Wireshark · Ethereal-dev: Re: [Ethereal-dev] SQL help

[Michael Cohen <michael.cohen@xxxxxxxxxxxxxxx>]

Hi List,

  There is more current version of flag called pyflag available on
sourceforge:
  http://sourceforge.net/projects/pyflag/

  The file released there is a patch to ethereal 0.9.16, but the cvs
contains a patch to 0.10.2. The newer patch includes a knowledge base
feature, where ethereal remembers relationships on the network (who is
talking to whom etc) and writes out a summary SQL. This features can be
operated in real time (i.e. is fast enough to keep up). Flag uses this
to draw a network diagram of the network from the deduced knowledge.

The new patch might prove to be more workable re the SQL formatting.

Michael.

On Fri, 2004-03-12 at 13:39, Ober Heim wrote:
> Check out the Flag project.
> It is located at
> http://www.dsd.gov.au/library/software/flag/index.html
> It uses patches to ethereal, although based on an older version that works
> with mysql.
> The problem using other db's is the way in which Flag patch puts the info 
> out.
> It does multiline set calls that are not standard sql.
> (e.g.)
> insert into sometable set 
> field1 = 'lala'
> field2 = 'othervar'
> ..
> 
> Although it does handle frame already, as well as the base 
> tcp, udp, dns, http, pop items.
> Worth giving a look at.
> 
> The other way, the method I took, 
> was to write an awk parser to format it for sql format.
> Using the -z "proto,colinfo,frame_num,frame_num" type format you can
> print out most internal vars on the colinfo field.
> This method also allows you to stick with generic ethereal binaries, and 
> not need your own customer versions.
> 
> My 2 cents.
> On Thu, 11 Mar 2004, Evan J. Burrows wrote:
> 
> > Be patient with me this is my first post,
> > 
> > I m currently a senior in college and i am working on my senior design 
> > project. Part of my project includes pushing network info to a SQL 2000 
> > Server database. I need this information so i can do real-time analysis 
> > on the database (hopefully). I looked into various other programs but 
> > ethereal provided the best performance for the price since it is free. 
> > 
> > I have installed and compiled the ethereal source on Redhat 9 and have 
> > been looking at the source files the last 2 weeks trying to get a feel 
> > of how ethereal works. Unfortunately i am not a very experienced 
> > programmer and i am quite overwhelmed with the Ethereal source code. I 
> > know pushing the network information to database was on the wishlist 
> > and since i need it for my project i figured i would post here and see 
> > if anyone could help me out or point me in the right direction. 
> > 
> > I want to push the following information to my database:
> > source and destination ip and mac address, protocol, port number, 
> > packet size, Frame number, arrival time, etc.
> > 
> > I have looked through the code and the Readme files but i am still kind 
> > of confused with which source files contain this information. I have 
> > looked through the epan folder and think i found some of the stuff i 
> > need but i am not really sure. All the information that i want is 
> > printed to the ethereal gui but i just don't know where to find the 
> > actual source so i can throw in some SQL calls. i looked at 
> > print_packets and thought that possibly might have something to do with 
> > it. I appologize if this topic has been covered already, but like i 
> > said i just subscribed today. If anyone has any information that might 
> > help me please post back; whether it be to try and help me out or point 
> > me in the right direction. 
> > 
> > thanks,
> > Evan 
> > 
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> > 
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>