The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. You will also gain access to thousands of other FAQs at ITFAQnet.com.
1.
|
How does Ethereal know when a dissector should be called?
|
|
2.
|
Where do you locate the design document for developing Ethereal?
|
|
3.
|
How do you pass information from one dissector to another?
|
|
4.
|
How do I know what functions are provided by Ethereal?
|
|
5.
|
Can I build Ethereal with Microsoft Visual C++?
|
|
6.
|
Where can I find more information on programming the GUI?
|
|
Answers
1.
|
The dissector_add function defines the condition in which the dissector should be called.
|
2.
|
There really isn’t a design document, but the README.developer document and the other documents contained in the doc directory contain useful information.
|
3.
|
By using the pinfo->private_data to pass a pointer to the other dissectors data.
|
4.
|
We have tried to list many of the common ones within this chapter, but for a complete listing you should look at the header files of the source for all exports. Exports are the mechanism that allows you to define the public functions that will be available to the rest of the application. Functions that are not exported are limited in visibility to the module in which they are defined. Although they may be limited in their visibility, it is important that you do not create a function within your dissector that might conflict with a public function that has been exported. This is one of the reasons why you should declare your private functions as static unless you plan to export the function for use with other Ethereal modules.
|
5.
|
Yes, you just need to make sure you have all of the required libraries and tools. It is important to realize that building under Microsoft Visual C++ does not include using the visual studio environment. Building Ethereal utilizes the command line interface and you build Ethereal.exe with nmake.exe. Ethereal does not include any visual studio workspace or configuration files to be used with the visual studio GUI. To build Ethereal under Microsoft Visual C++ you open a CMD window and then navigate to the main source directory of Ethereal. Finally you execute nmake with the syntax – nmake –f makefile.nmake.
|
6.
|
The GTK website has development tutorials and examples at www.gtk.org
|
Appendix: Supported Protocols
This section lists the 400+ protocols, by description, that are supported by Ethereal protocol decoders. The display fields, field values, and elongated descriptions of each protocol can be found on the accompanying CD-ROM in the /filters folder of Chapter 5.
Ethereal 0.10.0a provides 483 protocol keywords. This list shows the protocol names and descriptions.
aal1 ATM AAL1
aal3_4 ATM AAL3/4
aarp AppleTalk Address Resolution Protocol
acap Application Configuration Access Protocol
acn ACN
afp AppleTalk Filing Protocol
afs Andrew File System (AFS)
ah Authentication Header
aim AOL Instant Messenger
ajp13 Apache JServ Protocol v1.3
alcap AAL type 2 signaling protocol - Capability set 1 (Q.2630.1)
ans Intel ANS probe
ansi_637_tele ANSI IS-637-A (SMS) Teleservice Layer
ansi_637_trans ANSI IS-637-A (SMS) Transport Layer
ansi_683 ANSI IS-683-A (OTA (Mobile))
ansi_a_bsmap ANSI A-I/F BSMAP
ansi_a_dtap ANSI A-I/F DTAP
ansi_map ANSI Mobile Application Part
aodv Ad hoc On-demand Distance Vector Routing Protocol
arcnet ARCNET
arp Address Resolution Protocol
artnet Art-Net
asap Aggregate Server Access Protocol
ascend Lucent/Ascend debug output
asf Alert Standard Forum
asn1 ASN.1 decoding
asp AppleTalk Session Protocol
