etherape-users — Warning: posting restricted to list members only.

Re: [Etherape-users] Font picker.

[Juan T. <to...@us...>]

Hidde Fennema wrote:

> Is there a way it can be made more easier to user your program with more
> then one NIC? I'm running with three subnets here wich each have their own
> NIC. I found out that running the program with '-i eth2' works, but well,
> then I can only see traffic on that subnet, though I would like to view eth0
> and eth2 at the same time. Is it possible to add some sort of preference
> were I can click the NIC's I'd like to monitor?

Humm... Maybe I can manage to add more than one interface, but I'll
have to think it some more.

I'll try to get in the ability to set interface and mode at runtime for 0.2.10.
I'm just publishing 0.2.9 which is a bug fix version.

> - Questions, questions, questions ... though the program is already *great*
> !!!

Thanks. :-)

[Etherape-users] Font picker.

[Juan T. <to...@us...>]

Jorge Reyes wrote:

>
> Is there anyway you can pink the font size of the hosts ?
> Doing so it will clean up the screan a bit more (I'm running
> 1024x768) and it will aslo give the user the posibility of
> large the data is to be display.
>

I think it's not too hard. I'll try to add it to 0.2.9, together
with other GUI things.

Regards,
Juan.

[Etherape-users] Suggestions for the GUI

[Juan T. <to...@us...>]

mdf wrote:

> Some comments on the program (version 0.2.7):

Thank you for taking your time. It's nice to have someone helping with
UI design. Since I'm coding most of the time and not using the program,
I tend not to realize what the interface will feel like to the user.

> 0. Ignore those who complain about "rape" in the name.

That one is easy. Done! :-)

> 1. The toolbar takes up WAY too much screen space.  I recommend it's
>    complete removal, since whatever functionality exists on it can be
>    obtained through the menus.  Similarly, ditch the message bar at the
>    bottom, which currently serves no useful purpose [a node count is not
>    useful].

Agreed. I'll make them both optional. Specially since they serve no porpouse
right now.

> 2. The monitor parameter editor on the right side should be a
>    modeless dialog the user can summon/dismiss at will (and easily -- a
>    right-click popup perhaps), not something which continuously wastes
>    space ~100% of the time.

Yep, had it planned, but I tend to prioritize what users asks for... Now
that you've asked for it, it's a priority. :-)

> 3. The labels on the ring are currently centered on the nodes.  This
>    makes for extreme messiness in even medium sized networks.  I might
>    urge a nifty non-overlapping placement algorithm [simulated annealing
>    craziness just for the hell of it], but instead a simple strategy that
>    left-justifies nodes on the right side of the circle and right justifies
>    nodes on the left side of the circle, and top and bottom justifies on
>    the bottom and top nodes, should be fine.

Not as easy as it sounds. To do it properly I'd have to measure the size of
all names, so that I don't leave anything out. I'd rather give a little more
thought to this one. And see point 4 for another reason for which I'm
not willing right now to advance this part.

> 4. Nodes receiving the most traffic (in terms of packet count) should
>    be placed in the centre of the circle, not on the edge.  In fact, it
>    probably makes sense to put routers, nameservers and other things
>    in the center of the circle, other hosts on the local network on a first
>    layer ring, and (if selected) foreign/internet hosts on a wider ring.
>
>    Dynamic node placement algorithms would be cool.  The optimization
>    critieria is to place the nodes in such a way to prevent the
>    overlap of text, and to minimize the number of links that cross.

Humm... Interesting idea, though my initial goal was to let the user
place nodes wherever he felt like, and then save his settings. I think
I'll do that first and then I might improve the automatic placement code.
I accept patches, though. :-)

> 5. Better traffic analysis statistics for each node:  packets, bytes,
>    per protocol, per port, per host.

I'm taking notes... :-)

> If you have to prioritize this stuff -- and you feel it is actually an
> issue -- then 1 and 2 are probably the most important.  This program is
> a *monitor*, not a high-user-interaction thing.  Typical usage will be
> to set the preferences once and leave them alone for a long, LONG, time.
> Hence, maximum space should be given to the *display*, and minimum to the
> configuration editing.  In this same vein, a toolbar is useless:  the
> second or two it "saves" is not signifigant in the grand scheme of things.
> Even the menubar is of limited utility.  The ideal is to have a bare
> window with the display -- no menubar, no toolbar, no messagebar, and a
> popup modeless dialog which does the preference editing.

