OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Networking => Topic started by: Paul Smedley on June 04, 2017, 08:02:49 am

Title: Wireshark port
Post by: Paul Smedley on June 04, 2017, 08:02:49 am
Hi Guys,

After a mailing list discussion with Lewis and Steven, I took a look at compiling Wireshark.

The good news is, I got it working - well it loads at least.

Note that at this point, it won't capture network packets itself, but it should be useful to analyse logs captured on other systems, or, Stephen has told me that it can analyse logs captured with iptrace.

To capture packets using wireshark, we either need to port the pcap library, or teach wireshark how to use iptrace :)

Requires heimdal DLL's and qt4 for the gui.

Current binary at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170603.zip

Working on an updated build with a few more libraries included....

Feedback appreciated ;)

Cheers,

Paul
Title: Re: Wireshark port
Post by: Dave Yeo on June 04, 2017, 09:13:46 am
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.
Title: Re: Wireshark port
Post by: Paul Smedley on June 04, 2017, 11:41:46 am
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.

Updated build at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170604.zip readme.os2 included that documents the change, and fully lists (hopefully) the requirements.

pcap is on the list, just no idea (yet) how to do it :P

Cheers,

Paul
Title: Re: Wireshark port
Post by: David McKenna on June 04, 2017, 04:43:57 pm
 Thanks, Paul, it looks like a great start! I've used Wireshark in Windows and it is a very useful tool. I'll have to read up on how to analyze logs - never tried that before...
Title: Re: Wireshark port
Post by: Martin Iturbide on June 05, 2017, 02:29:28 am
Thanks Paul.

That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases

Regards
Title: Re: Wireshark port
Post by: Paul Smedley on June 05, 2017, 02:58:22 am
Hey Martin,

That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases

For pcap, it's not so much dependencies, it will need some code written to allow the pcap libraries to access a network card on OS/2. I have some sample code from Digi that I'll investigate.

Meanwhile, iptrace logs captured manually should be able to be analysed using wireshark, so getting pcap is a nice to have, not a must have. Short term, it may be possible to get wireshark able to launch iptrace from the gui (wireshark seems to support external capture utilities).

Cheers,

Paul
Title: Re: Wireshark port
Post by: Paul Smedley on June 11, 2017, 09:38:21 am
Updated build, http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170611.zip

Major change is that opening binary captures files is fixed.

Capture menu is now not greyed out, but it doesn't work yet :)
Title: Re: Wireshark port
Post by: Dariusz Piatkowski on June 12, 2017, 02:48:25 pm
Hi Paul!

I got this latest release and upon starting the app from CLI I get the following:

=== START ===
[G:\APPS\TCPIP\WIRESHARK\BIN]wireshark

(process:401): GLib-WARNING **: getpwuid_r(): failed due to unknown user id (0)

Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE

Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE
=== STOP ===

QT 4.7.3 is installed and working with other apps. Maybe heimdal? I have the previous release (heimdal-1.5.3-os2-20160723.zip) which was required as part of the SAMBA client update you did a while ago (Kerberso authentication I think???)...I did not install the recommended heimdal-1.5.3-os2-20160730.zip hesitating to impact my working SAMBA configuration. libc066 & libcx in-place as per the latest REL availability in RPM/YUM.

If I can go ahead and update heimdal to your 0730 release, or better yet, if I can install the RPM/YUM heimdal-libs release 1.5.3-1.oc00 I'd be happy to, although I'm not sure if that matches your heimdal-1.5.3-os2-20160730.zip release? The only potential problem is that the RPM/YUM release is i386 platform, whereas all my current stuff (or the stuff I can control) is i686.
Title: Re: Wireshark port
Post by: David McKenna on June 12, 2017, 11:55:02 pm
 Thanks Paul! I tried this build and the GUI starts fine, but the console fills up with 'Libc Panic: Child aborting fork' messages and the POPUPLOG is filled with this:

------------------------------------------------------------

06-12-2017  17:50:43  SYS3175  PID 0071  TID 0001  Slot 00b7
C:\PROGRAMS\WIRESHARK\BIN\WIRESHARK.EXE
c0000005
1e781e28
P1=00000002  P2=13850000  P3=XXXXXXXX  P4=XXXXXXXX 
EAX=00000000  EBX=03bcfd18  ECX=05df0160  EDX=20807e32
ESI=00000039  EDI=05df0160 
DS=0053  DSACC=d0f3  DSLIM=9fffffff 
ES=0053  ESACC=d0f3  ESLIM=9fffffff 
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:1f802de4  CSACC=d0df  CSLIM=9fffffff
SS:ESP=0053:03bcfc8c  SSACC=d0f3  SSLIM=9fffffff
EBP=03bcfc8c  FLG=00010246

LIBC066.DLL 0001:00001e28
--------------------------------------------------------------------------------------

 Doesn't actually crash though.... maybe I should ignore these errors and just press on?....

