tcpick-project — the tcpick project: submit here patches and feature requests

[Tcpick-project] FreeBSD problems? 0.2.0-devel1 released

[Francesco S. <dus...@in...>]

Hello,
A new development version of tcpick has been released.
You can download it here:
http://prdownloads.sourceforge.net/tcpick/tcpick-0.2.0-devel1.tar.gz?download
Please, tell me if you have again problems with tcpick on
FreeBSD.

This is the ChangeLog:

07/09/04 0.2.0-devel1
=========================

   * Robert Scheck fixed tcpick manual section in a `printf'

   * Saumil Shah feature request done:

     the flag 'u' to the '-w' option enables tcpick to write
sniffed     data in a unique file, with client and server data
mixed together.

     the flag 'b' to the '-w' option enables tcpick to write a
banner to     the unique file that introduces server and client
data.

   * FreeBSD ./configure bug should be resolved

enjoy,
-Francesco

P.S. I'm sorry I wasn't able to resolve MacOSX bug :(


-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

[Tcpick-project] Problem on MacOSX 10.3

[cirrus <ci...@gm...>]

Although the application does compile, when run it displays an error:

Starting tcpick 0.1.24 at 2004-09-07 01:38 BST
tcpick: listening on en0
SUICIDE: [main] BIOCSRTIMEOUT: Invalid argument

It seems that the problem is on line 156 of the tcpick.c file.
descr = pcap_open_live( dev, BUFSIZ, flags.notpromisc ? 0 : 1 , -1,
(char *)errbuf );
When changing the -1 (time to wait value) to something else, the
program compiles and runs, however it does not seem to capture any
packets. I've played with various values, but nothing seems to work
properly.

Any ideas/solutions?

Thanks,
cirrus

Please CC me, I'm not subscribed

Re: [Tcpick-project] Problems on FreeBSD 4.10

[Francesco S. <dus...@in...>]

[cut]
> configure: WARNING: net/if.h: present but cannot be compiled
> configure: WARNING: netinet/if_ether.h: present but cannot be
> compiled

Hello Mike,
I am sorry for my late answer (I was in holiday for a few days).
Thank you very much for your report. I will try to resolve this
problem for the next version of tcpick. May I send you an
improved configure script to try if it will work on your FreeBSD
box?

Thanks,
-Francesco

[Tcpick-project] Problems on FreeBSD 4.10

[<Mik...@Ci...>]

Hi ...

 

I'm having problems when I do a make on tcpick 0.1.24.  I get the following
error.

 

checking net/if.h presence... yes

configure: WARNING: net/if.h: present but cannot be compiled

configure: WARNING: net/if.h:     check for missing prerequisite headers?

configure: WARNING: net/if.h: see the Autoconf documentation

configure: WARNING: net/if.h:     section "Present But Cannot Be Compiled"

configure: WARNING: net/if.h: proceeding with the preprocessor's result

configure: WARNING: net/if.h: in the future, the compiler will take
precedence

configure: WARNING:     ## --------------------------------------- ##

configure: WARNING:     ## Report this to dus...@de...  ##

configure: WARNING:     ## --------------------------------------- ##

checking for net/if.h... yes

checking netinet/if_ether.h usability... no

checking netinet/if_ether.h presence... yes

configure: WARNING: netinet/if_ether.h: present but cannot be compiled

configure: WARNING: netinet/if_ether.h:     check for missing prerequisite
headers?

configure: WARNING: netinet/if_ether.h: see the Autoconf documentation

configure: WARNING: netinet/if_ether.h:     section "Present But Cannot Be
Compiled"

configure: WARNING: netinet/if_ether.h: proceeding with the preprocessor's
result

configure: WARNING: netinet/if_ether.h: in the future, the compiler will
take precedence

configure: WARNING:     ## --------------------------------------- ##

configure: WARNING:     ## Report this to dus...@de...  ##

configure: WARNING:     ## --------------------------------------- ##

checking for netinet/if_ether.h... yes

 

Any help would be appreciated.

 

TIA

 

Mike

 

[Tcpick-project] tcpick 0.1.24 released

[Francesco S. <dus...@de...>]

Changes: An option `-Enum' to exit when `num' connections are
marked as CLOSED that differs from `-Efnum' that exits when all
the first `num' tracked connections are marked as CLOSED. An
option `-Tfnum' to stop tracking new connections when `num' is
reached. Added a balanced AVL tree to the ip lookup engine. Works
successfully under OpenBSD and NetBSD. Several bugfixes.

