Experimental WireShark version with user interface list and remote capture (RPCAP) support
Hi all,
Subj can be download from here. It's Win32 version.
Sorry I did not create installer version so just unpack archive to any directory and start
wireshark.exe.
Local installed WinPCAP required. If you do not know how to install WinPCAP just run regular WireShark installation (0.99.6 recommended). It'll do everything needed.
If you want capture from remote Windows PC go to WinPCAP installation directory on remote PC and start rpcapd.exe. Copy from your Windows PC should also work.
To remote capture from Linux PC rpcapd should be started. Check for information how to build rpcapd for linux
here.
I have compiled development version of rpcapd for FC4 (can work on other linux'es as well). Available
here.
You need to use -n flag for now when rpcapd started. Read documentation (link I posted above) if have any questions on rpcapd.
After you start rpcapd, lunch my version of wireshark. Go Properties->Capture->Edit..... You'll find a way to add new remote interface.
Then go to Capture->Interfaces you'll see new interface in list. It should work as regular interface.
Any feedback very appreciated. It'll push me to clean the code and release to public.
_______________________________________________ Wireshark-users mailing list Wireshark-users <at> wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
It appears, from the packets you sent in your other message (which
would've been less confusing if you'd sent it as a reply to your own
message) that the PPPoE header, as captured, is bogus; it claims that
the payload length is 14 bytes, not 1294 bytes.
I don't know whether that's because the payload length is really wrong
on the wire, or because the Linux PPPoE implementation just tweaks the
PPPoE header in-place before the packet gets handed to the socket layer
(and thus to libpcap and thus tcpdump/Wireshark/whatever program is
capturing).
I would not be in the least surprised to find that it's the latter, as
we've had problems with captures done on Linux before this, for the same
reason. I thought there was copy-on-write logic that would prevent
modified-in-place packets from being handed to programs capturing
traffic, but I guess it either doesn't exist or isn't being used.
_______________________________________________
Wireshark-users mailing list
Wireshark-users <at> wireshark.org
RSS Feed