Document Outline

• Ethereal User's Guide
• Table of Contents
• Preface
  • 1. Foreword
  • 2. Who should read this document?
  • 3. Acknowledgements
  • 4. About this document
  • 5. Where to get the latest copy of this document?
  • 6. Providing feedback about this document
• Chapter 1. Introduction
  • 1.1. What is Ethereal?
    • 1.1.1. Some intended purposes
    • 1.1.2. Features
    • 1.1.3. Live capture from many different network media
    • 1.1.4. Import files from many other capture programs
    • 1.1.5. Export files for many other capture programs
    • 1.1.6. Many protocol decoders
    • 1.1.7. Open Source Software
    • 1.1.8. What Ethereal is not
  • 1.2. Platforms Ethereal runs on
    • 1.2.1. Unix
    • 1.2.2. Linux
    • 1.2.3. Microsoft Windows
  • 1.3. Where to get Ethereal?
  • 1.4. A rose by any other name
  • 1.5. A brief history of Ethereal
  • 1.6.  Development and maintenance of Ethereal
  • 1.7. Reporting problems and getting help
    • 1.7.1. Website
    • 1.7.2. Wiki
    • 1.7.3. FAQ
    • 1.7.4. Mailing Lists
    • 1.7.5. Reporting Problems
    • 1.7.6. Reporting Crashes on UNIX/Linux platforms
    • 1.7.7. Reporting Crashes on Windows platforms
• Chapter 2. Building and Installing Ethereal
  • 2.1. Introduction
  • 2.2. Obtaining the source and binary distributions
  • 2.3. Before you build Ethereal under UNIX
  • 2.4. Building Ethereal from source under UNIX
  • 2.5. Installing the binaries under UNIX
    • 2.5.1. Installing from rpm's under RedHat and alike
    • 2.5.2. Installing from deb's under Debian
  • 2.6. Troubleshooting during the install on Unix
  • 2.7. Building from source under Windows
  • 2.8. Installing Ethereal under Windows
    • 2.8.1. Install Ethereal
      • 2.8.1.1. Command line options
      • 2.8.1.2. Components
    • 2.8.2. Install WinPcap
      • 2.8.2.1. Manual WinPcap Installation
    • 2.8.3. Update Ethereal
    • 2.8.4. Update WinPcap
    • 2.8.5. Uninstall Ethereal
    • 2.8.6. Uninstall WinPcap
• Chapter 3. User Interface
  • 3.1. Introduction
  • 3.2. Start Ethereal
  • 3.3. The Main window
  • 3.4. The Menu
  • 3.5. The "File" menu
  • 3.6. The "Edit" menu
  • 3.7. The "View" menu
  • 3.8. The "Go" menu
  • 3.9. The "Capture" menu
  • 3.10. The "Analyze" menu
  • 3.11. The "Statistics" menu
  • 3.12. The "Help" menu
  • 3.13. The "Main" toolbar
  • 3.14. The "Filter" toolbar
  • 3.15. The "Packet List" pane
  • 3.16. The "Packet Details" pane
  • 3.17. The "Packet Bytes" pane
  • 3.18. The Statusbar
• Chapter 4. Capturing Live Network Data
  • 4.1. Introduction
  • 4.2. Prerequisites
  • 4.3. Start Capturing
  • 4.4. The "Capture Interfaces" dialog box
  • 4.5. The "Capture Options" dialog box
    • 4.5.1. Capture frame
    • 4.5.2. Capture File(s) frame
    • 4.5.3. Stop Capture... frame
    • 4.5.4. Display Options frame
    • 4.5.5. Name Resolution frame
    • 4.5.6. Buttons
  • 4.6. Capture files and file modes
  • 4.7. Link-layer header type
  • 4.8. Filtering while capturing
  • 4.9. While a Capture is running ...