Enjoy,
-Francesco Stablum

P.S. I am writing the files `PLATFORMS.compile' and
`PLATFORMS.running' to log all platforms and network interfaces
supported. 
Please, send me this kind of informations.

Re: [Tcpick-project] Tcpick 0.1.23 bug?

[Francesco S. <dus...@in...>]

On Mon, 19 Jul 2004 22:24:34 -0700
Penelope Fudd <ke...@pk...> wrote:

[cut]
> Where are these 'A0 00 00 00 00 00' chunks coming from?  I
> thought that-wR was binary-safe.  When I follow the stream
> using Ethereal, the problem goes away.

On my box I have run tcpick to rebuild a smtp session sniffed
with tcpdump, but I have not seen these 6 bytes long chunks.
It seem there are tcp option that are not recognized by tcpick.
tcpick calculates the position of the data with the "data offset"
field of the tcp packet, so there shouldn't be problems.
I will investigate on it.

> Thanks!
> Penelope Fudd <ke...@pk...>

pleased to help you,
-Francesco Stablum

-- 
http://francesco.stablum.info http://wecanstopspam.org
http://www.fsf.org/philosophy/no-word-attachments.it.html

-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

[Tcpick-project] Tcpick 0.1.23 bug?

[Penelope F. <ke...@pk...>]

Hi..

I've got a tcpdump program running that logs all email to & from the
mail server.

When I use 'tcpick -wR -r log-2004.xx.xx', and look at the resulting
client and server files, there are binary strings stuck in the middle of
the conversation:


           0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
       0:  a0 00 00 00 00 00 45 48 4c 4f 20 6d 78 31 30 30  "......EHLO mx100"
      10:  2e 64 61 63 65 68 61 64 6f 2e 75 73 0d 0a a0 00  ".dacehado.us...."
      20:  00 00 00 00 52 43 50 54 20 54 4f 3a 20 3c 64 77  "....RCPT TO: <pr"
      30:  6f 6f 64 40 76 69 73 69 6f 6e 32 68 69 72 65 2e  "ood@vista2river."
      40:  63 6f 6d 3e 0d 0a a0 00 00 00 00 00 44 41 54 41  "com>........DATA"
      50:  0d 0a a0 00 00 00 00 00 46 72 6f 6d 3a 20 22 50  "........From: "P"
      60:  61 72 61 64 69 67 6d 20 43 6f 6d 6d 75 6e 69 63  "aradigm Communic"
      70:  61 74 69 6f 6e 73 22 20 3c 48 65 69 64 69 52 6f  "ations" <HeidiRo"
      80:  73 65 40 6d 78 31 30 30 2e 64 61 63 65 68 61 64  "se@mx100.dacehad"

Where are these 'A0 00 00 00 00 00' chunks coming from?  I thought that
-wR was binary-safe.  When I follow the stream using Ethereal, the
problem goes away.

Thanks!
-- 
Penelope Fudd <ke...@pk...>

Re: [Tcpick-project] hi all

[Glaucius D. P. J. <gla...@in...>]

On Thu, 10 Jun 2004 17:37:22 +0000
Francesco Stablum <dus...@in...> wrote:

> Hello,
> In my opinion you could use something like this very simple bash
> script:
> 
> #!/bin/bash
>  while [ 1 ]; do  
>    tcpick -i ppp0 & 
>    sleep 60; 
>    killall tcpick; 
>    date;
>    echo "tcpick killed! Sleeping 29 minutes..."
>    sleep 1740
>  done;

yep, I did it, ehehe, look my script 

#!/bin/sh
#echo "Tcpick vai rodar por 5 minutos"
/usr/local/bin/tcpick -i eth1 > /tmp/out.txt & 
sleep 600 &
pid_sleep600=$!
#echo "esperando 600 segundos"
wait $pid_sleep600
killall -9 tcpick
/root/wait.php


regards !!! tanks


> 
> I hope this is the feature you need.
> IMHO shell scripting with tcpick could be better than adding
> features.
> 
> regards,
> -Francesco
> 
> On Wed, 9 Jun 2004 12:22:09 -0300
> Glaucius Djalma Pereira Junior <gla...@in...> wrote:
> > Hi tcpick users !!
> > I have a problem, I wanna use tcpick to know who is traffing in
> > my network, but, I need to run tcpick each 30 minutes, and just
> > run 1 minute, has tcpick a option to run just 1 minute or 2 ??
> > tanks !!
> 
> 
> -- 
> http://francesco.stablum.info http://wecanstopspam.org
> Non accetto allegati in formati proprietari (msword, excel ecc.)
> utilizzate formati quali pdf, html e testo semplice (txt)
> http://www.fsf.org/philosophy/no-word-attachments.it.html
> 


