TABLE OF CONTENTS Ethereal is an interactive sniffer with an easy-to-use GUI (graphical user interface). Its counterpart, tethereal, is a text-oriented, line-mode sniffer. These two interfaces, graphical and textual, are the normal ways of accessing the expansive library of dissectors Ethereal. Nevertheless, in this chapter you will learn other ways of taking advantage of Ethereal s that open source programmers have created for collection of dissectors. Tap modules, both line-mode and GUI, let you create custom reports directly in Ethereal. Another approach to report writing is for programs to read tethereal s textual output. And to make it easier for other programs, tethereal can convert its protocol dissection into XML (Extensible Markup Language). We ll examine all these techniques for producing reports.
Taps in Ethereal are ways to tap into protocol dissections while each packet is being processed. Information from the dissector is passed to a tap module, which keeps track of the information. When the entire capture file is dissected, the tap module is then directed to finish its reporting. Most tap modules display some information for the user, but a tap module could be programmed to do anything. In other words, a tap module is a report mechanism that has Ethereal s dissection data as input and can produce any type of output that you can program.
The key to making tap modules work is the information interchange between the protocol dissector and the tap module. The protocol dissector s job is to...
