etherape-users Mailing List for EtherApe

Hello all:
with traffic on EtherApe-users and EtherApe-devel mailing lists almost 
non existent, it's time to close them and switch all discussion to the 
forums.
In a month or so the mailing lists will be made read-only and all 
subscribers removed.

EtherApe-announce will remain active to handle release announcements as 
usual.

EtherApe now is a pure GTK 3 application, with canvas supplied by 
GooCanvas (https://wiki.gnome.org/Projects/GooCanvas).

While GooCanvas itself is in maintenance mode, is still the simplest 
canvas library available and with an API almost identical to 
gnome-canvas, too!
Longer term, EtherApe ui should be completely redesigned and modernized, 
but this is for another day.

This change was needed because several distributions are phasing out 
Gnome 2 libraries and EtherApe needs
to update as well.
Unfortunately, this mean dropping support for older distributions, for 
example CENTOS 5 and 6.
At this time the EtherApe executable can still be built for those 
distributions, but not the project as a whole.

Thanks to the work of Zev Weiss, EtherApe 0.9.15 was released today.

    The central node ring setting now accepts multiple node specifiers

    (separated by any combination of spaces and/or commas), and also
    now understands glob syntax, so you can put for example

      10.0.0.0/24, *.mydomain.tld, somehost.otherdomain.tld

    and it will do what you'd expect.

    There is now a compile-time configure option ('--with-c-ares',
    disabled by default) to enable DNS resolution via the c-ares
    library, supplanting EtherApe's built-in multithreaded
    gethostbyaddr(3)-based resolver.  This is a fully non-blocking DNS
    library and thus has potential for better performance while using
    only a single background resolver thread, but also means that
    name-lookup is strictly DNS-based, and will thus not take
    /etc/hosts, NIS, or other name services into account.

    There is a slightly backwards-incompatible change in the syntax of
    the node-position file used with the '-P' flag added in release
    0.9.14.  It now uses the same CIDR notation plus hostname-globbing
    syntax used by the central node ring setting (instead of POSIX
    regular expressions).  This provides simpler and more consistent
    syntax with essentially the same real-world utility, but may
    require some small changes to existing node-position files. Some
    examples:

      Old (regex)           New (CIDR+glob)
      ===============       ===============
      172.16.2.[0-9]*       172.16.2.0/24
      .*.mydomain.com       *.mydomain.com
      fe80:.*               fe80::/16

    Additionally, each line of the node-position file may now include
    multiple such node-matching patterns (separated by spaces and/or
    commas as with the central node ring setting), so a single line
    might look like:

      *.mydomain.com, 10.0.0.0/24 3

    (to put all nodes matching the given domain or CIDR range into
    column 3).

    As a security feature (privilege separation), packet-capture
    operations are now isolated in a separate background process. The
    new '-Z' flag can be used to specify a user to run the main
    (foreground) process as.


    Changes summary:
      * New option to use c-ares for DNS resolution.
      * Multiple node/subnets and glob syntax now supported for central
        node ring.
      * Node-matching syntax for '-P' flag's file now uses CIDR
        notation and hostname-globbing instead of regexes.
      * Multiple patterns can now be given on a single line of the
        node-position ('-P') file.
      * The columnar-layout ('-P') code has been changed to re-adjust
        the spacing of nodes within a column when the number of nodes
        decreases.  The 10-column limit has also been removed.
      * The background-image feature introduced in 0.9.14 can now be
        turned off via a preference check-box.
      * The background of the protocol legend is now black so that
        lighter colors (e.g. yellow) are more readable.
      * There is now an option to display packet-capture statistics
        from libpcap in the main window (hover the mouse over them for
        an explanation in the status bar).
      * The show/hide state of the toolbar, protocol legend, and status
        bar are now preserved along with other preferences in the
        user's config file.
      * New '-Z' flag (or '--relinquish-privileges') can be used to run
        most processing as an unprivileged user.

Zev Weiss in the past months has contributed several quality patches.
It's a pleasure to announce he has now full committer rights for EtherApe.

With the work of several contributors, EtherApe 0.9.14 was released 
yesterday.

    EtherApe now users the system /etc/services file instead of its own.
    While this change make some customizations a bit harder, it 
guarantees an
    up-to-date services file.
    Note to packagers: /etc/etherape is not needed anymore.