    • 4.9.1. Stop the running capture
    • 4.9.2. Restart a running capture
• Chapter 5. File Input / Output and Printing
  • 5.1. Introduction
  • 5.2. Open capture files
    • 5.2.1. The "Open Capture File" dialog box
    • 5.2.2. Input File Formats
  • 5.3. Saving captured packets
    • 5.3.1. The "Save Capture File As" dialog box
    • 5.3.2. Output File Formats
  • 5.4. Merging capture files
    • 5.4.1. The "Merge with Capture File" dialog box
  • 5.5. File Sets
    • 5.5.1. The "List Files" dialog box
  • 5.6. Exporting data
    • 5.6.1. The "Export as Plain Text File" dialog box
    • 5.6.2. The "Export as PostScript File" dialog box
    • 5.6.3. The "Export as CSV (Comma Seperated Values) File" dialog box
    • 5.6.4. The "Export as PSML File" dialog box
    • 5.6.5. The "Export as PDML File" dialog box
    • 5.6.6. The "Export selected packet bytes" dialog box
  • 5.7. Printing packets
    • 5.7.1. The "Print" dialog box
  • 5.8. The Packet Range frame
  • 5.9. The Packet Format frame
• Chapter 6. Working with captured packets
  • 6.1. Viewing packets you have captured
  • 6.2. Filtering packets while viewing
  • 6.3. Building display filter expressions
    • 6.3.1. Display filter fields
    • 6.3.2. Comparing values
    • 6.3.3. Combining expressions
    • 6.3.4. A common mistake
  • 6.4. The "Filter Expression" dialog box
  • 6.5. Defining and saving filters
  • 6.6. Finding packets
    • 6.6.1. The "Find Packet" dialog box
    • 6.6.2. The "Find Next" command
    • 6.6.3. The "Find Previous" command
  • 6.7. Go to a specific packet
    • 6.7.1. The "Go Back" command
    • 6.7.2. The "Go Forward" command
    • 6.7.3. The "Go to Packet" dialog box
    • 6.7.4. The "Go to Corresponding Packet" command
    • 6.7.5. The "Go to First Packet" command
    • 6.7.6. The "Go to Last Packet" command
  • 6.8. Marking packets
  • 6.9. Time display formats and time references
    • 6.9.1. Packet time referencing
• Chapter 7. Advanced Features
  • 7.1. Introduction
  • 7.2. Following TCP streams
    • 7.2.1. The "Follow TCP stream" dialog box
  • 7.3. Packet Reassembling
    • 7.3.1. What is it?
    • 7.3.2. How Ethereal handles it
    • 7.3.3. Reassembling is disabled by default!
  • 7.4. Name Resolution
    • 7.4.1. Ethernet name resolution (MAC layer)
    • 7.4.2. IP name resolution (network layer)
    • 7.4.3. IPX name resolution (network layer)
    • 7.4.4. TCP/UDP port name resolution (transport layer)
• Chapter 8. Statistics
  • 8.1. Introduction
  • 8.2. The "Summary" window
  • 8.3. The "Protocol Hierarchy" window
  • 8.4. Endpoints
    • 8.4.1. What is an Endpoint?
    • 8.4.2. The "Endpoints" window
    • 8.4.3. The protocol specific "Endpoint List" windows
  • 8.5. Conversations
    • 8.5.1. What is a Conversation?
    • 8.5.2. The "Conversations" window
    • 8.5.3. The protocol specific "Conversation List" windows
  • 8.6. The "IO Graphs" window
  • 8.7. Service Response Time
    • 8.7.1. The "Service Response Time DCE-RPC" window
  • 8.8. The protocol specific statistics windows
• Chapter 9. Customizing Ethereal
  • 9.1. Introduction
  • 9.2. Start Ethereal from the command line
  • 9.3. Packet colorization
  • 9.4. Control Protocol dissection
    • 9.4.1. The "Enabled Protocols" dialog box
    • 9.4.2. User Specified Decodes
    • 9.4.3. Show User Specified Decodes
  • 9.5. Preferences
• Appendix A. Configuration (and other) Files and Folders
  • A.1. Windows folders
    • A.1.1. Windows profiles
    • A.1.2. Windows NT/2000/XP roaming profiles
    • A.1.3. Windows temporary folder
• Appendix B. Protocols and Protocol Fields
• Appendix C. Related command line tools
  • C.1. Introduction
  • C.2. tcpdump: Capturing with tcpdump for viewing with Ethereal
  • C.3. tethereal: Terminal-based Ethereal
  • C.4. capinfos: Print information about capture files
  • C.5. editcap: Edit capture files
  • C.6. mergecap: Merging multiple capture files into one
  • C.7. text2pcap: Converting ASCII hexdumps to network captures
  • C.8. idl2eth: Creating dissectors from Corba IDL files
    • C.8.1. What is it?
    • C.8.2. Why do this?
    • C.8.3. How to use idl2eth
    • C.8.4. TODO
    • C.8.5. Limitations
    • C.8.6. Notes
• Appendix D. This Document's License (GPL)