atm ATM
atp AppleTalk Transaction Protocol packet
atsvc Microsoft Task Scheduler Service
auto_rp Cisco Auto-RP
bacapp Building Automation and Control Network APDU
bacnet Building Automation and Control Network NPDU
bacp PPP Bandwidth Allocation Control Protocol
bap PPP Bandwidth Allocation Protocol
beep Blocks Extensible Exchange Protocol
bfdcontrol Bi-directional Fault Detection Control Message
bgp Border Gateway Protocol
bicc Bearer Independent Call Control
bofl Wellfleet Breath of Life
bootp Bootstrap Protocol
bootparams Boot Parameters
bossvr DCE/RPC BOS Server
brdwlk Boardwalk
browser Microsoft Windows Browser Protocol
bssap BSSAP/BSAP
bssgp BSS GPRS Protocol
budb DCE/RPC BUDB
butc DCE/RPC BUTC
bvlc BACnet Virtual Link Control
cbcp PPP Callback Control Protocol
ccp PPP Compression Control Protocol
CCSDS CCSDS
cdp Cisco Discovery Protocol
cdpcp PPP CDP Control Protocol
cds_clerkserver CDS Clerk Server Calls
cds_solicit DCE/RPC CDS Solicitation
cflow Cisco NetFlow
cgmp Cisco Group Management Protocol
chap PPP Challenge Handshake Authentication Protocol
chdlc Cisco HDLC
cldap Connectionless Lightweight Directory Access Protocol
clearcase Clearcase NFS
clnp ISO 8473 CLNP ConnectionLess Network Protocol
cltp ISO 8602 CLTP ConnectionLess Transport Protocol
comp_data PPP Compressed Datagram
conv DCE/RPC Conversation Manager
cops Common Open Policy Service
cosine CoSine IPNOS L2 debug output
cotp ISO 8073 COTP Connection-Oriented Transport Protocol
cpfi Cross Point Frame Injector
cpha Check Point High Availability Protocol
cprpc_server DNS Control Program Server
cups Common Unix Printing System (CUPS) Browsing Protocol
data Data
dccp Distributed Checksum Clearinghouse Protocol
dce_dfs DCE DFS Calls
dce_update DCE/RPC UpServer
dcerpc DCE RPC
ddp Datagram Delivery Protocol
ddtp Dynamic DNS Tools Protocol
dec_stp DEC Spanning Tree Protocol
dfs Microsoft Distributed File System
dhcpv6 DHCPv6
diameter Diameter Protocol
distcc Distcc Distributed Compiler
dlsw Data Link SWitching
dns Domain Name Service
dnsserver Windows 2000 DNS
docsis DOCSIS 1.1
docsis_bpkmattr DOCSIS Baseline Privacy Key Management Attributes
docsis_bpkmreq DOCSIS Baseline Privacy Key Management Request
docsis_bpkmrsp DOCSIS Baseline Privacy Key Management Response
docsis_dsaack DOCSIS Dynamic Service Addition Acknowledge
docsis_dsareq DOCSIS Dynamic Service Addition Request
docsis_dsarsp DOCSIS Dynamic Service Addition Response
docsis_dscack DOCSIS Dynamic Service Change Acknowledgement
docsis_dscreq DOCSIS Dynamic Service Change Request
docsis_dscrsp DOCSIS Dynamic Service Change Response
docsis_dsdreq DOCSIS Dynamic Service Delete Request
docsis_dsdrsp DOCSIS Dynamic Service Delete Response
docsis_map DOCSIS Upstream Bandwidth Allocation
docsis_mgmt DOCSIS Mac Management
docsis_regack DOCSIS Registration Acknowledge
docsis_regreq DOCSIS Registration Requests
docsis_regrsp DOCSIS Registration Responses
docsis_rngreq DOCSIS MAP Messages
docsis_rngrsp DOCSIS Ranging Response
docsis_tlv DOCSIS Appendix C TLV’s
docsis_uccreq DOCSIS Upstream Channel Change Request
docsis_uccrsp DOCSIS Upstream Channel Change Response
docsis_ucd DOCSIS Upstream Channel Descriptor
docsis_vsif DOCSIS Vendor Specific Endodings
drsuapi Microsoft Directory Replication Service
dsi Data Stream Interface
dtsprovider DCE Distributed Time Service Provider
dtsstime_req DCE Distributed Time Service Local Server
dvmrp Distance Vector Multicast Routing Protocol
eap Extensible Authentication Protocol
eapol 802.1x Authentication
echo Echo
edonkey eDonkey Protocol