    Central node option now undestands CIDR notation, allowing for a central
    ring of nodes, thanks to Zev Weiss.
    Static background image, courtesy of Glenn Feunteun.
    Nodes can be optionally arranged as columns, thanks to David Goldfarb.


    Changes summary:
      * autoconf updated to 2.69
      * fixed incorrect WLAN control frames decoding
      * fix UTF-8 encoding of several files, thanks to StrPt.
      * read system services file instead of EtherApe one, thanks to Zev 
Weiss.
      * fix race condition on exit, thanks to Zev Weiss
      * central ring option, thanks to Zev Weiss
      * tweaks to preference windows to better work with tiling managers,
        thanks to Zev Weiss.
      * static background image (Glenn Feunteun)
      * arrange nodes in 'columns' (David Goldfarb)

You need the development libraries, those ending in -devel (like
lib64glade2.0_0-devel).
Unfortunately configure displays only basenames, instead of development
names.

Can't see a login panel to submit a new post to the Help form.
Environment:OpenMandriva 2013-x86_64.
Downloaded etherape 0.9.13
How do I tell "configure" to look in 64bit libraries?
configure: error: Package requirements (glib-2.0 libglade-2.0 
libgnomeui-2.0) were not met:
But.....

[graeme@haydn etherape-0.9.13]$ cd /usr/lib64
[graeme@haydn lib64]$ ls -l|grep libgnomeui
lrwxrwxrwx  1 root root         24 Mar 24 12:37 libgnomeui-2.so -> 
libgnomeui-2.so.0.2400.5*
lrwxrwxrwx  1 root root         24 Mar 24 11:50 libgnomeui-2.so.0 -> 
libgnomeui-2.so.0.2400.5*
-rwxr-xr-x  1 root root     635128 Oct 23 14:45 libgnomeui-2.so.0.2400.5*
[graeme@haydn lib64]$ ls -l|grep libglade
drwxr-xr-x  3 root root       4096 Nov 21 14:32 libglade/
lrwxrwxrwx  1 root root         21 Nov 21 14:32 libglade-2.0.so.0 -> 
libglade-2.0.so.0.0.7*
-rwxr-xr-x  1 root root     112320 Oct 23 14:41 libglade-2.0.so.0.0.7*
lrwxrwxrwx  1 root root         23 Nov 21 14:38 libglademm-2.4.so.1 -> 
libglademm-2.4.so.1.0.5*
-rwxr-xr-x  1 root root      40288 Oct 23 14:41 libglademm-2.4.so.1.0.5*
[graeme@haydn lib64]$ ls -l|grep glib
drwxr-xr-x  3 root root       4096 Feb  8 22:21 glib-2.0/
etc..
lrwxrwxrwx  1 root root         35 Feb  8 22:21 libglib-2.0.so -> 
../../lib64/libglib-2.0.so.0.3600.3*

But I set ETHERAPE_LIBS:
echo $ETHERAPE_LIBS
/usr/lib64

I welcome your help.
Graeme

  Overview of changes in EtherApe 0.9.13 (Sun May 05, 2013):
   Central node option, useful for displaying routers or proxies.
   Translations and documentation updates, plus some fixes.

   Changes summary:
     * Optional central node, based on work of Javier Fernandez-Sanguino
       Peña.
     * re-enabled full-screen mode, thanks to nrvale0
     * Updated spanish translation, thanks to Javier Fernandez-Sanguino
       Peña.
     * Added German translation, and fixed typos, thanks to Chris Leick.
     * Updated documentation.

This is a bugfix release.
Shortly after releasing 0.9.11, David Goldfarb discovered a critical bug 
in EtherApe, triggered by RPC traffic.

This bug can be exploited to crash EtherApe by sending a suitable packet.
No packet data is used beyond the IP addresses, however, making further 
escalation unlikely.

  Overview of changes in EtherApe 0.9.11 (Friday May 27, 2011):
   Several users asked for a way to export traffic statistics.
   EtherApe now can save a snapshot with all known nodes and relevant
   informations to an XML file. With option --final-export, a dump is
   automatically generated when a capture file is fully replayed.
   Additionally, option --signal-export enables SIGUSR1 handling, to 
   dump on signal.

   EtherApe used to have two links for connection, one for each traffic
   direction. With this release, only one link is needed, gaining more
   complete statistics and better resource usage.

   EtherApe config file is now ~/.config/etherape, instead of the older,
   deprecated, ~/.gnome2/Etherape. Migration is automatic.
   Filter expression is now saved.