Regards
Title: Re: Wireshark port
Post by: Paul Smedley on June 13, 2017, 05:36:12 am
Hi guys,

I suspect David and Dariusz's problems are the same, although interesting that I don't see the same here.

wireshark.exe is trying to fork() & exec and executable, and fork() is failing for some reason. Here, fork() simply returns an error, it doesn't cause any traps as such.

I'm using heimdal from ArcaOS with no issues.

I'm running in a VM with the W4 kernel which may be a point of difference.

David - if you could try ignoring the errors it would be appreciated - I may need to disable all capture support until this is fixed - as mentioned, capture support is enabled but won't work until we get a functional libpcap port.

Cheers,

Paul
Title: Re: Wireshark port
Post by: Paul Smedley on June 17, 2017, 11:30:49 am
OK, for now, I've disabled pcap support until we have a functional implementation.

A Wireshark build without it included is at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170617.zip
Title: Re: Wireshark port
Post by: David McKenna on June 18, 2017, 02:09:28 pm
 Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)

 In case someone reading wants to try it, here is what I did:

1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'
Title: Re: Wireshark port
Post by: Dariusz Piatkowski on June 19, 2017, 02:16:44 am
It works awesome!!!

Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.

Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.

Thanks again Paul!
Title: Re: Wireshark port
Post by: Paul Smedley on June 19, 2017, 11:17:40 am
Hey Dave!

Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)

 In case someone reading wants to try it, here is what I did:

1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'

Thanks for the feedback! Are you OK if I copy/paste the above into readme.os2 to help other users?

This might be a nice workaround until/if we can get native packet capture into wireshark/2 :)

Cheers,

Paul
Title: Re: Wireshark port
Post by: Paul Smedley on June 19, 2017, 11:18:54 am
Hey Dariusz,

It works awesome!!!

Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.

Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.

Thanks again Paul!

Thanks for the feedback - I'll add one of those icons into the distribution - I hadn't even thought about icons, I'll check the source code distro for an icon as well.

Cheers,

Paul
Title: Re: Wireshark port
Post by: David McKenna on June 19, 2017, 12:53:26 pm
 Paul,

  If you want to use my instructions I'd be honored. .. thanks.

Regards
Title: Re: Wireshark port
Post by: Paul Smedley on September 24, 2017, 11:32:02 am
Hi all, Wireshark is updated to v2.2.9 - link is https://www.dropbox.com/s/spm9rj6mxjlejw0/wireshark-2.2.9-os2-20170924.zip?dl=0
Title: Re: Wireshark port
Post by: maxwarp on June 25, 2018, 01:26:23 pm
hi guys,

i tried wireshark 2.2.13 on my eCS 2.2 desktop, but it complains about a "rocken.dll" library

since i don't want rpm/uym stuff on my machines, is there around a link to download this library?

thanks

massimo
Title: Re: Wireshark port
Post by: Dariusz Piatkowski on June 25, 2018, 02:25:35 pm
Hi massimo,

...since i don't want rpm/uym stuff on my machines, is there around a link to download this library?...

Well, I think you should be able to d/l the RPM packages and extract the DLLs using any of the zip/package tools.
Title: Re: Wireshark port
Post by: David McKenna on June 25, 2018, 10:47:19 pm
Massimo,

  Zip files can be had here for the release RPM stuff...

http://rpm.netlabs.org/release/00/zip/

 I also do not have a 'rocken.dll' file on my systems, but Wireshark works. A real mystery...

Regards,
Title: Re: Wireshark port
Post by: Paul Smedley on June 26, 2018, 11:17:06 am
https://www.dropbox.com/s/2p0uiiuqas2zimm/wireshark-2.2.13-os2-20180225.zip?dl=0 contains a readme.os2 which points to a dependency on the Heimdal support DLL's from https://trac.netlabs.org/kerberos

roken.dll is part of Heimdal
Title: Re: Wireshark port
Post by: maxwarp on June 26, 2018, 03:12:03 pm
installed 2.2.13, but it ask about a ROCKEN.DLL library
installed also ANPM but can't find heimdal

:-(


massimo
Title: Re: Wireshark port
Post by: maxwarp on June 26, 2018, 03:19:17 pm
thanks a lot
now it starts, even if i'm new about this application and i don't know how to use it ;)

ftp://ftp.netlabs.org/pub/kerberos/heimdal-1.5.3-os2-20160730.zip


massimo
Title: Re: Wireshark port
Post by: Paul Smedley on September 16, 2018, 11:49:01 am
Build updated to 2.2.17 - http://smedley.id.au/tmp/wireshark-2.2.17-os2-20180916.zip