Author Topic: Wireshark port  (Read 27568 times)

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Wireshark port
« on: June 04, 2017, 08:02:49 am »
Hi Guys,

After a mailing list discussion with Lewis and Steven, I took a look at compiling Wireshark.

The good news is, I got it working - well it loads at least.

Note that at this point, it won't capture network packets itself, but it should be useful to analyse logs captured on other systems, or, Stephen has told me that it can analyse logs captured with iptrace.

To capture packets using wireshark, we either need to port the pcap library, or teach wireshark how to use iptrace :)

Requires heimdal DLL's and qt4 for the gui.

Current binary at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170603.zip

Working on an updated build with a few more libraries included....

Feedback appreciated ;)

Cheers,

Paul
« Last Edit: June 04, 2017, 11:48:37 am by Paul Smedley »

Dave Yeo

  • Hero Member
  • *****
  • Posts: 4787
  • Karma: +99/-1
    • View Profile
Re: Wireshark port
« Reply #1 on: June 04, 2017, 09:13:46 am »
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #2 on: June 04, 2017, 11:41:46 am »
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.

Updated build at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170604.zip readme.os2 included that documents the change, and fully lists (hopefully) the requirements.

pcap is on the list, just no idea (yet) how to do it :P

Cheers,

Paul

David McKenna

  • Hero Member
  • *****
  • Posts: 743
  • Karma: +24/-0
    • View Profile
Re: Wireshark port
« Reply #3 on: June 04, 2017, 04:43:57 pm »
 Thanks, Paul, it looks like a great start! I've used Wireshark in Windows and it is a very useful tool. I'll have to read up on how to analyze logs - never tried that before...

Martin Iturbide

  • OS2World NewsMaster
  • Global Moderator
  • Hero Member
  • *****
  • Posts: 4713
  • Karma: +41/-1
  • Your Friend Wil Declares...
    • View Profile
    • Martin's Personal Blog
Re: Wireshark port
« Reply #4 on: June 05, 2017, 02:29:28 am »
Thanks Paul.

That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases

Regards
Martin Iturbide
OS2World NewsMaster
... just share the dream.

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #5 on: June 05, 2017, 02:58:22 am »
Hey Martin,

That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases

For pcap, it's not so much dependencies, it will need some code written to allow the pcap libraries to access a network card on OS/2. I have some sample code from Digi that I'll investigate.

Meanwhile, iptrace logs captured manually should be able to be analysed using wireshark, so getting pcap is a nice to have, not a must have. Short term, it may be possible to get wireshark able to launch iptrace from the gui (wireshark seems to support external capture utilities).

Cheers,

Paul

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #6 on: June 11, 2017, 09:38:21 am »
Updated build, http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170611.zip

Major change is that opening binary captures files is fixed.

Capture menu is now not greyed out, but it doesn't work yet :)

Dariusz Piatkowski

  • Hero Member
  • *****
  • Posts: 1317
  • Karma: +26/-0
    • View Profile
Re: Wireshark port
« Reply #7 on: June 12, 2017, 02:48:25 pm »
Hi Paul!

I got this latest release and upon starting the app from CLI I get the following:

=== START ===
[G:\APPS\TCPIP\WIRESHARK\BIN]wireshark

(process:401): GLib-WARNING **: getpwuid_r(): failed due to unknown user id (0)

Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE

Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE
=== STOP ===

QT 4.7.3 is installed and working with other apps. Maybe heimdal? I have the previous release (heimdal-1.5.3-os2-20160723.zip) which was required as part of the SAMBA client update you did a while ago (Kerberso authentication I think???)...I did not install the recommended heimdal-1.5.3-os2-20160730.zip hesitating to impact my working SAMBA configuration. libc066 & libcx in-place as per the latest REL availability in RPM/YUM.

If I can go ahead and update heimdal to your 0730 release, or better yet, if I can install the RPM/YUM heimdal-libs release 1.5.3-1.oc00 I'd be happy to, although I'm not sure if that matches your heimdal-1.5.3-os2-20160730.zip release? The only potential problem is that the RPM/YUM release is i386 platform, whereas all my current stuff (or the stuff I can control) is i686.

David McKenna

  • Hero Member
  • *****
  • Posts: 743
  • Karma: +24/-0
    • View Profile
Re: Wireshark port
« Reply #8 on: June 12, 2017, 11:55:02 pm »
 Thanks Paul! I tried this build and the GUI starts fine, but the console fills up with 'Libc Panic: Child aborting fork' messages and the POPUPLOG is filled with this:

------------------------------------------------------------

06-12-2017  17:50:43  SYS3175  PID 0071  TID 0001  Slot 00b7
C:\PROGRAMS\WIRESHARK\BIN\WIRESHARK.EXE
c0000005
1e781e28
P1=00000002  P2=13850000  P3=XXXXXXXX  P4=XXXXXXXX 
EAX=00000000  EBX=03bcfd18  ECX=05df0160  EDX=20807e32
ESI=00000039  EDI=05df0160 
DS=0053  DSACC=d0f3  DSLIM=9fffffff 
ES=0053  ESACC=d0f3  ESLIM=9fffffff 
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:1f802de4  CSACC=d0df  CSLIM=9fffffff
SS:ESP=0053:03bcfc8c  SSACC=d0f3  SSLIM=9fffffff
EBP=03bcfc8c  FLG=00010246

LIBC066.DLL 0001:00001e28
--------------------------------------------------------------------------------------

 Doesn't actually crash though.... maybe I should ignore these errors and just press on?....

Regards
« Last Edit: June 13, 2017, 03:07:23 am by David McKenna »

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #9 on: June 13, 2017, 05:36:12 am »
Hi guys,

I suspect David and Dariusz's problems are the same, although interesting that I don't see the same here.

wireshark.exe is trying to fork() & exec and executable, and fork() is failing for some reason. Here, fork() simply returns an error, it doesn't cause any traps as such.

I'm using heimdal from ArcaOS with no issues.

I'm running in a VM with the W4 kernel which may be a point of difference.

David - if you could try ignoring the errors it would be appreciated - I may need to disable all capture support until this is fixed - as mentioned, capture support is enabled but won't work until we get a functional libpcap port.

Cheers,

Paul

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #10 on: June 17, 2017, 11:30:49 am »
OK, for now, I've disabled pcap support until we have a functional implementation.

A Wireshark build without it included is at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170617.zip

David McKenna

  • Hero Member
  • *****
  • Posts: 743
  • Karma: +24/-0
    • View Profile
Re: Wireshark port
« Reply #11 on: June 18, 2017, 02:09:28 pm »
 Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)

 In case someone reading wants to try it, here is what I did:

1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'

Dariusz Piatkowski

  • Hero Member
  • *****
  • Posts: 1317
  • Karma: +26/-0
    • View Profile
Re: Wireshark port
« Reply #12 on: June 19, 2017, 02:16:44 am »
It works awesome!!!

Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.

Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.

Thanks again Paul!

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #13 on: June 19, 2017, 11:17:40 am »
Hey Dave!

Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)

 In case someone reading wants to try it, here is what I did:

1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'

Thanks for the feedback! Are you OK if I copy/paste the above into readme.os2 to help other users?

This might be a nice workaround until/if we can get native packet capture into wireshark/2 :)

Cheers,

Paul

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: Wireshark port
« Reply #14 on: June 19, 2017, 11:18:54 am »
Hey Dariusz,

It works awesome!!!

Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.

Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.

Thanks again Paul!

Thanks for the feedback - I'll add one of those icons into the distribution - I hadn't even thought about icons, I'll check the source code distro for an icon as well.

Cheers,

Paul