Wireshark-users: Re: [Wireshark-users] remote capture with a pipe: "unrecognized libpcap format"
On Oct 23, 2008, at 7:44 AM, KaZ wrote:
This version of snoop can only save packets in a file (or display a
cleaned up version of the packets, so no libpcap format to stdout).
(Well, you could try writing to the "file" named "/dev/stdout".)
The file is in the libpcap format
No, it's not, it's in snoop format. Snoop format is documented in
RFCs 1761 and 3827; libpcap format is documented at
http://wiki.wireshark.org/Development/LibpcapFileFormat
and in the pcap-savefile man page I just checked into the libpcap main
and 1.0 branches (and there was much rejoicing :-)).
(I can open it with Wireshark).
Wireshark can read a *lot* of capture file formats, including libpcap
(its native format) and snoop; "I can open it with Wireshark" does not
imply "it's in libpcap format".
When the first packet arrives, wireshark displays "unrecognized
libpcap format".
That error message needs to be fixed to indicate that the problem is
that it's not libpcap format at all. Wireshark only supports reading
libpcap format from a pipe - the heuristics it uses to determine the
file type when reading regular capture files involve having the
handler for each file type read the file, starting from the beginning,
and that's done by seeking to the beginning of the file before each
handler; you can't seek on a pipe. (If we had an underlying buffered
I/O layer that supported seeking within a buffer *and* having a large-
enough buffer, it could be done; we don't currently have that.)
Any ideas what I could try? Do you know where I can find a precompiled
tcpdump or tshark for solaris 10 / SPARC (maybe the problem is with
snoop)?
Yes, the problem is with snoop, and the problem is that it doesn't
write files in libpcap format and Wireshark doesn't support capture-
from-a-pipe for anything other than libpcap format.
tcpdump is available for Solaris 10 on x86 from
http://www.sunfreeware.com/programlistintel10.html
and for Solaris 10 on SPARC from
http://www.sunfreeware.com/programlistsparc10.html
Remember to run it with "-s 0" so that it writes out the *entire*
packet, not just the default first 64 or 96 bytes of the packet. On
the Mac, do
ssh username@remoteIP "tcpdump -s 0 -i cd4 -w - port 5060" >/tmp/
wireshark_pipe
and then capture from /tmp/wireshark_pipe.