Thanks. You have convinced me. :-)

> You might also consider log(bandwidth) to be used for link widths and
> node radii; the current one looks like it is a linear function, and
> really weird things happen at times.  A log() version might even obviate
> the need for explicit controls (saving space in the dialog, reducing code
> (and bugs), and lowering the documentation load).

I'll try to give three options in the next version, linear, sqrt and log.

Regards,
Juan.

Re: [Etherape-users] Compile problems

[Hidde F. <hi...@wa...>]

Thank you! Commenting out all references to DLT_SLIP_BSDOS worked. Updating
libpcap didn't though.....

----- Original Message -----
From: "Juan Toledo" <to...@us...>
To: "Hidde Fennema" <hi...@wa...>
Cc: <    >
Sent: Monday, March 13, 2000 10:10 PM
Subject: Re: [Etherape-users] Compile problems


>
>
> >   make[2]: Entering directory `/home/hidde/etherape-0.2.7/src'
> > gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../intl      -I/usr/include
> > -DNEED_GNOMESUPPORT_H -I/usr/lib/gnome-libs/include
> > -I/usr/lib/glib/include -I/usr/X11R6/include  -I/usr/X11R6/include
> > -I/usr/lib/glib/include  -g -O2 -Wall -Wunused  -c main.c
> > In file included from diagram.h:1,
> >                  from main.c:28:
> > capture.h:57: `DLT_SLIP_BSDOS' undeclared here (not in a function)
> > capture.h:57: enumerator value for `L_SLIP_BSDOS' not integer constant
> >
> > capture.h:59: `DLT_PPP_BSDOS' undeclared here (not in a function)
> > capture.h:59: enumerator value for `L_PPP_BSDOS' not integer constant
>
> What version of libpcap are you compiling with?
> Sounds as if your pcap.h doesn´t have those values.
> If they bother you, and you are not going to update your libpcap,
> then delete all metions to those DLT and L_ values, and the
> corresponding code.
>
>

Re: [Etherape-users] Compile problems

[Juan T. <to...@us...>]

>   make[2]: Entering directory `/home/hidde/etherape-0.2.7/src'
> gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../intl      -I/usr/include
> -DNEED_GNOMESUPPORT_H -I/usr/lib/gnome-libs/include
> -I/usr/lib/glib/include -I/usr/X11R6/include  -I/usr/X11R6/include
> -I/usr/lib/glib/include  -g -O2 -Wall -Wunused  -c main.c
> In file included from diagram.h:1,
>                  from main.c:28:
> capture.h:57: `DLT_SLIP_BSDOS' undeclared here (not in a function)
> capture.h:57: enumerator value for `L_SLIP_BSDOS' not integer constant
>
> capture.h:59: `DLT_PPP_BSDOS' undeclared here (not in a function)
> capture.h:59: enumerator value for `L_PPP_BSDOS' not integer constant

What version of libpcap are you compiling with?
Sounds as if your pcap.h doesn´t have those values.
If they bother you, and you are not going to update your libpcap,
then delete all metions to those DLT and L_ values, and the
corresponding code.

[Etherape-users] Compile problems

[Hidde F. <hi...@wa...>]

Hi,

This is really great! I've only got version 1.0 working and that one is =
already great. Every version higher then 1.0 though gives me while =
compiling the following error:

make[2]: Entering directory `/home/hidde/etherape-0.2.7/src'
gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../intl      -I/usr/include =
-DNEED_GNOMESUPPORT_H -I/usr/lib/gnome-libs/include =
-I/usr/lib/glib/include -I/usr/X11R6/include  -I/usr/X11R6/include =
-I/usr/lib/glib/include  -g -O2 -Wall -Wunused  -c main.c
In file included from diagram.h:1,
                 from main.c:28:
capture.h:57: `DLT_SLIP_BSDOS' undeclared here (not in a function)
capture.h:57: enumerator value for `L_SLIP_BSDOS' not integer constant
capture.h:59: `DLT_PPP_BSDOS' undeclared here (not in a function)
capture.h:59: enumerator value for `L_PPP_BSDOS' not integer constant
make[2]: *** [main.o] Error 1
make[2]: Leaving directory `/home/hidde/etherape-0.2.7/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/hidde/etherape-0.2.7'
make: *** [all-recursive-am] Error 2

I'm root, and I'm working on a slackware 7.0 P166MMX. It's probably my =
fault, but I cannot find the cause of the error.
Can somebody please give me some feedback? I'm somewhat desparate =
here...=20
thnx in advance!

