-To: Ethereal user support &lt;ethereal- users@xxxxxxxxxxxx&gt;

Today's Topics:

  1. Re: How does Ethereal interact with Fedora Core? (Guy Harris)
  2. Container Load Specials (Surplus Auto Parts)
  3. Vacancies in Australia (Adrian)
  4. RE: How does Ethereal interact with Fedora Core? (Michael Cobb)
  5. Can I open and then export a file from the command        line?
     (Linick, James (SED/WESTAR))
  6. Re: Can I open and then export a file from the    command line?
     (Gerald Combs)


----------------------------------------------------------------------

Message: 1
Date: Wed, 13 Sep 2006 11:26:14 -0700
From: Guy Harris < guy@xxxxxxxxxxxx>
Subject: Re: [Ethereal-users] How does Ethereal interact with Fedora
       Core?
To: Ethereal user support < ethereal-users@xxxxxxxxxxxx>,        Community
       support list for Wireshark < wireshark-users@xxxxxxxxxxxxx >
Message-ID: <45084D46.2030001@xxxxxxxxxxxx>
Content-Type: text/plain; charset=windows-1252; format=flowed

Michael Cobb wrote:
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
>
>
> ------------------------------------------------------------------------
>
> Can anyone explain to me how Ethereal relates to Fedora?

The same way Wireshark relates to it (see the above note).  This
discussion should probably be continued on the wireshark-users mailing
list; I'm sending this to that list as well.

> At what OS
> level is displaying a capture from? I'm not a developer, but need to be
> certain that packets displayed by Ethereal are indeed being presented
> from the OS to an application that is running.

Wireshark (and Ethereal) capture traffic using the libpcap library; on
Linux, that works by opening a "PF_PACKET socket", from which it
receives the packets.

Packets delivered to a PF_PACKET socket aren't necessarily delivered to
some other socket; they might be delivered to a networking protocol such
as TCP or UDP, but that won't necessarily deliver them to a socket.

> I am currently sniffing and seeing the packets in Ethereal. However the
> developer of the application has inserted debugging code to display when
> it receives those packets, but it does not acknowledge receiving them. I
> need to determine if this means the problem is OS related or application
> related.

It's *probably* application-related.  Are the packets TCP, UDP, or some
other protocol?  Does the application have a socket open to receive
those packets?


------------------------------

Message: 2
Date: Wed, 13 Sep 2006 09:23:46 -0500
From: "Surplus Auto Parts" < advertising@xxxxxxxxxxxxxxxx >
Subject: [Ethereal-users] Container Load Specials
To: "ethereal-users@xxxxxxxxxxxx " <ethereal-users@xxxxxxxxxxxx >
Message-ID: < 200609140149.k8E1nG005516@xxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain

**** SPECIAL NOTE:  We have also launched on of the world's largest wholesale / retail on-line auction sites www.autopartauctions.com
Please sign up today and take advantage of deep discounted prices on auto parts. NO MINIMUM PURCHASE REQUIRED.


Wholesale Lot Specials: If you are interested in any of the below-listed lots, please e-mail me at glenn@xxxxxxxxxxxxxxxx

1.      MIXED Lot of 13,000 sets of MSW Spark Plug Wire Sets - $1.75 each set. The lot is a mixture of assorted 4cyl - 6cyl - 8cyl engine applications for American, European, and Japanese vehicles. ALL ONE BRAND. Assorted arrangement of part numbers. Nice packaging. We do not have an inventory list. Must buy entire lot.

2.      MIXED Dayco / Goodyear Serpentine Belts - $1.50 each. The lot is a mixture of assorted part numbers for American, European, and Japanese vehicles. Nice packaging. We do not have an inventory list. Minimum order 2,500 pcs.

