OS2 World Community Forum
OS/2, eCS & ArcaOS - Technical => Networking => Topic started by: Paul Smedley on June 04, 2017, 08:02:49 am
-
Hi Guys,
After a mailing list discussion with Lewis and Steven, I took a look at compiling Wireshark.
The good news is, I got it working - well it loads at least.
Note that at this point, it won't capture network packets itself, but it should be useful to analyse logs captured on other systems, or, Stephen has told me that it can analyse logs captured with iptrace.
To capture packets using wireshark, we either need to port the pcap library, or teach wireshark how to use iptrace :)
Requires heimdal DLL's and qt4 for the gui.
Current binary at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170603.zip
Working on an updated build with a few more libraries included....
Feedback appreciated ;)
Cheers,
Paul
-
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.
-
Excellent. Haven't looked at your binary yet, but it would be nice to have a pcap port.
Updated build at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170604.zip readme.os2 included that documents the change, and fully lists (hopefully) the requirements.
pcap is on the list, just no idea (yet) how to do it :P
Cheers,
Paul
-
Thanks, Paul, it looks like a great start! I've used Wireshark in Windows and it is a very useful tool. I'll have to read up on how to analyze logs - never tried that before...
-
Thanks Paul.
That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases
Regards
-
Hey Martin,
That's a very interesting port. I wonder which other library dependencies does the pcap library has.
Is this one? http://www.tcpdump.org/#latest-releases
For pcap, it's not so much dependencies, it will need some code written to allow the pcap libraries to access a network card on OS/2. I have some sample code from Digi that I'll investigate.
Meanwhile, iptrace logs captured manually should be able to be analysed using wireshark, so getting pcap is a nice to have, not a must have. Short term, it may be possible to get wireshark able to launch iptrace from the gui (wireshark seems to support external capture utilities).
Cheers,
Paul
-
Updated build, http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170611.zip
Major change is that opening binary captures files is fixed.
Capture menu is now not greyed out, but it doesn't work yet :)
-
Hi Paul!
I got this latest release and upon starting the app from CLI I get the following:
=== START ===
[G:\APPS\TCPIP\WIRESHARK\BIN]wireshark
(process:401): GLib-WARNING **: getpwuid_r(): failed due to unknown user id (0)
Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE
Abnormal program termination - pid=0x0191 - tid=0x01 - G:\APPS\TCPIP\WIRESHARK\B
IN\WIRESHARK.EXE
=== STOP ===
QT 4.7.3 is installed and working with other apps. Maybe heimdal? I have the previous release (heimdal-1.5.3-os2-20160723.zip) which was required as part of the SAMBA client update you did a while ago (Kerberso authentication I think???)...I did not install the recommended heimdal-1.5.3-os2-20160730.zip hesitating to impact my working SAMBA configuration. libc066 & libcx in-place as per the latest REL availability in RPM/YUM.
If I can go ahead and update heimdal to your 0730 release, or better yet, if I can install the RPM/YUM heimdal-libs release 1.5.3-1.oc00 I'd be happy to, although I'm not sure if that matches your heimdal-1.5.3-os2-20160730.zip release? The only potential problem is that the RPM/YUM release is i386 platform, whereas all my current stuff (or the stuff I can control) is i686.
-
Thanks Paul! I tried this build and the GUI starts fine, but the console fills up with 'Libc Panic: Child aborting fork' messages and the POPUPLOG is filled with this:
------------------------------------------------------------
06-12-2017 17:50:43 SYS3175 PID 0071 TID 0001 Slot 00b7
C:\PROGRAMS\WIRESHARK\BIN\WIRESHARK.EXE
c0000005
1e781e28
P1=00000002 P2=13850000 P3=XXXXXXXX P4=XXXXXXXX
EAX=00000000 EBX=03bcfd18 ECX=05df0160 EDX=20807e32
ESI=00000039 EDI=05df0160
DS=0053 DSACC=d0f3 DSLIM=9fffffff
ES=0053 ESACC=d0f3 ESLIM=9fffffff
FS=150b FSACC=00f3 FSLIM=00000030
GS=0000 GSACC=**** GSLIM=********
CS:EIP=005b:1f802de4 CSACC=d0df CSLIM=9fffffff
SS:ESP=0053:03bcfc8c SSACC=d0f3 SSLIM=9fffffff
EBP=03bcfc8c FLG=00010246
LIBC066.DLL 0001:00001e28
--------------------------------------------------------------------------------------
Doesn't actually crash though.... maybe I should ignore these errors and just press on?....