Hidde, The Netherlands.-

[Etherape-users] 0.2.5

[Juan T. <to...@us...>]

As my girlfriend is requiring me to go out for Friday night
I'm publishing a version with color coded prot display just half done
:-)

In ethernet mode, you can click on a link to see what's the most
common prot.

Please stress test it, to see if there are bugs.

Regards,
Juan.

[Etherape-users] 0.2.4 (bug fix version)

[Juan T. <to...@us...>]

Any of you having problems with segfaults on 0.2.3 please
check 0.2.4. If it still crashes, please read README.bugs

I hope I got it down.
Regards,
Juan.

[Etherape-users] Re: Etherape - looks like an excellent util, but...

[Juan T. <to...@us...>]

David Pollard wrote:

> Downloaded the latest version 2.3 and I get this when I run it - any ideas ?  This is an strace of the program
>
> write(1, "Creating canvas_node: ff:ff:ff:f"..., 59Creating canvas_node: ff:ff:ff:ff:ff:ff. Number of nodes 12) = 59
> write(1, "\n", 1
> )                       = 1
> gettimeofday({952601513, 852585}, NULL) = 0
> gettimeofday({952601513, 853305}, NULL) = 0
> gettimeofday({952601513, 853830}, NULL) = 0
> gettimeofday({952601513, 854356}, NULL) = 0
> gettimeofday({952601513, 854869}, NULL) = 0
> gettimeofday({952601513, 855384}, NULL) = 0
> --- SIGSEGV (Segmentation fault) ---
> write(3, "7\0\5\0b\1\200\5\v\1\200\5\0\0\1\0\0\0\0\0\33\31\2\0\0"..., 40) = 40
> read(3, 0xbffff264, 32)                 = -1 EAGAIN (Resource temporarily unavailable)
> select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
> read(3, "\1\1\221\7\0\0\0\0\365\0\200\5\0\0\0\0\0\0\0\0\0\0\0\0"..., 32) = 32
> fork()                                  = 6258
> wait4(6258, [WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL) = 6258
> --- SIGCHLD (Child exited) ---
> _exit(1)                                = ?
>
> Hope this helps - :-)

Could you please post it as a bug report in  https://sourceforge.net/bugs/?group_id=2712
so that other users know that it is being investigated?

Thanks. :-)

[Etherape-users] Re: EtherApe 0.2.3 crashes

[Juan T. <to...@us...>]

"David J. M. Karlsen" wrote:

> Did a ./configure ; make all ; make check ; make install
> but it segfault's shortly after execution (when I get the messages
> about creating canvas...) any idea?
> Platform: Mandrake 7.02 complete install w/2.2.14-15mdk kernel
> Suggestions? Well known?

I have no idea right now.
Would you mind posting a bug report at

You might want to check first
http://www.chiark.greenend.org.uk/~sgtatham/bugs.html

Thanks for the report. Once I have more info I'll try hard to fix it.

Regards,
Juan.

[Etherape-users] Re: Etherape

[Juan T. <to...@us...>]

Kingsley Turner wrote:

> > > When EtherApe updates, I find it very confusing that the nodes move
> > > around on the circumference.  It would be good IMHO if the
> > > name/IP was in a fixed position on screen.  Obviously this has
> > > to change for the number of links to grow.  I find that there's
> > > so much movement it's impossible to read.  I don't see why this
> > > movement doesn't eventually settle down.  We have a particularly
> > > shitty network setup here (hundreds of boxes on the same subnet),
> > > and this creates a very erratic diagram.  It looks to me as if
> > > quiet nodes are actually removed - is this the case?  if it is
> > > can I turn it off?!
> > >

There is something else you can do right now.
Set node timeout time to 0 and they will not disappear anymore.
You will probabably want to use the -o option as well.

[Etherape-users] Re: Etherape - looks like an excellent util, but...

[Juan T. <to...@us...>]

David Pollard wrote:

> Juan
>
> I hope this may help for future versions........but.....
>
> When we have a heavily loaded network, your program doesn't update the display. Its as if the network card (in promiscuous mode) and cpu is too
> busy getting the data, to display on the screen. If I unplug the network card, the screen updates a few times, but when I stick the cable back
> in, it all freezes up ?
>
> Any ideas ?  Or ways round this - again thanks again

Increment the refresh period.
What machine are you running it on?