3.      60 - Pallets - Assorted Brake Hardware: Bendix, Wagner, Carlson, Lee, Raybestos, Napa, Gibson, Brake Pro, etc. All types of disc & drum brake hardware. Some pallets have caliper kits, wheel cylinder kits, master cylinder kits, brake hoses, adjuster kits, etc. - $6, 000.00 for a FULL Truckload (60 pallets)

4.      Brake Hoses - 40,000 pcs - $0.50 each. Minimum quantity to purchase is 2,000 pcs. All are new. Brands: Wagner, Auto Specialty, Bendix, Road-Pro, Raybestos, Napa, etc.

5.      60 - Pallets - Assorted Brake Cables: Bendix, Wagner, Raybestos, Napa, Brake Pro, etc. All types of applications for American, European, and Japanese vehicle applications. - $2,000.00 for a FULL Truckload (60 pallets) OR for smaller lots $59.00 per pallet.

6.      Engine Bearings: Federal Mogul, Sealed Power, Clevite, Perfect Circle, etc: Sold by the POUND $0.79 per pound. Each pallet is a mixture of engine bearings for American, European, and Japanese vehicle applications. ALL are in the original packaging. 80,000 pounds available.

7.      Brake Pads Sets- MAJOR Brands: Raybestos, EIS, Wagner (Auto pro), Federated, Chief (Raybestos), etc - $0.50 per set in lots of 5,000 pcs. All types of applications for American, European, and Japanese vehicle applications.

8.      Mixed Suspension Parts - $0.49 per pound. Assorted Brands: Sealed Power, TRW, Moog, McQuay Norris, Elgin, etc. All types of applications for American, European, and Japanese vehicle applications.

9.      Engine Parts: Federal Mogul, Sealed Power, Clevite, Perfect Circle, etc: Sold by the POUND $0.45 per pound. Each pallet is a mixture of engine parts: Timing chains, gears, valves, springs, rocker arms, push rods, and other internal engine parts  for American, European, and Japanese vehicle applications. ALL are in the original packaging. 80,000 pounds available.

10.     Clutch Discs & plates: BULK packed Borg Warner clutches. $0.50 per pound. All are NEW.

11.     Mixed Brake Master Clinders. Assorted brands. Each pallet is a mixture of engine bearings for American, European, and Japanese vehicle applications. ALL are in the original packaging. 1,000 pcs available. $9.00 each

12.     Mixed Wheel Cylinders: Assorted Brands: Bendix, Raybestos, Napa, Auto Specialty - $0.75 each. Each pallet is a mixture of engine bearings for American, European, and Japanese vehicle applications. ALL are in the original packaging. 15,000 pcs available.

13.     60 - Pallets - Assorted Brake caliper kits, wheel cylinder kits, master cylinder kits, clutch master cylinder kits. - $6,000.00 for a FULL Truckload (60 pallets)

14.     MIXED - 4 Seasons Reman AC Compressors: NO LIST - $14.00 each. Some with clutch, some without.

15.     Brake Shoe Sets- MAJOR Brands: Raybestos, EIS, Wagner (Auto pro), Federated, Chief (Raybestos), etc - $5,500.00 per TRUCKLOAD (60 pallets) . All types of applications for American, European, and Japanese vehicle applications.



If you are interested in pictures of any of the above-listed products, please e-mail me at glenn@xxxxxxxxxxxxxxxx

**** SPECIAL NOTE:  We have also launched on of the largest wholesale / retail on-line auction sites www.autopartauctions.com Please sign up today and take advantage of deep discounted prices on auto parts. NO MINIMUM PURCHASE REQUIRED.

Thanks.


***************
Worldwide Suppliers of SURPLUS / CLOSEOUT Automotive Parts.

Glenn Anthony
World Trading
12999 Executive Drive
Sugar Land, TX 77478 USA
Phone (281) 565-5457
Fax (281) 565-6636
Web Site http://www.surplusparts.com
E-Mail glenn@xxxxxxxxxxxxxxxx


*******************************************************************************
We are sorry if this message has reached you in error. This email list intended for automotive parts wholesalers, retailers, automotive parts buyers, car restoration enthusiasts, and wrencheads.
If you wish to be removed from our mailing list, please reply to this message with REMOVE in the subject line. If the phrase REMOVE is not in the subject line, your address will not be removed.




