TABLE OF CONTENTS In this chapter you will learn how to enable Ethereal to read from new data sources. Programming with libpcap is introduced. You will be able to read ASCII hex dump files into Ethereal. For a more integrated solution, you will be able to teach Ethereal to read and possibly write a new file format natively.
The most commonly used open source library for capturing packets from the network is libpcap, whose name is an abbreviation of packet capture library. Originally developed at the Lawrence Berkeley Laboratory, it is currently maintained by the same loosely knit group of people who maintain tcpdump, the venerable command-line packet capture utility. Both libpcap and tcp-dump are available online at www.tcpdump.org. A Windows version called WinPcap is available from http://winpcap.polito.it/.
Libpcap is able to save captured packets to a file. The pcap file format is unique to libpcap, but because so many open source applications use libpcap, a variety of applications can make use of these pcap files. The routines provided in libpcap allow you to save packets you have captured and to read pcap files from disk to analyze the stored data.
The first issue to decide when capturing packets is which network interface to capture from. You can have libpcap pick a default interface for you. In that case, it picks the first active, non-loop-back interface. The pcap_lookupdev function picks the default interface.
char errbuf[PCAP_ERRBUF_SIZE]; char *default_device; pcap_t *ph; default_device = pcap_lookupdev(errbuf); if...