-- 
Glaucius Djalma Pereira Junior
Gerente de Redes
gla...@in...
icq:39175730 | 0xx22 8113 2075

Re: [Tcpick-project] hi all

[Francesco S. <dus...@in...>]

Hello,
In my opinion you could use something like this very simple bash
script:

#!/bin/bash
 while [ 1 ]; do  
   tcpick -i ppp0 & 
   sleep 60; 
   killall tcpick; 
   date;
   echo "tcpick killed! Sleeping 29 minutes..."
   sleep 1740
 done;

I hope this is the feature you need.
IMHO shell scripting with tcpick could be better than adding
features.

regards,
-Francesco

On Wed, 9 Jun 2004 12:22:09 -0300
Glaucius Djalma Pereira Junior <gla...@in...> wrote:
> Hi tcpick users !!
> I have a problem, I wanna use tcpick to know who is traffing in
> my network, but, I need to run tcpick each 30 minutes, and just
> run 1 minute, has tcpick a option to run just 1 minute or 2 ??
> tanks !!


-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

[Tcpick-project] hi all

[Glaucius D. P. J. <gla...@in...>]

Hi tcpick users !!

I have a problem, I wanna use tcpick to know who is traffing in my network, but, I need to run tcpick each 30 minutes, and just run 1 minute, has tcpick a option to run just 1 minute or 2 ??


tanks !!

-- 
Glaucius Djalma Pereira Junior
Gerente de Redes
gla...@in...
icq:39175730 | 0xx22 8113 2075

Re: [Tcpick-project] tcpick feature request

[Francesco S. <dus...@in...>]

On Fri, 04 Jun 2004 21:44:13 -0300
Davi de Castro Reis <dav...@te...> wrote:

[cut]
> Unfortunatelly, tcpick prints (as dots) some header stuff together
> with the plain text protocol, despite the flags I used. Then I hacked
> loop.c to avoid syn packets (with or without a payload). So the line
> if(flags.displaydata>0)
> became
> if(flags.displaydata>0 && (!tcppacket->syn))
> and I could simply use my captured stream as an input for my server or
> netcat.
[/cut]

Hello Davi,
I am very happy to know how tcpick is being used by the people.
Fortunately the problem of the header stuff should be resolved in the
latest version of tcpick. The problem depended on the fact that I
haven't been smart enough to know that the solution was it the tcp
protocol itself! In tcpick 0.1.23 the lenght of the tcp header is
calculated in that way: <tcppacket->doff * 4>
But, if you meet this problem again, let me know and I will find a
solution.

happy hacking!
- Francesco Stablum

-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

Re: [Tcpick-project] tcpick feature request

[Davi de C. R. <dav...@te...>]

Hello,

This is an interesting application. I use tcpick to create automated 
tests for my server applications. I simply let my users use the server 
application from the GUI frontend all day, and I log the commands the 
server receives (it uses a http-like communication protocol) using 
tcpick and redirecting it output to some file (e.g. LOG).
Then, when I want to reproduce the users commands, I just start my 
server in inetd mode and feed the commands through a pipe.
cat LOG | ./server --mode inetd > RESULTS
It is a very convenient tool to do benchmarks and to test server 
applications.

Unfortunatelly, tcpick prints (as dots) some header stuff together with 
the plain text protocol, despite the flags I used. Then I hacked loop.c 
to avoid syn packets (with or without a payload). So the line
if(flags.displaydata>0)
became
if(flags.displaydata>0 && (!tcppacket->syn))
and I could simply use my captured stream as an input for my server or 
netcat.

