Wireshark-dev: Re: [Wireshark-dev] PCap-NG support in Wireshark and Tshark

From: Anders Broman <a.broman@xxxxxxxxxxxx>
Date: Sun, 29 Dec 2013 11:15:19 +0100
Matthias Lang skrev 2013-12-18 13:46:
Hi,

Summary: I've stumbled on some unexpected details in how wireshark and
          tshark handle PCap-NG. I'm not sure if they're bugs or
	 insufficient RTFM, so I thought I'd run them by here before
	 submitting bugs.

--------------------

I've checked out revision 54142 from subversion and built it on a
Debian AMD64 box. I.e. I think I'm looking at fresh code on a sane system.

1. The manpage (tshark.pod) for 'tshark' says reading from stdin isn't
    allowed. But it actually works fine. Manpage says:

     | =item -r  E<lt>infileE<gt>
     |
     | Read packet data from I<infile>, can be any supported capture file format
     | (including gzipped files).  It's B<not> possible to use named pipes
     | or stdin here!

    Here's what happens, i.e. it works just fine:

       >cat /tmp/dumpcap.pcapng | ./tshark -r -
       0 0.000000000 0  192.168.1.3 -> 255.255.255.255 UDP 211 ...
       0 0.000027000 0  192.168.1.3 -> 255.255.255.255 UDP 235 ...

    And reading from a named pipe works fine too:

       >mkfifo /tmp/a_named_pipe
       >cat /tmp/dumpcap.pcapng > /tmp/a_named_pipe &
       >./tshark -r /tmp/a_named_pipe
       0 0.000000000 0  192.168.1.3 -> 255.255.255.255 UDP 211 ...

    I figure this can be fixed by just removing the word "not" from the
    manpage.

    Q: Ok if I submit a diff for my rewording?

Yes

2. tshark.pod says

    | B<TShark>'s native capture file format is B<pcap> format

    It might help someone if it said "B<Pcap-NG>". I'm not sure if
    Pcap-NG is considered a separate format or a new version. It feels
    like a separate format to me since it's totally incompatible.

    Q: Ok if I submit a diff for my rewording?
Yes

3. Wireshark can read a Pcap from stdin, but not Pcap-NG.

    The following works fine:

       >./wireshark -r /tmp/dumpcap.pcapng

    But the following gets me a "Unrecognized libpcap format" dialog box:

       >./wireshark -k -i - < /tmp/dumpcap.pcapng

    I get the same dialog box if I do this:

       >cat /tmp/dumpcap.pcapng > /tmp/a_named_pipe  &
       >wireshark -k -i /tmp/a_named_pipe

    But this works fine:

       >./tshark -r /tmp/dumpcap.pcapng -F pcap -w - | ./wireshark -k -i -

    Q: is there a switch I'm missing or is this a bug?
Bug or not yet implemented, open a bug.

4. The wireshark wiki says "if_tsresol" is supported, but only for
    values 6 (microseconds) and 9 (nanoseconds).

    Wireshark is better than that.

    I verified that 0, 1, 2 and 3 (seconds, tenths of seconds,
    hundreths, milliseconds) work in both tshark and
    wireshark. milliseconds are important to me because the Pcap-NG
    files I generate have millisecond timestamps.

    I suspect all values work. I'm not good enough at subversion to
    figure out since when. It might be commit r41455.

    Wiki: http://wiki.wireshark.org/Development/PcapNg

    Q: Ok if I edit the wiki to just say that it works? i.e. without
       the limitation?
Yes

5. If an IDB in a Pcap-NG file contains both 'if_name' and
    'if_description', wireshark only seems to display the
    if_description; I can't figure out a way to see the name.

    The way I see the 'if_name' is to open the file and go in to
    'Statistics/Summary'.

    Here's an example of each type of file:

    if_name: http://corelatus.se/~matthias/if_name_only.pcapng
    if_name and if_description: http://corelatus.se/~matthias/if_name_and_description.pcapng

    And here's a screenshot of the "good" case, i.e. when you only
    have the if_name field:

    http://blog.corelatus.com/static/pcap_ng_wireshark_summary_screenshot.png

    I generated the Pcap-NG file, so it's possible I've stuffed up and
    made a file that's somehow invalid. But it looks fine to me.

    Q: Can I report this as a bug? (Or is it deliberate?)
Bug or not yet implemented open a bug and include your test file.

6. I can't figure out a way to display the interface _name_ in
    the Wireshark packet detail pane. Here's a screenshot where I've
    got the interface _number_ displayed:

    http://blog.corelatus.com/static/pcap_ng_wireshark_screenshot.png

    I found an earlier discussion about this:

    http://www.wireshark.org/lists/wireshark-users/201206/msg00082.html

    Q: Is there a way to get at "frame.interface_name"? Both for display
       and filtering. (last time, the answer was "not yet")

    Q: Same question for tshark.
Probebly not yet implemented open a bug so it won't be forgotten.

Background: I work with signalling on SS7 (telecom) networks. One
hardware capture device can capture signalling from hundreds of
interfaces.

Being able to view, filter and sort packets captured on multiple
interfaces is really useful, so I implemented support for writing
PCap-NG files instead of classic PCap. And now I'm exploring what
I can do with the result in Wireshark and tshark.

Matt
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe