etherape-users — Warning: posting restricted to list members only.

Re: [Etherape-users] Something is wrong with the RPM

[Brenno J.S.A.A.F. de W. <br...@de...>]

I would love to help you on testing!

Cheers,


Brenno.

Juan Toledo wrote:

> I'm taking away the RPM, since there is obviously some library
> incompatibility. If someone is willing to try out the new versions I
> produce before releasing them publicly, please let me know.
>
> Regards,
> Juan.
>
> _______________________________________________
> Etherape-users mailing list
> Eth...@li...
> http://lists.sourceforge.net/mailman/listinfo/etherape-users

[Etherape-users] Making an /etc/ethers file

[Norman G. <no...@tu...>]

The FAQ gives quite a tedious way of getting an /etc/ethers file. Another
way to get MAC addresses for the /etc/ethers file is to:

/sbin/arp -a

You can then translate the output of that program to the ethers file
format with this simple perl hack:

----------------Cut---------------
#!/usr/bin/perl -w
use strict;

# arp2ether
#translates: host.domain (19.20.30.20) at 00-01-aa-b1-3f-ef ...
#to:         00:01:aa:b1:3f:ef	host.domain

my @arp;
my @enet;

while(<>){
  chomp;
  @arp = split;
  @enet = split( /-/, $arp[3] );
  print join( ":", @enet), "\t", $arp[0], "\n";
}
----------------Cut---------------

Save this to a file, arp2ether, and use like this:

chmod +x arp2ether                             # make arp2ether executable
/sbin/arp -a | arp2ether > ethers.current      # Get the active MACS

                                               # Merge with old /etc/ethers
sort -u /etc/ethers ethers.current > ethers.new
mv /etc/ethers /etc/ethers.old
cp ethers.new /etc/ethers

-- 
Norman Gaywood -- School of Mathematical and Computer Sciences
University of New England, Armidale, NSW 2351, Australia
no...@tu...     http://turing.une.edu.au/~norm
Phone: +61 2 6773 2412     Fax: +61 2 6773 3312

[Etherape-users] Something is wrong with the RPM

[Juan T. <to...@us...>]

I'm taking away the RPM, since there is obviously some library
incompatibility. If someone is willing to try out the new versions I
produce before releasing them publicly, please let me know.

Regards,
Juan.

[Etherape-users] Etherape RPM

[Brenno J.S.A.A.F. de W. <br...@de...>]

Hi,

I just decided to install the Etherape RPM and got a core dump
instantly. I am using RH 6.2. Anyone encountered similar problems?


Cheers,


Brenno de Winter.
Ede, The Netherlands

[Etherape-users] Re: etherape-rpm

[Juan T. <to...@us...>]

>
> I just encountered a much more serious problem:
>
> I had vmware running when starting etherape.
> My Computer crashed due to a problem in vmware's vmnet driver.
> (First XFree86 crashed ..., but I think this was due to a "deeper" problem).
>
> I suppose that's a vmware error.

I doubt this is specific to etherape. I suggest you try tcpdump and or ethereal
in the same conditions, and see what you get. (I'm talking about the vmnet
thing, I have no idea about X crashing, but of course, no app should ever be
able of crashing it. :-) =

[Etherape-users] More IPX

[Juan T. <to...@us...>]

> Any plans to incorporate ipx support ?
>

Humm.. I was looking at the tracefile you sent me and I was thinking I might do
this first, since I might move the code to libglade and this is actually easier,
but:

What do you actually want it to do with IPX? Do you want to have and IPX mode to
show connections over routers (easy)? Do you want it to resolve IPX names (hard)?
Do you want it to recognize and colorize protocols riding IPX (medium)?

Regards,
Juan.

[Etherape-users] Re: Can you help ? IPX support and priorities

[Juan T. <to...@us...>]

David Pollard wrote:

> thanks juan
>
> all working a treat !!!
>
> Any plans to incorporate ipx support ?

Now that I can read from capture files it should be easier. Can you please send me
a small capture file with the kind of traffic you want me to check? Use
tcpdump -w tracefile -f "use filtering is possible so as not to make a huge file"

It's not a priority right now, though. I'm working on the rpm distribution (should
be out today), and then I'll be trying to make the idle mode properly (what it does
when the refresh period is less than the CPU can handle)

Regards,
Juan.

[Etherape-users] Re: etherscape and frame relay

[Juan T. <to...@us...>]

ESS wrote:

> Been using your cool etherscape program. However, the traffic I want to
> monitor is running
> over frame-relay (T1) and not ethernet on the same machine. When
> I specify the device
> for my wancard "wp1_fr16", I get the following message:

It's actually called etherape (pronounce as ether-ape), but I like your
variation. :-) I 'll use it in case I ever change the program name.

As to your problem... Humm... I'm using the libpcap library for packet
capture. I'm surprised it doesn't support frame relay. That doesn't mean
that etherape supports frame relay yet, but it will if you send me a small
capture file.

Install tcpdump (see www.tcpdump.org) and try it out on your frame relay
device. If it works, do
tcpdump -i wp1_fr16 -w tracefile
to save some traffic to a file and send it to me so that I can test it.

Thanks for your report. :-)

Regards,
Juan.

[Etherape-users] Re: Etherape and AIX

[Juan T. <to...@us...>]

> Yes I did compile and run the test suite. The 'metadata' test failed however.  The other tests passed with no problems. I posted a message to the gnome-list but no one replied with any information as to the possible problem.  I am using gnome-libs 1.0.56.  One point of interest:  mc works fine in text mode.  gmc does not as it is X based.  Any clues ?

No, I'm afraid I can't help you, since I'm also pretty new to gnome, and I don't have any access to any AIX machine. But since it seems you can't display any gnome app, it does seem like a gnome problem and not etherape. Keep asking in the gnome-list. I will be closing the bug.

If you do manage to get gnome apps working, please do try etherape, and tell me if it works.

Regards,
Juan.

[Etherape-users] Re: how can I find libpcap?

[Juan T. <to...@us...>]

da...@en... wrote:

> just curious -- where can I get libpcap?  I downloaded etherape, and I
> guess it requires libpcap.  Do you know where I can find a copy?

In RedHat and Debian they are indenpendent packages
In source, it comes with the tcpdump package.

Regards,
Juan.

[Etherape-users] Re: manpage for etherape

[Juan T. <to...@us...>]

Ross Campbell wrote:

> Hi,
>
> Here's a skeleton manpage for etherape... I really didn't do much other than
> help2man and a quick vi... it should have more info in it, but I thought at
> least this was a good start.

Thank you for the effort, but I'd really have some real documentation even if
only in plain ASCII. Plan ascii can later be given formatting. I'll put it in the
archive, though, if you tell me you might keep on improving it. :-)

BTW - our subnets have 1024 hosts and it's impossible to see mac or hostnames

> with so many hosts.. how about the ability to filter out only the n top
> talkers?

That's a nice idea. :-) I have a lot of them to implement now, but it shouldn't
bee too hard. In the meantime, you might want to use a small node-timeout and/or
some kind of tcpdump filtering.

> PS - any progress of FDDI support, I'd really love to be able to run this on
> FDDI

Do something for me: send me some smal FDDI capture file (tcpdump -w file)

> pps - have you seen wiredview - sort of like etherape meets GL, not as useful
> as etherape, but fun to watch :)

Nope. I'll look at it to steal more ideas. :-)

> Thanks!

Thank you! :-)

[Etherape-users] Re: Services ...

[Juan T. <to...@us...>]

> I saw in one program, that it can detect collision on the ethernet (can't
> realize how it works) so u can see if the local net is jammed ....

Humm... I was thinking in adding an ethernet load meter sometime later, and a
colision detector would be a nice thing to do if it were possible... Perhaps by
watching the reported ethernet errors in the interface? The problem with that is
that it's probably pretty much non portable. I take note (I save all suggestions)
and I may retake the subject later.

Regards,
Juan.

[Etherape-users] Re: Services ...

[Juan T. <to...@us...>]

Thanks for your comments. :-)

> ftp://ftp.isi.edu/in-notes/iana/assignments/port-numbers
> It's quite complex I think ;-)

Yep, realized so a bit later. But when I saw its complexity I started to think
that I should read those from a file so that the user can select how much
complexity he wants. I'd always provide a default, though.

> BTW Do u plan accounting abilities and or colision detection ?

By accounting I guess you mean logging... Yes, it's planned.

Colision detection? What do you mean by that?

Regards,
Juan.

[Etherape-users] Re: bug reporting and text representation

[Juan T. <to...@us...>]

The_Colombian wrote:

> Hello I just got a major erro with etherape 3.5
> I'm send you two JPG images
> One is the error emssage the other one was what it was prcessing
> before it crashed.

Unless there is something wrong with the display, I'd rather have a
backtrace than a screenshot. See
http://etherape.sourceforge.net/bug-reporting.html

> PS
> I have a question.
> I like the visual display that currently Etherape has. However could
> it be posible to do it as a table ?
> I.E. one line will have the sender ip + receiving IP and the local
> routes it took ?

Logs of traffic are planned. Real time text representation is not by
now. I think you will find other applications that already do that if
you look for them. trafshow, for instance.

> Thanks
> Jorge Reyes
> The_Colombian

You are welcome :-)

Regards,
Juan.

[Etherape-users] RE: Not compiling in RedHat

[Juan T. <to...@us...>]

> checking for gnome-config... no
> checking for gnomeConf.sh file in /usr/local/lib... not found
> configure: error: Could not find the gnomeConf.sh file that is generated by
> gnome-libs install
>
> I'm running a RedHat 6.1 system, with the gnome-libs and gnome-core RPMs
> installed.  I've tried this same compile on other RedHat machines with more
> complete gnome distributions, and I've looked for "gnomeConf.sh" on those
> systems.  They don't have it, and if they did, I would have to think that
> it wouldn't be in the /usr/local/ heirarchy.  Is there some way to work
> around these problems on RH?  Maybe you should mention this in the docs as
> a known problem with RH (unless it's just me ...).

Sounds to me that you are don't have the gnome-dev packages installed.
I'm not a RedHat user, so I don't really know what the names are,
but I'm forwarding your letter to the list, in case anybody knows.

Regards,
Juan.

[Etherape-users] Re: etherape questions

[Chuck C. <cam...@ne...>]

On Thu, Mar 23, 2000 at 08:32:11PM +0100, Juan Toledo wrote:
> 
> > One question:
> >
> > 1)Is it possible to indicate the traffic direction on the map?  It appears
> > that it is doing so, but in the same color for each direction, and the same
> > line width, so you lose the ability to see this happening.  Maybe some arrow
> > heads or something, or an offset between the two directions???
> 
> It's on the todo list. It hasn't been a priority yet. Among other things because I
> really don't know how to do it properly. I can't just put a "Show incoming traffic
> only" button for links, because what direction is incoming for a link? And if I'm
> to draw them both, I'm not really sure what is the best way to do it. This is an
> open invitation for everybody to brainstorm about it. :-)

I assume you are currently just drawing a bar of scaled thickness in the 
protocol color.  Maybe you could add some arrow heads indicating 
direction.  These would not have to scale, and could appear near the end 1/3 
of the link line (if they are all in the center of the link line, they 
might be difficult to see, and they would post on top of one another.

The arrow heads could always post in black (or the background canvas color)
if they were drawn after the link line was displayed.

Another possibility (and one I like much better) would be to use different 
line types (e.g.  dots, dashes, mixed length dashes, mixed dots and dashes, 
etc.) in fixed weight or line width to draw links of different protocol types. 
You could then offset link lines for the two directions between nodes by a 
small fixed amount with arrow heads at each end to indicate direction and use 
color variation (blue = lowest, green, yellow =  medium, orange, red = highest)
to represent packet volumes.

This latter approach would keep the high volume link(s) from dominating the
display by growing as large as the canvas.

-chuck

-- 
ACCEL Services, Inc.| Specialists in Gravity, Magnetics |  1(713)993-0671 ph.
1980 Post Oak Blvd. |   and Integrated Interpretation   |  1(713)960-1157 fax
    Suite 2050      |                                   |
 Houston, TX, 77056 |          Chuck Campbell           | cam...@ne...
                    |  President & Senior Geoscientist  |

     "Integration means more than having all the maps at the same scale!"

[Etherape-users] Re: etherape questions

[Juan T. <to...@us...>]

> I grabbed yesterday's version yesterday, and after build it just puked, so
> I went back to 0.3.1.  I left it running overnight, and found a memory leak
> in the graphics.  Essentially it starved X out of memory, and killed the
> X server.
>
> I'm building the 0.3.3 version now, and will let you know if the same occurs.

It probably will. It's in development and I still haven't found all the leaks.
0.3.2 should have fixed some, but with the changes it introduced I problably added
some others.


> One question:
>
> 1)Is it possible to indicate the traffic direction on the map?  It appears
> that it is doing so, but in the same color for each direction, and the same
> line width, so you lose the ability to see this happening.  Maybe some arrow
> heads or something, or an offset between the two directions???

It's on the todo list. It hasn't been a priority yet. Among other things because I
really don't know how to do it properly. I can't just put a "Show incoming traffic
only" button for links, because what direction is incoming for a link? And if I'm
to draw them both, I'm not really sure what is the best way to do it. This is an
open invitation for everybody to brainstorm about it. :-)

> Great program!  Thanks lots.
> -chuck

Thank you. :-)

[Etherape-users] Re: Etherape

[Juan T. <to...@us...>]

> Well the only thing that would be really useful is perhaps a mechanism of
> building a permanent table from the arps. We have a fairly large
> distributed network, while we recognize most network interface identifiers
> now from experience, it would be far easier to have it automagicly grab the
> information from the arps. That being said, I also think I'm being too lazy...

Humm. This shouldn't be too hard. Maybe sometime this week.
Thanks for the idea. :-)

Regards,
Juan.

[Etherape-users] Re: Etherape

[Juan T. <to...@us...>]

"J.P van Oyen" wrote:

> I am getting this in the debug screen. Widgets not found ?
> Any idea what to do about it ?
> Ps how to disable the dump in console ?

There are several warnings caused by my ignorance in GTK
coding (any help, anyone?). They are harmless. Same thing
with debug messages. In order to get rid of them just
redirect output. In bash, use
./etherape > /dev/null 2> /dev/null

See the man page of your shell if it is other than bash.

> Another issue is that I can not make the points smaller any more. Since
> a few versions its changed as with the early ones I could make it
> smaller.

Can you be more specific? How small do you want them to be?
What size mode are you talking about?

> During compilations there are a few warnings that might be of interest
> to you :

The code restructuring I talked about was to get rid of those warnings and
some more you are not seing now. Thanks for taking the effort
of telling me, though.

> Its realy a very nice tool and I like it alot.

Thank you. :-)

Regards,
Juan.

Re: [Etherape-users] Broadcast positioning

[Juan T. <to...@us...>]

Magnus Ullberg wrote:

> Hi,
>
> Is there any easy way to put the broadcast address in the center of the
> screen? I know you've got plans for the layout of the diagram but I thought
> id as anyway..

No easy way yet. I'm busy trying to generalize on protocol recognitions,
but I'll give it a try if I'm tired of thinking hard later.

Regards,
Juan.

[Etherape-users] RE: gnome dependency

[Juan T. <to...@us...>]

Jammet wrote in freshmeat:
>Can the program be changed to not be dependant on GNOME
>anymore? I've been trying to avoid the use graphical user
>interfaces such as KDE and GNOME and only use a Window
>Manager, and like GTK applications alot.

>Okay this may be a silly request - I don't know just how much
>of etherape is about GNOME, but I've seen many apps that let
>me ./configure --without-gnome and I'd like this a lot with
>etherape. Please give it a thought, thank you =).

I'm afraid the display is definitely dependant on gnome, since it
is based in gnome_canvas and that's one of the reasons I've
managed to produce this program quite fast.

On the other hand, I'm taking care to separate the capturing
and the display side of things, so that anybody willing to
produce a different interface would only have to do that.

I don't like to be dependant on so high level libraries either,
but right now there are no other options (until some nice
programmer decides to give it a try!).

Regards,
Juan.

[Etherape-users] Broadcast positioning

[Magnus U. <Ull...@ar...>]

Hi,

Is there any easy way to put the broadcast address in the center of the
screen? I know you've got plans for the layout of the diagram but I thought
id as anyway..

Thanks,
Magnus Ullberg
Area Bancshares Corp.
230 Frederica St.
Owensboro, KY 42301
phone: (270) 688-4647

[Etherape-users] Re: DHCP

[Juan T. <to...@us...>]

Hidde Fennema wrote:

>  Ls,Is it an idea to add the option to filter out DHCP broadcasts?
> They're driving me crazy ...Hidde, The Netherlands..

You can already filter traffic with the -f option. See the man page for
tcpdump
to see how it is used. Remember that you will probably have to use
quotes
as in
etherape -f "not port telnet"

[Etherape-users] Re: Etherape 0.2.11

[Juan T. <to...@us...>]

RIchard REnwick wrote:

> I get an error when compiling v.0.2.11.  When it gets to
> diagram.c, I get the following:
>
> diagram.c:81: parse error before `a'
> diagram.c:82: parse error before `a'
>
> I am afraid my C is not good enough to work out why.  Can
> you help please.
>
> Thanks

Try changing every appearence of 'gconstpointer' to 'void *'
Did you run the configure script?
What glib version do you have installed?
What OS are you compiling it on?

Regards,
Juan.

[Etherape-users] Re: make error on solaris

[Juan T. <to...@us...>]

Emil Obermayr wrote:

> having trouble with compiling of Version 0.2.8 and 0.2.9; 0.2.6 was
> fine; 0.2.7 not tested; any ideas?
>
> qedemob@sun32:/usr/local/src/etherape-0.2.9 $ uname -a
> SunOS sun32 5.6 Generic_105181-15 sun4u sparc
> qedemob@sun32:/usr/local/src/etherape-0.2.9 $ gcc --version
> 2.95.2
>
> make[2]: Entering directory `/usr/local/src/etherape-0.2.9/src'
> gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../intl      -I/usr/local/include -DNEED_GNOMESUPPORT_H -I/usr/local/lib/gnome-libs/include -I/usr/local/lib/glib/include -I/usr/openwin/include  -I/usr/openwin/include -I/usr/local/lib/glib/include -I/usr/local/include  -g -O2 -Wall -Wunused  -c capture.c
> In file included from capture.c:23:
> /usr/include/net/if.h:189: field `ifa_addr' has incomplete type
> /usr/include/net/if.h:191: field `ifu_broadaddr' has incomplete type
> /usr/include/net/if.h:192: field `ifu_dstaddr' has incomplete type
> /usr/include/net/if.h:210: field `ifru_addr' has incomplete type
> /usr/include/net/if.h:211: field `ifru_dstaddr' has incomplete type
> /usr/include/net/if.h:213: field `ifru_broadaddr' has incomplete type

Simply delete the #include <net/if.h> line in capture.c
I'm not using it yet.

I'll have to study why it doesn't work when I finally need it, though...

Regards,
Juan.