------------------------------

Message: 3
Date: Thu, 14 Sep 2006 17:55:55 +0900
From: Adrian < Cherie@xxxxxxx>
Subject: [Ethereal-users] Vacancies in Australia
To: ethereal-users@xxxxxxxxxxxx
Message-ID: <9DA0A392.6209900@xxxxxxx>
Content-Type: text/plain; charset="iso-8859-1"


  Join Numarkets and get involved into business gaining $30 billion per year!


  Australia is waiting for new employees!


  It is quite an innovative business solution recognized by the Entrepreneur
  Magazine  as "One of the hot 13 businesses of 2005" that has developed
  worldwide.


  The majority of sellers working on Internet marketplaces like eBay are not
  always aware of how to catalog their goods thus minimizing the profit.


  Being an inside-the-US company, Numarkets allows eBay customers sell all
  they need without effort.


  Today  Numarkets  has  expanded  even  outside the US and will keep on
  increasing.


  At present Numarkets offers the vacancies of administrative assistants, or
  customer service representatives on the territory of Australia for distant
  work,  to  assist  in  sales process and exclude inaccuracies from our
  commercial  service  devoted to people, companies and other commercial
  communities all over the globe.


  The highlights of this job include from daily to monthly supervision of
  particular assignments performance concerning the customer service for
  trading inside Australia.

  The main responsibilities:

  - supporting the sales office executing special projects, information input
  and other as determined

  - monitoring purchases and expenses data

  -  assistance in overall organizational tasks, among them - conducting
  correspondence, treatment of orders for goods and expenses accounts etc.

  - everyday Internet mailing


  Workin hours: full-time or part-time employment. Flextime allowed. Generally
  3 hours a day necessary for part-time operating, on weekdays.


  Payment: the base rate is 1,200AUD, with 5 percent additional commission for
  each effective sale.


  On average, the present Australian customer base can provide the general
  earnings increase up to fixed 1,800AUD a month.


  Place  of  work: distant work through Internet including all messages.
  Throughout the probation period phone-based support is possible.


  Necessary conditions: IAP available, Excel and great incentive to work.


  Promotion Possibility: obtain new skills performing at highly regarded
  global corporation. Numarkets will be launched in Australia the next year
  (2007).

  Be sure this will bring infinite opportunities for advance.


  Other  vacancies feature shop managers, sales experts, bookkeepers and
  accountants, financial analysts, web designers, advertisers and promoters,
  customer service, franchise specialists and legal services, sales support, a
  range of distant work positions etc.


  Expenses and charges: since our company covers all the expenses, you wonât
  carry any expenditure or pay any charges.


  More    Recruitment    Actions:    please   mail   your   resume   to:
  [1]hrdepartment@numarkets.us. If possible, mark which job you are interested
  in (part-time or full-time employment).

  On our examination the submission file you will get a reply in case you meet
  the requirements.


  The probation period for our new employees usually comes up to 1 month. For
  that period the worker will be given instructions and assistance on-line and
  draw salary.


  The decision on the employeeâs workability is made no less than 1 week
  before the probation period ends. In the probation time, dissolution of
  labor contract can be suggested from the part of the controlling person.


  At the end of the probation period, you can the go on working, have the
  probation  period  stretched or the contract cancelled - as it will be
  suggested by the controlling person. Once the probation period is up, your
  base rate grows bigger.


  The  following  is  the  e-mail  to  post  questions  or  your resume:
  [2]hrdepartment@ numarkets.us

  Best regards,

  Tracy Huston


  Authorization Settings

  You have been submitted to Numarkets. In case you suppose some error has
  occurred and you got this message by mistake or would not like to collect
  unexpected messages, please answer this note with delete in the subject
  line. We will update right away in view of that. Take our apologies for any
  trouble.

