Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-08-23 Thread Guy Harris
Nathan Jennings wrote: Thanks for the help and suggestions. They are implemented in the updated attached "sniffex.c" source file, v0.1.1. I've checked that in to the Web site, with some changes, and updated the tutorial to refer to it (I changed both the tutorial code and sniffex.c code to r

[tcpdump-workers] sniffex.c - libpcap example code proposal

2005-07-05 Thread Nathan Jennings
Guy Harris wrote: > > On Jun 29, 2005, at 1:20 PM, Guy Harris wrote: > >> Use "isprint()" rather than "isascii()" in "print_payload()". > > > ...and, while you're at it, print the payload in hex, as well as > ASCII, to emphasize that there's *no* guarantee that TCP data is text. > A format such as

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-30 Thread Robert Lowe
Guy Harris wrote: On Jun 29, 2005, at 3:07 PM, Robert Lowe wrote: Seems like that kind of functionality might be a good candidate for inclusion in libpcap itself, no?? There are already functions to dump to a savefile; why not printable output as well?? How much printable output do you w

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-30 Thread 广星
> >I've attached "sniffex.c", which is intended to be libpcap example code. >It's based on Tim Carstens "sniffer.c" source. > >I hope "sniffex" will serve as a decent working example of libpcap code >and provide basic documentation via comments for beginners. I also hope >this can serve as a tem

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-30 Thread Guy Harris
广星 wrote: How can I determine the right format? For example a packet has been identified as an HTTP packet, How can I know what its format is and are there many formats of the content of http? Note that a TCP segment, in a link-layer frame, doesn't necessarily correspond to a single HTTP req

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread 广星
Thank you very much for the earnest detailed reply:-)~ But there are still some questions in my mind. === 2005-06-30 10:10:21 Guy Harris wrote:=== > >On Jun 29, 2005, at 5:50 PM, 广星 wrote: > >> What I most concern about is how to print the payload in the >> correct format? >> For example,

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Guy Harris
On Jun 29, 2005, at 5:50 PM, 广星 wrote: What I most concern about is how to print the payload in the correct format? For example, there is a HTTP packet, how can I print the HTTP payload according to its real content, such as"HTTP/1.1 206 Partial". Well, the first thing you have to determi

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread 广星
> >I've attached "sniffex.c", which is intended to be libpcap example code. >It's based on Tim Carstens "sniffer.c" source. > >I hope "sniffex" will serve as a decent working example of libpcap code >and provide basic documentation via comments for beginners. I also hope >this can serve as a tem

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Guy Harris
On Jun 29, 2005, at 3:07 PM, Robert Lowe wrote: Seems like that kind of functionality might be a good candidate for inclusion in libpcap itself, no?? There are already functions to dump to a savefile; why not printable output as well?? How much printable output do you want? Should libpcap i

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Robert Lowe
Guy Harris wrote: On Jun 29, 2005, at 1:20 PM, Guy Harris wrote: Use "isprint()" rather than "isascii()" in "print_payload()". ...and, while you're at it, print the payload in hex, as well as ASCII, to emphasize that there's *no* guarantee that TCP data is text. A format such as

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Guy Harris
On Jun 29, 2005, at 1:20 PM, Guy Harris wrote: Use "isprint()" rather than "isascii()" in "print_payload()". ...and, while you're at it, print the payload in hex, as well as ASCII, to emphasize that there's *no* guarantee that TCP data is text. A format such as 00 00 48 65

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Guy Harris
On Jun 29, 2005, at 12:11 PM, Nathan Jennings wrote: There's one issue I've run into: after displaying certain packets (see function print_payload), my xterm/bash shell loses the ability to display newlines (i.e scroll lines). I suppose this is due to the display of a certain sequence of c

Re: [tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Jefferson Ogata
Nathan Jennings wrote: > There's one issue I've run into: after displaying certain packets (see > function print_payload), my xterm/bash shell loses the ability to > display newlines (i.e scroll lines). I suppose this is due to the > display of a certain sequence of characters to my xterm/shell. An

[tcpdump-workers] sniffex.c - libpcap example code proposal

2005-06-29 Thread Nathan Jennings
Hello, I've attached "sniffex.c", which is intended to be libpcap example code. It's based on Tim Carstens "sniffer.c" source. I hope "sniffex" will serve as a decent working example of libpcap code and provide basic documentation via comments for beginners. I also hope this can serve as a t