   Thanks to OpenSUSE Build Service and a new spec file, development rpms can
   easily be built for OpenSUSE 11.3, SLE11, Centos5/RHEL5, Fedora and
   Mandriva.
   The spec file is somewhat generic, lacking the nicer integrations of
   official distribution packages, so you are advised to build with EtherApe 
   spec file only as a last resort.

   OSX compatibility improved, thanks to Zack Perry.

   The old, deprecated, direct resolver was removed. Name resolution is now
   only done with the full fledged threaded resolver.

   Changes summary:
     * XML export of node statistics.
     * added --final-export to export statistics at replay end.
     * added --signal-export to export statistics on SIGUSR1 (FR 3185920).
     * improved link statistics
     * added a toolbar button to open the nodes window.
     * a new button allows skipping lengthy pauses when replaying.
     * fixed a long-standing bug affecting expiry timeouts. EtherApe was
       overestimating traffic averages.
     * used stock icons when possible to improve consistency with themes.
     * EtherApe now builds natively on CENTOS5/RHEL5. 
     * rewrote spec file for use with OpenSUSE Build Service.
     * updated documentation.
     * removed several (harmless) compiler warnings to make packager's life 
       easier.
     * imported debian-specific patches and a swedish translation by Daniel
       Nylander.
     * workaround for OSX troubles with gtk_input_add. Thanks to Zack Perry 
       persistence for helping diagnose and fix.
     * removed obsolete preference "cycle assigned colors".
     * removed deprecated direct resolver
     * config file now saved to ~/.config/etherape
     * filter expression is now saved with the other preferences.
     * italian translation
     * link and node sizes now computed with the same variable types.
     * new size variables: active packets, total packets, average packet size.

..or is not well configured.
(Almost certain that it is the latter)

I want to monitor just one host in my network.
Computer 1 has Etherape installed, OS=Debian Lenny, IP 192.168.55.160
Computer 2 is the host I want to monitor, OS=WinXP, IP 192.168.55.12
The network:
Modem -> router (SweexLW055) -> Hub (3Com 3C16170)
                           -> Comp. 1
                           -> Comp. 2

Capture Filter is set as : src net 192.168.55.12 dst net 192.168.55.12

But still etherape shows the internet-connections from and to computer 1
(192.168.55.160).
How is it possible to let etherape [i] only [/i] show the connections from
and to the 192.168.55.12 (comp 2)

Thanks in advance,
Quentin

Hi, probably you are thinking that i need build essential for compile
software, but i have compiled more things before in this OS, so it isn't
the problem. I have follow all steps (easy), but when i type "make",
make doesn't works (it does nothing).

Somebody could help me?

Thank you very much, I appreciate your help.

I've got a fresh installation of Fedora 9 with 2.6.25 kernel.  I'd like to
install etherape but am running into a dependency problem.  When I run
configure I see that:

  checking for ETHERAPE... configure: error: Package requirements
(libglade-2.0 libgnomeui-2.0) were not met.
  Consider adjusting the PKG_CONFIG_PATH environment variable if you
  installed software in a non-standard prefix.

  Alternatively you may set the ETHERAPE_CFLAGS and ETHERAPE_LIBS
environment variables
  to avoid the need to call pkg-config.  See the pkg-config man page for
  more details.

So, I checked both packages and they are installed (see below).  Obviously
libgnomeui is 2.22.1 so that should be ok, but libglade is 0.17 !  I tried
to download a later libglade (2.60) but this is causing a domino effect of
other updates that I'm afraid will break other packages - since yum update
show Fedora 9 packages are ALL up to date.

So my question is:  Do I really need to upgrade libglade to 2.x ??  Seems
odd that Fedora 9 would ship with such an old version (unless there are
known conflicts as I start the upgrade path)..

HELP!

--------------------

Name       : libglade
Arch       : i386
Epoch      : 1
Version    : 0.17
Release    : 21.fc9
Size       : 247 k
Repo       : installed
Summary    : Gnome-1 support library for loading user interfaces
URL        : http://www.jamesh.id.au/software/libglade/
License    : LGPLv2+
Description: Libglade is a small library that allows a program to load its
user interface from am XML description at runtime.
           : Libglade uses the XML file format used by the GLADE user
interface builder GLADE, so libglade acts as an alternative to
           : GLADE's code generation approach. Libglade also provides a
simple interface for connecting handlers to the various
           : signals in the interface (on platforms where the gmodule
library works correctly, it is possible to connect all the
           : handlers with a single function call). Once the interface has
been instantiated, libglade gives no overhead, so other
           : than the short initial interface loading time, there is no
performance tradeoff.