References

  1. mailto: hrdepartment@xxxxxxxxxxxx
  2. mailto: hrdepartment@xxxxxxxxxxxx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: /pipermail/attachments/20060914/ee741864/attachment.html

------------------------------

Message: 4
Date: Thu, 14 Sep 2006 08:02:54 -0400
From: "Michael Cobb" < mcobb@xxxxxxx>
Subject: RE: [Ethereal-users] How does Ethereal interact with Fedora
       Core?
To: "'Ethereal user support'" < ethereal-users@xxxxxxxxxxxx>
Message-ID: < 001201c6d7f5$b8b1feb0$3e1f1ea6@xxxxxxxxxxxx>
Content-Type: text/plain;       charset="us-ascii"

Thanks for a response.

It is UDP Multicast.

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, September 13, 2006 2:26 PM
To: Ethereal user support; Community support list for Wireshark
Subject: Re: [Ethereal-users] How does Ethereal interact with Fedora Core?

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Michael Cobb wrote:
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
>
>
> ------------------------------------------------------------------------
>
> Can anyone explain to me how Ethereal relates to Fedora?

The same way Wireshark relates to it (see the above note).  This
discussion should probably be continued on the wireshark-users mailing
list; I'm sending this to that list as well.

> At what OS
> level is displaying a capture from? I'm not a developer, but need to be
> certain that packets displayed by Ethereal are indeed being presented
> from the OS to an application that is running.

Wireshark (and Ethereal) capture traffic using the libpcap library; on
Linux, that works by opening a "PF_PACKET socket", from which it
receives the packets.

Packets delivered to a PF_PACKET socket aren't necessarily delivered to
some other socket; they might be delivered to a networking protocol such
as TCP or UDP, but that won't necessarily deliver them to a socket.

> I am currently sniffing and seeing the packets in Ethereal. However the
> developer of the application has inserted debugging code to display when
> it receives those packets, but it does not acknowledge receiving them. I
> need to determine if this means the problem is OS related or application
> related.

It's *probably* application-related.  Are the packets TCP, UDP, or some
other protocol?  Does the application have a socket open to receive
those packets?
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users



------------------------------

Message: 5
Date: Thu, 14 Sep 2006 10:12:59 -0500
From: "Linick, James (SED/WESTAR)" < james.linick@xxxxxxxxxxx>
Subject: [Ethereal-users] Can I open and then export a file from the
       command line?
To: < ethereal-users@xxxxxxxxxxxx>
Message-ID:
       < 3416952878223F4BA8D143D53A7D6BF102F2C28F@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain;       charset="us-ascii"

Is it possible to open a tcpdump file and export it to a PDML file from
the command line?


------------------------------

Message: 6
Date: Thu, 14 Sep 2006 09:26:52 -0700
From: Gerald Combs < gerald@xxxxxxxxxxxxx>
Subject: Re: [Ethereal-users] Can I open and then export a file from
       the     command line?
To: Ethereal user support < ethereal-users@xxxxxxxxxxxx>
Message-ID: <450982CC.6060609@xxxxxxxxxxxxx>
Content-Type: text/plain; charset=ISO-8859-1

Linick, James (SED/WESTAR) wrote:
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> Is it possible to open a tcpdump file and export it to a PDML file from
> the command line?

Sure!  First, upgrade to Wireshark.  As the message above indicates,
development under the name "Ethereal" has ceased.  Then use TShark to
read the file and print to pdml:

   tshark -nr /path/to/tcpdump_file.pcap -T pdml

The TShark manual page can be found online at

   http://www.wireshark.org/docs/man-pages/tshark.html



------------------------------

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users


End of Ethereal-users Digest, Vol 41, Issue 13
**********************************************

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users