Ethereal-users: Re: [Ethereal-users] Filter for RAWETHER

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 4 Sep 2003 20:07:24 -0700

On Sep 3, 2003, at 1:13 PM, Fiore_Mark@xxxxxxx wrote:

Ethereal, can you parseRAWETHERmade by PCAUSA.http://www.pcausa.com/products/products.htm?

Rawether is a package that does many of the same sorts of things that the low-level packet.dll file in WinPcap does (and, I think, does a number of things packet.dll doesn't do).

Ethereal does not support using Rawether instead of WinPcap. If somebody wants to write a version of libpcap that uses Rawether, it might be possible to make libpcap use it instead of packet.dll (we could make pcap-win32.c try to do a LoadLibrary on packet.dll or the Rawether dll and use whichever one it finds - packet.dll probably works better for libpcap in most, if not all, cases, so it should probably try to load that first).

However:

	1) that's probably a significant amount of work;

2) Rawether, unlike WinPcap, costs money, so whoever did that work would have to buy it *AND* whoever *uses* it would, I think, also have to buy it;

3) it might take even *more* work to arrange that it be possible to build libpcap even if you don't have Rawether, and we ("we" being the libpcap developers, not the Ethereal developers - the Ethereal developers aren't responsible for libpcap or WinPcap, although some of the Ethereal developers are also libpcap developers) wouldn't want to require people doing libpcap development on Windows to buy Rawether (especially given that most of that development is done by the WinPcap developers - why should we force them to buy Rawether?);

4) given that, at present, WinPcap includes both libpcap and packet.dll and the driver, and that it is free, I'm not sure how life would be better if there were a Windows libpcap that used Rawether.