[]s
Davi


Francesco Stablum wrote:
> Hello John,
> What you have asked could be an interesting way to use tcpick, but I
> don't think of this feature as internal of the program, but "external".
> I mean tcpick could run easily like a web server, simply redirecting his
> output to a netcat session in listening mode.
> I think that in the next days i will develop a feature that should
> sound like this: "exit from tcpick after connection <num> is reached".
> Maybe it will added to the actual --pipe option.
> The idea of this "sniffing http server" ;-) will be this:
>  
> # yes "tcpick --pipe server \"port 80\" | nc -l -p 8000" | sh
>  
> In that way you could connect to localhost:8000 with a normal browser to
> see the files transmitted via http.
> But there are two problems, a little one and a big one.
> The little problem is that actually tcpick doesn't have a "exit when
> connection <n> closes" function. So you will see only the first file,
> but, be sure this is an option that will be added soon (in version
> 0.1.24 of course).
> The BIG problem is that images will be non displayed in the browser if
> they are "local" references. And maybe you will see on the browser
> images themselves, instead of html documents.
> Then, you could write a html page with an "auto-refresh" frame to have a
> costant updated view of the http files.
> 
> 
> 

Re: [Tcpick-project] tcpick feature request

[Francesco S. <dus...@in...>]

Hello John,
What you have asked could be an interesting way to use tcpick, but I
don't think of this feature as internal of the program, but "external".
I mean tcpick could run easily like a web server, simply redirecting his
output to a netcat session in listening mode.
I think that in the next days i will develop a feature that should
sound like this: "exit from tcpick after connection <num> is reached".
Maybe it will added to the actual --pipe option.
The idea of this "sniffing http server" ;-) will be this:
 
# yes "tcpick --pipe server \"port 80\" | nc -l -p 8000" | sh
 
In that way you could connect to localhost:8000 with a normal browser to
see the files transmitted via http.
But there are two problems, a little one and a big one.
The little problem is that actually tcpick doesn't have a "exit when
connection <n> closes" function. So you will see only the first file,
but, be sure this is an option that will be added soon (in version
0.1.24 of course).
The BIG problem is that images will be non displayed in the browser if
they are "local" references. And maybe you will see on the browser
images themselves, instead of html documents.
Then, you could write a html page with an "auto-refresh" frame to have a
costant updated view of the http files.

-Francesco Stablum

On Thu, 3 Jun 2004 15:54:45 -0400 (EDT) "John M. Harrison" wrote:

> 
> Hi,
> 
>   I just downloaded tcpick. Nice program. 
> 
>   We serve several websites from this computer. It would be very nice
>   to
> have a browser window which showed the same things our customers are
> seeing as they are seeing them.
> 
>   In that way we could watch them as they access our site and make our
> site better.
> 
>   I bet some simple patch in tcpick could split the tcp stream and
>   make it
> available to a 2nd browser such as dillo or glinks. This 2nd browser
> would follow the remote browser's activities and allow us to see our
> customer's activities as they happen.
> 
>   I bet this could become a very useful tool.
> 
>   regards,
>   john


-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

[Tcpick-project] tcpick feature request

[John M. H. <jm...@ne...>]

Hi,

  I just downloaded tcpick. Nice program. 

  We serve several websites from this computer. It would be very nice to
have a browser window which showed the same things our customers are
seeing as they are seeing them.

  In that way we could watch them as they access our site and make our
site better.

  I bet some simple patch in tcpick could split the tcp stream and make it
available to a 2nd browser such as dillo or glinks. This 2nd browser would
follow the remote browser's activities and allow us to see our customer's
activities as they happen.

  I bet this could become a very useful tool.

  regards,
  john

[Tcpick-project] tcpick 0.1.23 is out!

[Francesco S. <dus...@in...>]

Notes:
03/06/04 0.1.23
===============
I have rewritten most of the source code of tcpick. Now it is really a
good thing. If you want to work on tcpick, join the mailing list and let
me know :^) I have changed my coding style and the indentation (that is
now the 8-spaces style, typical of the code of the linux kernel).
You will find the code really more clear than before.
In that way I am encouraging more developer to work on tcpick to 
run something like a community, with patches, feature requests and 
so on.
Now tcpick is able to download entire files transmitted via ftp, and 
the md5sums should be equal for every file downloaded in such 
way; if not, please send a bug report.

There are some changes in the options: the options to display the
payload of each packet sniffed by tcpick are now prefixed with `-y'. 
Now it is available another set of options, prefixed by `-b': these 
options are useful if you want to print only the acknowledged stream
(it works like `-w' but in the stdout). Please read the newly-written 
manpage for other details.


Changes:
03/06/04 0.1.23
===============

   * PFLOG support added by kirash

   * patch by Sebastian Prause: "I've created a little patch to make
     tcpick work with pppoe interfaces on NetBSD (which use
     DLT_PPP_ETHER) and wanted to share it, so here it is..."

   * now the options for displaying the payload should be prefixed by -y
     I have added another set of displaying option, that are prefixed
     with -b. The -b options are useful to view data only when
     acknowledged (exactly like data written to files) and with this is
     particulary useful the raw mode (-bR) that you can use if you want
     to redirect data with a pipe to another software.