[Etherape-users] Re: Etherape

[Juan T. <to...@us...>]

> What I would do is maybe grey them out, and then when you have a significant
> number of drop-outs (25%) re-draw them then.  Or leave their space open
> but blank, and then use that if a new one comes in.
>

I'll see what I can do for the next version

>
> I think colour coded link types would be good, ftp = red, telnet = green,
> netbios = yellow... etc.  Hmmm I guess this could be difficult. Hmm, but
> not if you base it on /etc/services.

It was planned already. Did you get the idea from the "Place holder for
color coded protocol display" label at the bottom right? ;-)

Juan.

[Etherape-users] Re: etherape

[Nathan H. <nj...@ha...>]

On Wed, 8 Mar 2000, Juan Toledo wrote:

> Nathan Hurst wrote:
> 
> Thanks. :-)
> What particular distribution version, so that I can mention it on the README?

Modified linuxppc 1999.

njh

[Etherape-users] Re: etherape

[Juan T. <to...@us...>]

Nathan Hurst wrote:

> Hi,
> Downloaded and played with etherape - it's very cool, and helped me track
> down a trojan machine on our network.  It compiles cleanly on linuxppc.

Thanks. :-)
What particular distribution version, so that I can mention it on the README?

>
> There seems to be a bug where hosts can change from ipaddrs to hwaddrs,
> this may or may not be related to the fact that our network has appletalk
> traffic on it(which doesn't use IP, instead talking at the ethernet
> layer).

I guess you mean from session. Etherape determines whether a particular host
is IP based depending on the first packet from it that it hears about. That
means
that if the first packet is ARP, for instance, it will wrongly think it
doesn´t have
an IP address. But then again, presenting IP addressess while in etherape mode

(not interape, I mean), is a hack that I don´t feel very confortable about.
The Right Thing (R) to do is to have a proper /etc/ethers file in your system.

> Couple of suggestions/requests:
> * The ability to name hosts, or perform a rev-name lookup

Copied. Per node preferences are planned for the future.
Rev-name lookup? Do you mean what you get with the -r option? :-)
And the resolving will be non-blocking with the next version to come out
shortly (matter of minutes).

> * A client which can be posted on another network and display the traffic
> on that network(i.e. we have several routers, and it seems that
> etherape(like tcpdump) only sees traffic not masqueraded to outside
> machines.

The "easy" solution would be to simply forward the X display. Remote
capturing is a problem in itself and I would want etherape to be pretty
independent of the capture procedure. Talk on the ethereal-dev mailing
list is that their wiretap library may eventually become a capturing
daemon as well. Stay tuned.

>
> * The ability to move nodes around(I know your current layout approach is
> better dynamically, but it would be nice if I could put the network into a
> topology more like our own).

This has always been a goal of mine, but it is dependent on the ability
to keep per-node preferences. I'll be getting there, but keep in mind
that etherape only has one developer at this moment. :-)

Regards,
Juan.

[Etherape-users] Re: Etherape - looks like an excellent util, but...

[Juan T. <to...@us...>]

David Pollard wrote:

> The configure script wont work - I am running mandrake 7. I have every
> gtk module (known to man afaik) installed on my machine
>
> running /usr/bin/gtk-config provides this :-
>
> [root@dplaptop etherape-0.2.2]# gtk-config --version
> 1.2.5
> [root@dplaptop etherape-0.2.2]#

> Humm... Looks weird. Are your sure that the 1.2.5 version is on
> /usr/bin/gtk-config?

Could you please provide config.log so as to check what exactly failed?

Regards,
Juan.

[Etherape-users] Re: Works..

[Juan T. <to...@us...>]

It's on the README.
Since I'm going to be adding many modes, I'll be using the general
-m option.
To get interape, run as etherape -m ip

Greetings,
Juan.

"J.P van Oyen" wrote:

> Hai,
>
> Yes now DNS lookups are back up again I only saw you removed the -I
> option ?
>
> Cheers J.P..

[Etherape-users] 0.2.2 is out.

[Juan T. <to...@us...>]

Hello ther, dear co-developers. :-)

Here are the changes for 0.2.2

  Overview of changes in Etherape 0.2.2 (Tuesday 03-07-2000):

     * Added ppp and slip devices support.
     * Broght back IP address display in ethernet mode when no
       /etc/ethers is available
     * Fixed another bug with RedHat 6.1. (I really have to find time to

       talk to this guy)

There is a bug hanging around over there that I have not yet pinpointed.