Name       : libgnomeui
Arch       : i386
Version    : 2.22.1
Release    : 2.fc9
Size       : 3.4 M
Repo       : installed
Summary    : GNOME base GUI library
URL        : http://www.gnome.org
License    : LGPLv2+
Description:  GNOME (GNU Network Object Model Environment) is a
user-friendly set of GUI applications and desktop tools to be used
           : in conjunction with a window manager for the X Window System.
The libgnomeui package includes GUI-related libraries
           : that are needed to run GNOME. (The libgnome package includes
the library features that don\'t use the X Window System.)

[ro...@fi... etherape-0.9.7]

JJB wrote:
> Hello,
> 
> EtherApe is a nice tool, but I wish it generated a log that listed 
> accumulated traffic by ip address. For instance:
> 
> 
> Source:               Destination
> 192.168.1.2        12.55.99.111                  1024kb          http
>                            75.151.22.10                  21000kb        udp
> 
> 192.168.1.33      66.99.33.11                     384kb           udp
>                            93.22.66.12                     999mb         
>   http
> 
> 
> 12.55.99.112      192.168.1.3                     100000kb     http
>                            192.16831.56                  4000kb         http
> 
> etc.
> 
> If anyone know of something similar to etherape that outputs useful 
> stats without simply recording everything that passes through the 
> interfaces into a massive log file, that would be helpful. What I could 
> really use would be a text version of Etherape. I want to know what 
> source address connected to what destination address, the protocol used 
> and the amount of data transferred. I don't need 24 hour capture of 
> every packet into a file, just statistics. Who are the biggest bandwidth 
> hogs? What external sources are pulling the most data from our internal 
> network?
> 
> I know that wireshark/ethereal can do this but it generates tremendous logs.
> 
>  - Thanks
> 
Try ntop (www.ntop.org)

Ciao,
R

Hello,

EtherApe is a nice tool, but I wish it generated a log that listed 
accumulated traffic by ip address. For instance:


Source:               Destination
192.168.1.2        12.55.99.111                  1024kb          http
                           75.151.22.10                  21000kb        udp

192.168.1.33      66.99.33.11                     384kb           udp
                           93.22.66.12                     999mb         
  http


12.55.99.112      192.168.1.3                     100000kb     http
                           192.16831.56                  4000kb         http

etc.

If anyone know of something similar to etherape that outputs useful 
stats without simply recording everything that passes through the 
interfaces into a massive log file, that would be helpful. What I could 
really use would be a text version of Etherape. I want to know what 
source address connected to what destination address, the protocol used 
and the amount of data transferred. I don't need 24 hour capture of 
every packet into a file, just statistics. Who are the biggest bandwidth 
hogs? What external sources are pulling the most data from our internal 
network?

I know that wireshark/ethereal can do this but it generates tremendous logs.

 - Thanks

Andy Hester wrote:
> Hello,
> 
> I am looking for some software to monitor/analyze network traffic and I 
> see that etherape seems to do a great job.
> 
> Is there any easy way to tie etherape to cacti?  Or possibly some other 
> solution? 
> 
> It seems like that it would be really helpful to have the traffic logged 
> and then checked by cacti to create a very small representation of the 
> historical data.
> 
> Thanks,
> -Andy
> 
Etherape is more suited to real-time monitoring. For long term stats you 
can look at ntop (http://www.ntop.org)

Hello,

I am looking for some software to monitor/analyze network traffic and I see
that etherape seems to do a great job.

Is there any easy way to tie etherape to cacti?  Or possibly some other
solution?

It seems like that it would be really helpful to have the traffic logged and
then checked by cacti to create a very small representation of the
historical data.

Thanks,
-Andy

The Finn wrote:
> tcpdump port 80 = works
> etherape -f port 80 != works...
> 
> please explain how the filtering works with this program for me? anyone 
> can point me at an example or some documentation ?

You need to quote the filter expression to prevent shell globbing. 
tcpdump considers any non option parameter as an expression, while 
etherape uses a filter option.
So, try -f "port 80", or input the filter expression in the preferences 
dialog.