   * The newline carachter is suppressed when displaying the payload of
     the packet or an acknowledged stream in the case there are no
     banners except the case of the hexdump's.

   * Added the "-pipe" option, by a wish of loopback. See manpage for
     details.

   * Now you are able to choose to write to file only data of clients or
     servers or both, with the additional flags `C' and `S' to the
     option `-w' (omitted means "both").

   * Many, many changes, code cleanups and improvement made by whyx in
     fragments.c and lookup.c

   * With the new option `-T<number>', it is now possible to track only
     the first <number> connections, the following will be discarded by
     the tracker engine. This is useful for the `-w' and `-b' options;
     for `-y' and `-h' it has no effect, because they aren't part of
     the tracker.

   * In the hexdump+ascii red dots rapresents now the unprintable
     carachter.

   * the lenght of the payload is now displayed in the packet banner

   * rewritten the core of verify.c and fragments.c

   * now connections with equal ip addresses and ports are stored in
     different files

   * files dumped with tcpick -w* options are now saved vith ".tcpick"
     extension

   * bugfix on datalink.c by kirash

   * deleted alloc.c and match.c

   * used the "linux" 8-spaces indentation

   * added packet separator (by a Simone Gianni's wish)

   * added the `-p' flag to avoid to put the network interface in
     promiscuous mode (I'm not sure it works) (by a Simone Gianni's
     wish)

   * Rewritten manpage. Read it! There are lots of changes in the
     options!

   * I have tested tcpick to sniff a file via ftp, and the md5sums were
     equal. The tar.gz archive I have downloaded was more than 2MB
     long. Other tests are confirming me that the newly-written code
     works in the right way.

-- 
http://francesco.stablum.info http://wecanstopspam.org
Non accetto allegati in formati proprietari (msword, excel ecc.)
utilizzate formati quali pdf, html e testo semplice (txt)
http://www.fsf.org/philosophy/no-word-attachments.it.html

[Tcpick-project] Tcpick 0.1.23-test11 released: so many changes from 0.1.22!

[Francesco S. <dus...@in...>]

Hi,
tcpick version 0.1.23-test11 has been released.
It was necessary to let it in the testing branch for this big amount of
time because of I have rewritten most of the code and I wanted to be
sure tcpick was really stable.
I have changed my coding style and the indentation (that is now
the 8-spaces style, typical of the code of the linux kernel).
Now the code should be very clear. In that way I am encouraging more
developer to work on tcpick to run something like a community, with
patches, feature requests and so on.
Now tcpick is able to download entire files transmitted via ftp, and the
md5sums should be equal for every file downloaded in such way; if not,
please send a bug report.
There are some changes in the options: the options to display the
payload of each packet sniffed by tcpick are now prefixed with `-y'. Now
it is available another set of options, prefixed by `-b': these options
are useful if you want to print only the acknowledged stream (it works
like `-w' but in the stdout). Please read the manpage for other details.
Do you think tcpick is stable? Try it, and let me know!

regards,
- Francesco Stablum

Here is the Changelog:

   * pflog support added by kirash

   * patch by Sebastian Prause: "I've created a little patch to make
     tcpick work with pppoe interfaces on NetBSD (which use
     DLT_PPP_ETHER) and wanted to share it, so here it is..."

   * now the options for displaying the payload should be prefixed by -y
     I have added another set of displaying option, that are prefixed
     with -b. The -b options are useful to view data only when
     acknowledged (exactly like data written to files) and with this is
     particulary useful the raw mode (-bR) that you can use if you want
     to redirect data with a pipe to another software.

   * The newline carachter is suppressed when displaying the payload of
     the packet or an acknowledged stream in the case there are no
     banners except the case of the hexdump's.

   * Many, many changes, code cleanups and improvement made by whyx in
     fragments.c and lookup.c

   * With the new option `-T<number>', it is now possible to track only
     the first <number> connections, the following will be discarded by
     the tracker engine. This is useful for the `-w' and `-b' options;
     for `-y' and `-h' it has no effect, because they aren't part of
     the tracker.

   * In the hexdump+ascii red dots rapresents now the unprintable
     carachter.