eigrp Enhanced Interior Gateway Routing Protocol
els FC Extended Link Svc
enc OpenBSD Encapsulating Device
enip EtherNet/IP (Industrial Protocol)
enttec ENTTEC
epm DCE/RPC Endpoint Mapper
epm4 DCE/RPC Endpoint Mapper4
esis ISO 9542 ESIS Routing Information Exchange Protocol
esp Encapsulating Security Payload
eth Ethernet
etherip Ethernet over IP
fc Fiber Channel
FCdNS Fiber Channel Name Server
fcct Fiber Channel Common Transport
fcip FCIP
fcp Fibre Channel Protocol for SCSI
fcs FC Fabric Configuration Server
fcsp Fiber Channel Security Protocol
fddi Fiber Distributed Data Interface
fix Financial Information eXchange Protocol
fldb DCE/RPC FLDB
fr Frame Relay
frame Frame
ftp File Transfer Protocol (FTP)
ftp-data FTP Data
ftserver FTServer Operations
fw1 Checkpoint FW-1
FZS Fibre Channel Fabric Zone Server
giop General Inter-ORB Protocol
giop-coseventcomm Coseventcomm Dissector Using GIOP API
giop-cosnaming Cosnaming Dissector Using GIOP API
gmrp GARP Multicast Registration Protocol
gnutella Gnutella Protocol
gprs_ns GPRS Network service
gre Generic Routing Encapsulation
gryphon DG Gryphon Protocol
gsm_a_bssmap GSM A-I/F BSSMAP
gsm_a_dtap GSM A-I/F DTAP
gsm_a_rp GSM A-I/F RP
gsm_map GSM Mobile Application Part
gsm_sms GSM SMS TPDU (GSM 03.40)
gss-api Generic Security Service Application Program Interface
gtp GPRS Tunneling Protocol
gvrp GARP VLAN Registration Protocol
h1 Sinec H1 Protocol
h225 H225
h245 H245
h261 ITU-T Recommendation H.261
h263 ITU-T Recommendation H.263 RTP Payload header (RFC2190)
h4501 H4501
hclnfsd Hummingbird NFS Daemon
hpext HP Extended Local-Link Control
hsrp Cisco Hot Standby Router Protocol
http Hypertext Transfer Protocol
hyperscsi HyperSCSI
iapp Inter-Access-Point Protocol
ib Interbase
icap Internet Content Adaptation Protocol
icl_rpc DCE/RPC ICL RPC
icmp Internet Control Message Protocol
icmpv6 Internet Control Message Protocol v6
icp Internet Cache Protocol
icq ICQ Protocol
igap Internet Group Membership Authentication Protocol
igmp Internet Group Management Protocol
igrp Cisco Interior Gateway Routing Protocol
ilmi ILMI
imap Internet Message Access Protocol
initshutdown Remote Shutdown
ip Internet Protocol
ipcomp IP Payload Compression
ipcp PPP IP Control Protocol
ipfc IP Over FC
ipmi Intelligent Platform Management Interface
ipp Internet Printing Protocol
ipv6 Internet Protocol Version 6
ipv6cp PPP IPv6 Control Protocol
ipx Internetwork Packet eXchange
ipxmsg IPX Message
ipxrip IPX Routing Information Protocol
ipxsap Service Advertisement Protocol
ipxwan IPX WAN
irc Internet Relay Chat
isakmp Internet Security Association and Key Management Protocol
iscsi iSCSI
isdn ISDN
isis ISO 10589 ISIS InTRA Domain Routing Information Exchange Protocol
isl Cisco ISL
isns iSNS
isup ISDN User Part
iua ISDN Q.921-User Adaptation Layer
jabber Jabber XML Messaging
kadm5 Kerberos Administration
kerberos Kerberos
klm Kernel Lock Manager
kpasswd MS Kpasswd
krb5rpc DCE/RPC Kerberos V
l2tp Layer 2 Tunneling Protocol
lacp Link Aggregation Control Protocol
lane ATM LAN Emulation
lanman Microsoft Windows Lanman Remote API Protocol
lapb Link Access Procedure Balanced (LAPB)
lapbether Link Access Procedure Balanced Ethernet (LAPBETHER)
lapd Link Access Procedure, Channel D (LAPD)
laplink Laplink
lcp PPP Link Control Protocol
ldap Lightweight Directory Access Protocol
ldp Label Distribution Protocol
llap LocalTalk Link Access Protocol
llc Logical-Link Control
lmi Local Management Interface
lmp Link Management Protocol (LMP)
lpd Line Printer Daemon Protocol
lsa Microsoft Local Security Architecture