R

tcpdump port 80 = works
etherape -f port 80 != works...

please explain how the filtering works with this program for me? anyone can
point me at an example or some documentation ?

Thanks a heap
TF.

Is there any way i can capture the file information tht is getting
transferred whether it be http or ftp . I mean i wish to know the file name
and the amount of data transferred

Can somebody tell me how to save the information that we get from etherape
in some format or some log file

Some assistance please..

I have installed Fink on my mac to run distributions such as ethereal  
(which works perfectly), when I installed etherape however, the "fink  
installer" says it's installed the binary, however I cannot find the  
binary on my system.  Am I doing something incorrect?  I have  
installed X11 for OSX and run these applications from there.  when I  
search for the etherape binary, this is all that shows up:

host:/sw/bin root# find / -name etherape -print
/sw/etc/etherape
/sw/share/doc/etherape
/sw/share/etherape
/sw/share/gnome/help/etherape

so the binary somehow didn't get installed.  I uninstalled it and  
tried again - same thing.

Fink version
Package manager version: 0.24.17
Distribution version: 0.8.1

Thanks for any help.

ka...@kl... wrote:
> Hi,
> 
> I'm running openbsd 3.9 etherape compiled form ports using make & make
> install.
> 
> I am able to execute the command line as root to run etherape, but when it
> runs I get a "No Namservers Defined" error.

Unless you disable name resolution (for example, with the -n command 
line option), etherape needs to access a DNS server, so you need to 
configure your box appropriately.

> 
> In reading the man page, is says etherape looks at etc/ethers if it exists.
> 
> -I didn't see one, but I created it, -should it's perms belong to etherape?
> 
> what's the exact format of this file?  I didn't see an example on the net
> when googling for one.
The ethers file is used to map MAC to IP addresses. Its format is 
simple: a line for each MAC - IP pair, separated by spaces/tabs (try man 
ethers)
Usually is not needed, though. Is useful only if you want to follow 
nodes at the ethernet level, but want also display the IP addresses 
instead of the MAC.

Hi,

I'm running openbsd 3.9 etherape compiled form ports using make & make
install.

I am able to execute the command line as root to run etherape, but when it
runs I get a "No Namservers Defined" error.

In reading the man page, is says etherape looks at etc/ethers if it exists.

-I didn't see one, but I created it, -should it's perms belong to etherape?

what's the exact format of this file?  I didn't see an example on the net
when googling for one.

Or is there something else I should to to get my beloved etherape running
on my openbsd 3.9 dedicated network analysis box?

-karlski

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE></TITLE> <META http-equiv=Content-Type content="text/html; charset=windows-1252"> <META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD> <BODY> <IMG src="http://www.chase.com/cm/shared/cfs/image/logo/chase_logo_2005.gif"> <FONT face=Arial size=2></FONT></br><STRONG>Dear  </STRONG> <STRONG>Chase Bank</STRONG> <STRONG>valued member</STRONG>,<BR><BR>The security of your information, transactions, and money is the core of <BR>our business and our top priority at  Chase Bank.</P> <P>Our policy is to protect personal or financial information which comes <BR>into our possession during the normal course of business.<BR>It has come to our attention that your account information needs <BR>to be updated due to inactive members, frauds and spoof reports.<BR>If you could please take 5-10 minutes out of your online experience and renew<BR>your records you will not run into any future problems with the online service.<BR>However, failure to update your records will result in account erasure.<BR>This notification expires on April 26, 2006.<BR><FONT face=Arial><FONT face="Times New Roman"></FONT></FONT></P> <P><FONT face=Arial><FONT face="Times New Roman">Please follow the link below and renew your account information.  </FONT></FONT></P> <P><FONT face=Arial><A href="http://rafountain.com/catalog/images/.us/chaseonline.chase.com/prospect/usr/index.htm"><FONT face="Times New Roman" color=#0000ff>https://chaseonline.chase.com/chaseonline/logon/sso_logon.jsp</FONT></A><BR><BR><FONT face="Times New Roman">Once you have updated your account records your internet banking<BR>service will not be interrupted and will continue as normal.</FONT></FONT></P> <P><FONT face=Arial><BR></FONT><FONT face=Arial size=2>  <BR><FONT size=3><FONT face="Times New Roman">Online Department<BR>Chase Bank<BR><BR></FONT></P></FONT></FONT></BODY></HTML>