   * the lenght of the payload is now displayed in the packet banner

   * rewritten the core of verify.c and fragments.c

   * now connections with equal ip addresses and ports are stored in
     different files

   * files dumped with tcpick -w* options are now saved vith ".tcpick"
     extension

   * bugfix on datalink.c by kirash

   * deleted alloc.c and match.c

   * used the "linux" 8-spaces indentation

   * added packet separator (by a Simone Gianni's wish)

   * added the `-p' flag to avoid to put the network interface in
     promiscuous mode (I'm not sure it works) (by a Simone Gianni's
     wish)

   * Rewritten manpage. Read it! There are lots of changes in the
     options!

   * I have tested tcpick to sniff a file via ftp, and the md5sums were
     equal. The tar.gz archive I have downloaded was more than 2MB
     long. Other tests are confirming me that the newly-written code
     works in the right way.

[Tcpick-project] FASD project: Online survey launched

[<ben...@id...>]

Dear Open Source developer

I am doing a research project on "Fun and Software Development" in which I kindly invite you to participate.
You will find the online survey under http://fasd.ethz.ch/qsf/. The questionnaire consists of 53 questions and you will need about 15 minutes to complete it.

With the FASD project (Fun and Software Development) we want to define the motivational significance of fun when software developers decide to engage in Open Source projects. What is special about our research project is that a similar survey is planned with software developers in commercial firms. This procedure allows the immediate comparison between the involved individuals and the conditions of production of these two development models. Thus we hope to obtain substantial new insights to the phenomenon of Open Source Development.


With many thanks for your participation,
Benno Luthiger


PS:
The results of the survey will be published under http://www.isu.unizh.ch/fuehrung/blprojects/FASD/.
We have set up the mailing list fa...@we... for this study. Please see http://fasd.ethz.ch/qsf/mailinglist_en.html for registration to this mailing list.

_______________________________________________________________________

Benno Luthiger
Swiss Federal Institute of Technology Zurich
8092 Zurich

Mail: benno.luthiger(at)id.ethz.ch
_______________________________________________________________________

[Tcpick-project] New mechanism to capture data

[Francesco S. <dus...@in...>]

This is the explanation of the new mechanism of fragments.c (code
comments).
Actually I am developing a way to track the tcp session in the healtiest
way. These new features will be available in tcpick 0.1.23 (max 2
weeks, including debuggin) and will be a big step in the development.
When the code is too complicated and doesn't work it is the time to
rewrite it, isn't it? ;)
Why are these improvement so important? You could download passively a
very big compressed archive via ftp without data corruption!

/*
 * Explanation of this code (fragments.c)
 * ======================================
 *
 * The stream of data of the tcp connection will be saved on 
 * the file, but we know that tcp connection aren't datagram-oriented, 
 * but stream-oriented! This means we *must* rebuild the disordered 
 * flow. The problem is: we cannot store entire tcp connections in
 * memory! This is simply crazy! What if somebody is downloading cd
 * iso images, or dvd films! They will surely corrupted.
 * Solution: write the rebuilded part of tcp flow in the file when
 * there are no missing pieces; so we will be able to store in memory
 * the "early coming" packets and when the "latest" (sorry for the bad
 * english) could complete the stream, flush this part of the flow to
 * the file.
 *
 * Phase 1:
 *     Picking up the packets containing data from the interface.
 * 
 * Packets containing data fragments are stored into the chained 
 * "fragments_noack" dinamically-allocated structs. "_noack" 
 * means that these data are not yet acknowledged with the "ack"
 * packet of response. 
 * The packet are chained with the "->next_struct" trick, and are
 * ordered sequentially following the offset of the data calculated
 * from the seq field. 
 * 
 * Phase 2:
 *     Acks are arriving!
 * 
 * These are the acks of the stored but not acknowledged packets.
 * Simply, they acknowledge the packet. This way the packet can go in
 * the "fragments_ack" chained struct. This chain is very similar to
 * the "fragments_noack", but contains only 100% tcp-acknowledged
 * data. (We can trust the tcp stack of the host, hopefully).
 * 
 * Phase 3:
 *     Flush! (a.k.a. writing the rebuilded stream to file)
 * 
 * My preferred part: data that are ordered by the systems above
 * descripted will be written to the file in that way:
 * If the offset of the data just written to the file is equal to the
 * offset of the first packet, write it to file and deallocate it. 
 * Now control the now first ring of the chain and check it again,
 * until a NULL (end of the chain) is reached, or a offset is not like
 * the one of data written.
 *
 */

What do you think about it?
Cheers,
- Francesco

-- 
http://francesco.stablum.info
Key fingerprint = 521D DAD3 EB81 B62B FE35  E644 8CAD C1FC 66C8 246F
Non mandatemi allegati in formati proprietari (msword, excel ecc.)
uso GNU/Linux, preferite formati quali pdf, html e testo semplice (txt),
grazie http://wecanstopspam.org

Re: [Tcpick-project] [patch] support for pppoe on NetBSD

[Francesco S. <dus...@in...>]

On Tue, 20 Apr 2004 21:05:26 +0200
Sebastian Prause <seb...@gm...> wrote:

> Hi,
> I've created a little patch to make tcpick work with pppoe interfaces
> on NetBSD (which use DLT_PPP_ETHER) and wanted to share it, so here it
> is...