lsa_ds Microsoft Local Security Architecture (Directory Services)
lwapp LWAPP Encapsulated Packet
lwapp-cntl LWAP Control Message
lwapp-l3 LWAPP Layer 3 Packet
lwres Light Weight DNS RESolver (BIND9)
m2pa MTP2 Peer Adaptation Layer
m2tp MTP 2 Transparent Proxy
m2ua MTP 2 User Adaptation Layer
m3ua MTP 3 User Adaptation Layer
mailslot SMB MailSlot Protocol
malformed Malformed Packet
mapi Microsoft Exchange MAPI
mbtcp Modbus/TCP
mdshdr MDS Header
megaco MEGACO
messenger Microsoft Messenger Service
mgcp Media Gateway Control Protocol
mgmt DCE/RPC Remote Management
mip Mobile IP
mipv6 Mobile IPv6
mmse MMS Message Encapsulation
mount Mount Service
mp PPP Multilink Protocol
mpeg1 RFC 2250 MPEG1
mpls MultiProtocol Label Switching Header
mplscp PPP MPLS Control Protocol
mrdisc Multicast Router DISCovery protocol
msdp Multicast Source Discovery Protocol
msnip MSNIP: Multicast Source Notification of Interest Protocol
msnms MSN Messenger Service
msproxy MS Proxy Protocol
mtp2 Message Transfer Part Level 2
mtp3 Message Transfer Part Level 3
mtp3mg Message Transfer Part Level 3 Management
mysql MySQL Protocol
nbdgm NetBIOS Datagram Service
nbipx NetBIOS over IPX
nbns NetBIOS Name Service
nbp Name Binding Protocol
nbss NetBIOS Session Service
ncp NetWare Core Protocol
ndmp Network Data Management Protocol
ndps Novell Distributed Print System
netbios NetBIOS
netlogon Microsoft Windows Logon Protocol
nfs Network File System
nfsacl NFSACL
nfsauth NFSAUTH
nisplus NIS+
nispluscb NIS+ Callback
nlm Network Lock Manager Protocol
nlsp NetWare Link Services Protocol
nmpi Name Management Protocol over IPX
nntp Network News Transfer Protocol
nspi NSPI
ntlmssp NTLM Secure Service Provider
ntp Network Time Protocol
null Null/Loopback
oamaal ATM OAM AAL
ospf Open Shortest Path First
oxid DCOM OXID Resolver
pap PPP Password Authentication Protocol
pcli Packet Cable Lawful Intercept
pcnfsd PC NFS
per Packed Encoding Rules (ASN.1 X.691)
pflog OpenBSD Packet Filter log file
pflog-old OpenBSD Packet Filter log file, pre 3.4
pgm Pragmatic General Multicast
pim Protocol Independent Multicast
pipe SMB Pipe Protocol
pop Post Office Protocol
portmap Portmap
ppp Point-to-Point Protocol
pppmux PPP Multiplexing
pppmuxcp PPPMux Control Protocol
pppoed PPP-over-Ethernet Discovery
pppoes PPP-over-Ethernet Session
pptp Point-to-Point Tunneling Protocol
prism Prism
q2931 Q.2931
q931 Q.931
q933 Q.933
qllc Qualified Logical Link Control
quake Quake Network Protocol
quake2 Quake II Network Protocol
quake3 Quake III Arena Network Protocol
quakeworld QuakeWorld Network Protocol
radius Radius Protocol
ranap Radio Access Network Application Part
raw Raw packet data
raw_sip Session Initiation Protocol (SIP as raw text)
rdm RDM
remact DCOM Remote Activation
rep_proc AFS (4.0) Replication Server call declarations
rip Routing Information Protocol
ripng RIPng
rlogin Rlogin Protocol
rmcp Remote Management Control Protocol
rmi Java RMI
rmp HP Remote Maintenance Protocol
roverride Remote Override interface
rpc Remote Procedure Call
rpc_browser RPC Browser
rpc_netlogon Microsoft Network Logon
rpl Remote Program Load
rpriv Privilege Server Operations
rquota Remote Quota
rs_acct DCE/RPC RS_ACCT
rs_attr Registry Server Attributes Manipulation Interface
rs_bind DCE/RPC RS_BIND
rs_misc DCE/RPC RS_MISC
rs_pgo DCE Name Service
rs_plcy RS Interface Properties
rs_prop_acct DCE/RPC RS_PROP_ACCT
rs_repadm Registry server administration operations.
rs_replist DCE/RPC Repserver Calls
rs_unix DCE/RPC RS_UNIX
rsec_login Remote sec_login preauth interface.
rsh Remote Shell
rstat RSTAT
rsvp Resource ReserVation Protocol (RSVP)
rsync RSYNC File Synchroniser
rtcfg RTCFG
rtcp Real-time Transport Control Protocol
rtmp Routing Table Maintenance Protocol
rtnet RTNET
rtp Real-Time Transport Protocol
rtpevent RFC 2833 RTP Event
rtsp Real Time Streaming Protocol
rwall Remote Wall Protocol
rx RX Protocol
sadmind SADMIND
samr Microsoft Security Account Manager
sap Session Announcement Protocol
sb3 Fiber Channel Single Byte Command
sccp Signaling Connection Control Part
sccpmg Signaling Connection Control Part Management
scsi SCSI
sctp Stream Control Transmission Protocol
sdlc Synchronous Data Link Control (SDLC)
sdp Session Description Protocol
sebek SEBEK - Kernel Data Capture
secidmap DCE Security ID Mapper
serialization Java Serialization
ses ISO 8327-1 OSI Session Protocol
sflow InMon sFlow
sgimount SGI Mount Service
short Short Frame
sip Session Initiation Protocol
skinny Skinny Client Control Protocol
slarp Cisco SLARP
slimp3 SliMP3 Communication Protocol
sll Linux cooked-mode capture
smb SMB (Server Message Block Protocol)
smpp Short Message Peer to Peer
smtp Simple Mail Transfer Protocol
smux SNMP Multiplex Protocol
sna Systems Network Architecture
sna_xid Systems Network Architecture XID
snaeth SNA-over-Ethernet
snmp Simple Network Management Protocol
socks Socks Protocol
sonmp Nortel SONMP
spnego Spnego
spnego-krb5 SPNEGO-KRB5
spoolss Microsoft Spool Subsystem
spray SPRAY
spx Sequenced Packet eXchange
srvloc Service Location Protocol
srvsvc Microsoft Server Service
sscop SSCOP
ssh SSH Protocol
ssl Secure Socket Layer
stat Network Status Monitor Protocol
statnotify Network Status Monitor CallBack Protocol
stp Spanning Tree Protocol
stun Simple Traversal of UDP Through NAT
sua SS7 SCCP-User Adaptation Layer
svcctl Microsoft Service Control
swils Fiber Channel SW_ILS
syslog Syslog message
t38 T38
tacacs TACACS
tacplus TACACS+
tapi Microsoft Telephony API Service
tcap Transaction Capabilities Application Part
tcp Transmission Control Protocol
tds Tabular Data Stream
telnet Telnet
teredo TEREDO Tunneling IPv6 over UDP through NATs
tftp Trivial File Transfer Protocol
time Time Protocol
tkn4int DCE/RPC TokenServer Calls
tns Transparent Network Substrate Protocol
tpcp Alteon - Transparent Proxy Cache Protocol
tpkt TPKT
tr Token-Ring
trmac Token-Ring Media Access Control
tsp Time Synchronization Protocol
tzsp Tazmen Sniffer Protocol
ubikdisk DCE/RPC FLDB UBIK TRANSFER
ubikvote DCE/RPC FLDB UBIKVOTE
ucp Universal Computer Protocol
udp User Datagram Protocol
udpencap UDP Encapsulation of IPsec Packets
unreassembled Un-reassembled Fragmented Packet
v120 Async data over ISDN (V.120)
vines_arp Banyan Vines ARP
vines_echo Banyan Vines Echo
vines_frp Banyan Vines Fragmentation Protocol
vines_icp Banyan Vines ICP
vines_ip Banyan Vines IP
vines_ipc Banyan Vines IPC
vines_llc Banyan Vines LLC
vines_rtp Banyan Vines RTP
vines_spp Banyan Vines SPP
vj PPP VJ Compression
vlan 802.1q Virtual LAN
vrrp Virtual Router Redundancy Protocol
vtp Virtual Trunking Protocol
wap-wsp Wireless Session Protocol
wap-wsp-wtp Wireless Transaction Protocol
wap-wtls Wireless Transport Layer Security
wbxml WAP Binary XML
wccp Web Cache Coordination Protocol
wcp Wellfleet Compression
whdlc Wellfleet HDLC
who Who
winreg Microsoft Registry
wkssvc Microsoft Workstation Service
wlan IEEE 802.11 wireless LAN
wlan_mgt IEEE 802.11 wireless LAN management frame
wlancap AVS WLAN Capture header
x.25 X.25
x.29 X.29
x11 X11
xdmcp X Display Manager Control Protocol
xot X.25 over TCP
xyplex Xyplex
yhoo Yahoo Messenger Protocol
ymsg Yahoo YMSG Messenger Protocol
ypbind Yellow Pages Bind
yppasswd Yellow Pages Password
ypserv Yellow Pages Service
ypxfr Yellow Pages Transfer
zebra Zebra Protocol
zip Zone Information Protocol