Ethereal-users: Re: [Ethereal-users] Problems Importing TCPDUMP Output intoEthereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Mon, 14 Apr 2003 22:14:54 +0100
Certain Symantec Enterprise Firewall and Raptor firewall versions seems to include a special windows port of tcpdump and the following webpage explain a few things about that tcpdump version. However not enough information needed to support the captures made with that tcpdump version (libpcap files with link layer type 99).
http://www.firetower.com/forum/tcpdump.html

The information on Symantecs homepage is very limited, but indicates that "link layer headers are not available" when using
that tcpdump version.

http://service1.symantec.com/SUPPORT/entgate.nsf/5000e5ef2ad281c788256bc1005cd7cc/24de6a93de842b8b88256bd0007f9306?OpenDocument

http://service1.symantec.com/SUPPORT/entgate.nsf/5000e5ef2ad281c788256bc1005cd7cc/24de6a93de842b8b88256bd0007f9306/$FILE/tcpdump.pdf

It seems that the capture Richard sent (http://www.ethereal.com/lists/ethereal-users/200304/msg00137.html) contained ip-packets with some kind of packet header after the normal libpcap packet header. 
The extra packet header looked the same for all packets in that file (88 AE C8 78 00 00 08 00 00 00 00 00 00 00 00 00 ... 00 00 00 00) and it was easy to make an Analyzer (http://analyzer.polito.it) LFF-file that just discards those octets and set the link layer type to Raw IP. I sent the LFF file to Richard together with a converted capture a couple of days ago, and today he confirmed that the tcpdump program came with the Raptor firewall.

<-----Original Message-----
<From: Richard Ginski 
<To: Martin Regner
<Date: Monday, April 14, 2003 1:43 PM
<Subject: Re: [Ethereal-users] Problems Importing TCPDUMP OutputintoEthereal
<
<Yes this is a Raptor firewall. 

I guess that that the Analyzer LFF file I prepared may not work for all captures made with the modified SEF/Raptor tcpdump program and I also think it would be good if Ethereal could read those files directly, so I wonder if there is anyone that has some more information about this modified tcpdump version? 

Regards,
  Martin