Thank you very much, Sebastian,
I have added your patch to the sources of the 0.1.23 (soon coming).
I am very happy to see people helping me using tcpick on their
systems. :)

Cheers,
-Francesco

-- 
http://francesco.stablum.info
Key fingerprint = 521D DAD3 EB81 B62B FE35  E644 8CAD C1FC 66C8 246F
Non mandatemi allegati in formati proprietari (msword, excel ecc.)
uso GNU/Linux, preferite formati quali pdf, html e testo semplice (txt),
grazie
http://wecanstopspam.org

[Tcpick-project] [patch] support for pppoe on NetBSD

[Sebastian P. <seb...@gm...>]

Hi,
I've created a little patch to make tcpick work with pppoe interfaces on
NetBSD (which use DLT_PPP_ETHER) and wanted to share it, so here it is...


--- datalink.c.orig     2004-04-20 20:41:00.000000000 +0200
+++ datalink.c  2004-04-20 20:42:39.000000000 +0200
@@ -189,6 +189,13 @@
        ip_trasl=4;
       }
 #endif
+#ifdef DLT_PPP_ETHER
+    case DLT_PPP_ETHER:
+      {
+       ip_trasl=8; 
+       break;
+      }
+#endif
 #ifdef DLT_LINUX_SLL
     case DLT_LINUX_SLL:
       {
              
               
   -- Sebastian Prause

Re: [Tcpick-project] debian report for tcpick-0.1.22

[Francesco S. <dus...@in...>]

On Sun, 18 Apr 2004 12:52:19 +0200
Maurizio Lemmo - Tannoiser <tan...@te...> wrote:

> STABLE:
> deb http://erlug.linux.it/~tann/tcpick/stable ./
> deb-src http://erlug.linux.it/~tann/tcpick/stable ./
> 
> UNSTABLE:
> deb http://erlug.linux.it/~tann/tcpick/unstable ./
> deb-src http://erlug.linux.it/~tann/tcpick/unstable ./

Very Good! :)
I have added a link of this url to the download page.

Thank you,
-Francesco

-- 
http://francesco.stablum.info
Key fingerprint = 521D DAD3 EB81 B62B FE35  E644 8CAD C1FC 66C8 246F
Non mandatemi allegati in formati proprietari (msword, excel ecc.)
uso GNU/Linux, preferite formati quali pdf, html e testo semplice (txt), grazie
http://wecanstopspam.org

Re: [Tcpick-project] debian report for tcpick-0.1.22

[Maurizio L. - T. <tan...@te...>]

* marted=EC 13 aprile 2004, alle 00:13, Francesco Stablum scrive:
> Thank you very much for the package, Maurizio, I think the best thing i=
s
> if you please give me the link for the package, so I can update the
> download page to link to it.=20

mini *unofficial* debian repository for tcpick:

STABLE:
deb http://erlug.linux.it/~tann/tcpick/stable ./
deb-src http://erlug.linux.it/~tann/tcpick/stable ./

UNSTABLE:
deb http://erlug.linux.it/~tann/tcpick/unstable ./
deb-src http://erlug.linux.it/~tann/tcpick/unstable ./

I don't use testing, so i can say nothing about it. Probably, the
unstable package could run normally.

This way, anyone just issue an "apt-get install tcpick", and the other
apt-* function.

Just put in /etc/apt/sources.list the appropriate repository, and
apt-get update.

Everyone: use at your own risk. Run for me. :)

--=20
                          Maurizio - Tannoiser - Lemmo
                 Founder Member of ERLUG http://erlug.linux.it
-------------------------------------------------------------------------=
------
Willow: "I bet you have a lot of groupies."
Oz: "It happens. I'm livin' groupie-free nowadays. I'm clean."
Willow: "Oh."
	--Buffy the Vampire Slayer: Surprise

Re: [Tcpick-project] [PATCH] pflog support

[Francesco S. <dus...@in...>]

On Thu, 15 Apr 2004 11:37:59 +0000
kirash <ki...@in...> wrote:

> explanation (very short):
> in main()[tcpick.c] , if pcap_lookupnet return -1, set netp and maskp to 
> zero, print a warning message and go on... this is necessary because
> pflog is a pseudodevice without ip address.