I hope I'll fix it soon. The "Null packet in check_packet" one, I mean.
Have you guys suffered from it, or is it actually pretty uncommon?

Regards,
Juan.

[Etherape-users] Re: Problems installing Etherape

[Juan T. <to...@us...>]

> capture.c: In function `get_node_id`:
> capture.c:522: warning: implicit declaration of
> function`ntohs`
> capture.c: In function `packet_read`:
> capture.c:604: incompatable types in assignment
> capture.c:608: incompatable types in assignment
> capture.c:625: incompatable types in assignment
> capture.c:629: incompatable types in assignemnt
> capture.c:646: incompatable types in assignemnt
> capture.c:650: incompatable types in assignment

Should be fixed in the next version, later today.

I really have to find the time to talk to the people at redhat
about their "featureful" version of pcap. :-(

Regards,
Juan.

[Etherape-users] Re: New version.

[Juan T. <to...@us...>]

"J.P van Oyen" wrote:

> Hai..
>
> Just tried the new release but it seems it lost the -r option if I use
> it it does no name lookups if I start the 0.2.0 it works oke.
>
> Is there something I did not read well ?
>

Got lost in the source cleanup. Expect to see it back later today.

Regards,
Juan.

Re: [Etherape-users] Capture daemon

[Juan T. <to...@ba...>]

Magnus Ullberg wrote:

> Hi,
>
> I've got a suggestion for you.. what if you made a small daemon that sits on
> a host and captures the data and then you can grab that file and open it in
> Etherape later on another host?
>
> My boss is talking about getting a gigabit card and do port mirroring of all
> our switches, but for now I don't have a way to see the complete network..

This is actually pretty simple to implement, I just didn't have it as a priority
until
you just told me it should. :-)

You will save to a file using tcpdump, and then etherape will read from the
file.

Shouldn't take too long, unless I take vacations this week, which I may.

Thanks for the comment. :-)

Regards,
Juan.

[Etherape-users] Capture daemon

[Magnus U. <Ull...@ar...>]

Hi,

I've got a suggestion for you.. what if you made a small daemon that sits on
a host and captures the data and then you can grab that file and open it in
Etherape later on another host?

My boss is talking about getting a gigabit card and do port mirroring of all
our switches, but for now I don't have a way to see the complete network..

Thanks,
Magnus Ullberg
Area Bancshares Corp.
230 Frederica St.
Owensboro, KY 42301
phone: (270) 688-4647
pager: (270) 691-6714

[Etherape-users] RedHat 6.1 workaround!

[Juan T. C. <to...@ba...>]

I've finally been able to sit in front of a RH6.1 machine, and 
I have found the problem.

It seems that RedHat's version of pcap requires a filter to be
given, even if it is blank.

So, there is a very easy workaround. Call etherape as 
./etherape -f ""

Enjoy, RedHat users! :-)

I'll fix it in the source once I get home.

[Etherape-users] Re: etherape-0.1.8

[Juan T. <to...@us...>]

On Wed, Mar 01, 2000 at 09:02:01PM -0500, ro...@mo... wrote:
> Hi,
> 
> I posted this to the bugtracking system at sourcefourge, but got no reply.  
> 
I did reply to your bug.
You did not provide an email address, nor an answer to my questions. :-(

Have a look at 
https://sourceforge.net/bugs/?func=detailbug&bug_id=102378&group_id=2712

Regards, Juan.

Re: [Etherape-users] etherape 0.1.7

[Juan T. <to...@us...>]

> Running RH6.1 on an Intel P75 with 64 megs Ram, adaptec SCSI, dual 3c905b interfaces. 
> I've applied all the latest updates from from the RH site. Downloaded, compiled and installed 
> 0.1.4, 0.1.5, 0.1.6, and  0.1.7. Nothing happens, nothing appears, can't use the New, Open, 
> Save buttons, although using the same functions from the pull-down menus gives me the popup 
> window telling me that the message isnt there yet. Let 0.1.7 run for about an hour, still nothing 
> appears. Used tcpdump to check the interface, tons of stuff passing through. When I start 
> etherape, I get: " DEBUG: pcap_fd: 5 " in the console window. Best regards,

Have a look at the homepage http://etherape.sourceforge.net/
This is a known problem. You will have to recompile libpcap.

Regards,
Juan.