Introduction

Ethereal is an interactive sniffer with an easy-to-use graphical user interface (GUI). Its counterpart, Tethereal, is a text-oriented, line-mode sniffer. In this chapter, we learn how to enhance and tweak Ethereal, focusing on the leveraging and coding tools used to interact with it. (For a primer on Ethereal or its underlying technology, it is recommended that you read the Ethereal documentation.)

In an effort to extend Ethereal, we will program a protocol dissector, either linked into Ethereal or as a plugin. We will see how Ethereal calls a dissector, and how to best integrate it into Ethereal. The various structures needed to retrieve and process a data packet are also explained. Finally, some advanced topics are introduced that allow users to give their dissector even more functionality.

This chapter also explains Ethereal's two interfaces graphical and textual, and its tap modules. The tap modules can be both command-line mode and GUI, and allow users to create custom reports directly in Ethereal. Another approach to report writing is reading Tethereal's textual output. And, to make it easier for other programs, Tethereal can convert its protocol dissection into Extensible Markup Language (XML).