Thank you very much for the patch kirash :)
I have added it to the the sources of the next version (i hope i will release it soon!).

Thanks,
-Francesco

-- 
http://francesco.stablum.info
Key fingerprint = 521D DAD3 EB81 B62B FE35  E644 8CAD C1FC 66C8 246F
Non mandatemi allegati in formati proprietari (msword, excel ecc.)
uso GNU/Linux, preferite formati quali pdf, html e testo semplice (txt), grazie

[Tcpick-project] [PATCH] pflog support

[kirash <ki...@in...>]

explanation (very short):
in main()[tcpick.c] , if pcap_lookupnet return -1, set netp and maskp to 
zero, print a warning message and go on... this is necessary because
pflog is a pseudodevice without ip address.

in datalink.c
ip_trasl for DLT_PFLOG is 48 (for OpenBSD 3.3 and higher):
	struct pfloghdr {
		u_int8_t	length;
		sa_family_t	af;
		u_int8_t	action;
		u_int8_t	reason;
		char		ifname[IFNAMSIZ];
		char		ruleset[PF_RULESET_NAME_SIZE];
		u_int32_t	rulenr;
		u_int32_t	subrulenr;
		u_int8_t	dir;
		u_int8_t	pad[3];
	};


however, this is a silly pflog support, because pflog packet contain
other significant info, for a complete implementation see ethreal sources.

PATCH:

diff tcpick-0.1.22/src/datalink.c tcpick-0.1.22-pflog/src/datalink.c
--- tcpick-0.1.22/src/datalink.c	Fri Mar 19 22:14:48 2004
+++ tcpick-0.1.22-pflog/src/datalink.c	Thu Apr 15 10:53:55 2004
@@ -138,6 +138,13 @@
 	break;
       }       
 #endif
+#ifdef DLT_PFLOG
+    case DLT_PFLOG:
+      {
+	strcpy(str,"DLT_PFLOG");
+	break;
+      }       
+#endif
     default:
       {
         sprintf(str,"NOT RECOGNIZED DATALINK(0x%x)(%d)",numba,numba);
@@ -183,10 +190,11 @@
 	break;
       }
 #endif
-#ifdef DLT_LOOP /* not tested */
+#ifdef DLT_LOOP 
     case DLT_LOOP:
       {
 	ip_trasl=4;
+	break;
       }
 #endif
 #ifdef DLT_LINUX_SLL
@@ -196,10 +204,11 @@
 	break;
       }
 #endif
-#ifdef DLT_PFLOG /* not tested */
+#ifdef DLT_PFLOG 
     case DLT_PFLOG:
       {
-	ip_trasl=28;
+	ip_trasl=48;
+	break;
       }
 #endif
 
diff tcpick-0.1.22/src/tcpick.c tcpick-0.1.22-pflog/src/tcpick.c
--- tcpick-0.1.22/src/tcpick.c	Sun Feb 29 14:44:35 2004
+++ tcpick-0.1.22-pflog/src/tcpick.c	Wed Apr 14 19:53:01 2004
@@ -466,10 +466,11 @@
       ret=pcap_lookupnet(dev,&netp,&maskp,(char *)errbuf);
       if (ret==-1)
 	{
+	  netp = 0;
+	  maskp = 0;
 	  errcolor();
 	  fprintf(stderr,"%s\n",errbuf);
 	  resetcolor();
-	  exit(-1);
 	}
 
       addr.s_addr = netp;





-- 
GLS aka KIRASH

Re: [Tcpick-project] [PATCH] datalink.c (trivial)

[Francesco S. <dus...@in...>]

On Wed, 14 Apr 2004 17:32:56 +0000
kirash <ki...@in...> wrote:
> +       break;

Patch added :)
Thank you very much for this, kirash

-Francesco

-- 
http://francesco.stablum.info
Key fingerprint = 521D DAD3 EB81 B62B FE35  E644 8CAD C1FC 66C8 246F
Non mandatemi allegati in formati proprietari (msword, excel ecc.)
uso GNU/Linux, preferite formati quali pdf, html e testo semplice (txt), grazie