© 2006, The Technology Firm Ethereal The Technology Firm.

© 2006, The Technology Firm WWW.THETECHFIRM.COM

Ethereal

The Technology Firm


What is Ethereal (From Docs.)

Ethereal is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file.

Ethereal knows how to read libpcap capture files, including those of tcpdump, snoop (including Shomiti) and atmsnoop, LanAlyzer, Sniffer (compressed or uncompressed), Microsoft Network Monitor, AIX's iptrace, NetXray, Sniffer Pro, Etherpeek, RADCOM's WAN/LAN analyzer, Lucent/Ascend router debug output, HP-UX's nettl, the dump output from Toshiba's ISDN routers, the output from i4btrace from the ISDN4BSD project, the output in IPLog format from the Cisco Secure Intrusion Detection System, and pppd logs (pppdump format).

Display filters in Ethereal are very powerful; more fields are filterable in Ethereal than in other protocol analyzers, and the syntax you can use to create your filters is richer. As Ethereal progresses, expect more and more protocol fields to be allowed in display filters.

Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the display filter syntax.


Ethereal Screen Layout

A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in.

a hex dump shows you exactly what the packet looks like when it goes over the wire.

The summary line, briefly describing what the packet is.

Filename Of Current File


Edit -> Preferences -> Columns

This screen allows you to add or move columns around.

For consistency, I always recommend you name your columns the same as the descriptions noted in the ‘pull down’ menu.


Neat Feature – ‘Sorting Columns’

Output is Sorted By Frame No By Default

After Sorting By Info

Click Info Header


Neat Feature – ‘Drag and Drop’ You can now drag and drop a file from Windows Explorer directly into Ethereal.


Neat Feature – ‘Follow TCP Stream’

See the next slide for the results,


Neat Feature – ‘Conversation List’ You can now see a list of all the TCP, IP or MAC addresses.


Results for Follow TCP Stream By default the red text is the data received by the client. This color/feature may be modified via the Edit->Preferences->TCP Streams menu.


How To Use The ‘Decode As’ Feature


How To Rebuild A Captured Web Page

Using Ethereal


1. Select ‘Follow TCP Stream’


2. Select Save As And Provide A HTML Extension


3. Open Newly Created file


Capture Filters Seems complicated at best. The capture filter syntax follows the rules of the pcap library This syntax is different from the display filter syntax. Ethereal documentation asks you to check the manual page of tcpdump Sample filters

src ip 192.168.1.1 ether src 00:50:BA:48:B5:EF


More On Capture Filters A capture filter for HTTP than captures traffic to and from a particular host

tcp port 80 and host 10.10.10.5 A capture filter for HTTP than captures traffic not from a particular host

tcp port 80 and not host 10.10.10.5 A capture filter to and from an ethernet address

ether 00:00:01:01:02:22


Display Filter Comparison Operators

The comparison operators can be expressed either through C-like symbols, or through English-like abbreviations:

eq, == Equal ne, != Not equal gt, > Greater than lt, < Less Than ge, >= Greater than or Equal to le, <= Less than or Equal to


GUI Display Filter


Match Selected – Quick Display Filter

Quick Way to Learn Display Filter Commands


Save Selected Frames - OPE

1. Go to File -> Save Capture.

2. In the next screen, select the From Frame ID# radio button and enter the frame number range.

3. Provide location and File Name.1

2

3


How To Define A Capture FilterUsing

Ethereal


Figure Out Your MAC Address Go to your command prompt and type “ipconfig /all” (without the quotes).

The resulting display will contain the following info:

1 Ethernet Adapter :

Description . . . . . . . . : Xircom CardBus Ethernet 10/100 Adapter

Physical Address. . . . . . : 00-10-A4-E4-43-02

DHCP Enabled. . . . . . . . : Yes


The Correct Way…


The Wrong Way…


References http://www.ethereal.com. ….\ethereal.html .….\editcap.html .….\tethereal.html .….\text2pcap.html

© 2006, The Technology Firm Ethereal The Technology Firm.

Documents

technology firm

ethereal slide

feature slide

tcp stream slide

created file slide

info header slide

html extension slide

ethereal progresses