Regards
-
Hi guys,
I suspect David and Dariusz's problems are the same, although interesting that I don't see the same here.
wireshark.exe is trying to fork() & exec and executable, and fork() is failing for some reason. Here, fork() simply returns an error, it doesn't cause any traps as such.
I'm using heimdal from ArcaOS with no issues.
I'm running in a VM with the W4 kernel which may be a point of difference.
David - if you could try ignoring the errors it would be appreciated - I may need to disable all capture support until this is fixed - as mentioned, capture support is enabled but won't work until we get a functional libpcap port.
Cheers,
Paul
-
OK, for now, I've disabled pcap support until we have a functional implementation.
A Wireshark build without it included is at http://smedley.id.au/tmp/wireshark-2.2.7-os2-20170617.zip
-
Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)
In case someone reading wants to try it, here is what I did:
1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'
-
It works awesome!!!
Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.
Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.
Thanks again Paul!
-
Hey Dave!
Thanks again, Paul! This one indeed does not have all the errors in the console. I spent some time with it and everything that should work seems to work just fine. I was a little disappointed to find I had no Bluetooth connection. I wonder what 'souronnet.os2world.net' does? :-)
In case someone reading wants to try it, here is what I did:
1) Open a command line window and type 'iptrace lan0' (or lan1 or lan2 depending on which interface you want to monitor)
2) Browse the network for a little while (don't leave iptrace running for too long or the log file could fill up your hard drive!)
3) close iptrace by hitting <enter>. There is now a file called 'iptrace.dmp' in the directory you ran iptrace from.
4) In the same directory type 'ipformat -x'. This formats the trace for wireshark and is a file named 'iptrace.enc'.
5) Open Wireshark and open the file 'iptrace.enc'
Thanks for the feedback! Are you OK if I copy/paste the above into readme.os2 to help other users?
This might be a nice workaround until/if we can get native packet capture into wireshark/2 :)
Cheers,
Paul
-
Hey Dariusz,
It works awesome!!!
Wow, this is really great...I mean all the stuff I have ever wanted to know (or was curious) about in the normal TCP/IP traffic exposed and available for review.
Here are a couple of icons I quickly grabbed on-line...in case anyone else is looking for something prettier than the OS/2 CLI session icon.
Thanks again Paul!
Thanks for the feedback - I'll add one of those icons into the distribution - I hadn't even thought about icons, I'll check the source code distro for an icon as well.
Cheers,
Paul
-
Paul,
If you want to use my instructions I'd be honored. .. thanks.
Regards
-
Hi all, Wireshark is updated to v2.2.9 - link is https://www.dropbox.com/s/spm9rj6mxjlejw0/wireshark-2.2.9-os2-20170924.zip?dl=0
-
hi guys,
i tried wireshark 2.2.13 on my eCS 2.2 desktop, but it complains about a "rocken.dll" library
since i don't want rpm/uym stuff on my machines, is there around a link to download this library?
thanks
massimo
-
Hi massimo,
...since i don't want rpm/uym stuff on my machines, is there around a link to download this library?...
Well, I think you should be able to d/l the RPM packages and extract the DLLs using any of the zip/package tools.
-
Massimo,
Zip files can be had here for the release RPM stuff...
http://rpm.netlabs.org/release/00/zip/
I also do not have a 'rocken.dll' file on my systems, but Wireshark works. A real mystery...
Regards,
-
https://www.dropbox.com/s/2p0uiiuqas2zimm/wireshark-2.2.13-os2-20180225.zip?dl=0 contains a readme.os2 which points to a dependency on the Heimdal support DLL's from https://trac.netlabs.org/kerberos
roken.dll is part of Heimdal
-
installed 2.2.13, but it ask about a ROCKEN.DLL library
installed also ANPM but can't find heimdal
:-(
massimo
-
thanks a lot
now it starts, even if i'm new about this application and i don't know how to use it ;)
ftp://ftp.netlabs.org/pub/kerberos/heimdal-1.5.3-os2-20160730.zip
massimo
-
Build updated to 2.2.17 - http://smedley.id.au/tmp/wireshark-2.2.17-os2-20180916.zip