Wireshark · Wireshark-users: Re: [Wireshark-users] Wireshark-users Digest, Vol 29, Issue 50

["余洪航" <cduter@xxxxxx>]

yeah ,i got a problem:

i want to get the content of the page,first i got the packets ,but,i found the http content are compressed to the gzip format,so,how can i unpack the gzip content?help,thanks a lot!

 

crazy :)

 

 

 

------------------ Original ------------------

From: "wireshark-users-request"<wireshark-users-request@xxxxxxxxxxxxx>;

Date: 2008年10月29日(星期三) 下午3:41

To: "wireshark-users"<wireshark-users@xxxxxxxxxxxxx>;

Subject: Wireshark-users Digest, Vol 29, Issue 50

 

Send Wireshark-users mailing list submissions to
    wireshark-users@xxxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
    https://wireshark.org/mailman/listinfo/wireshark-users
or, via email, send a message with subject or body 'help' to
    wireshark-users-request@xxxxxxxxxxxxx

You can reach the person managing the list at
    wireshark-users-owner@xxxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Wireshark-users digest..."


Today's Topics:

   1. msn messenger and in-game chat (Kevin dePfyffer)
   2. Re: capturing "unlicensed 900 MHz local area    network" packets
      (Guy Harris)
   3. Re: Finding mismatched HTTP Content-Length and    the data
      (Martin Visser)
   4. Re: Finding mismatched HTTP Content-Length    and    the data
      (Stephen Fisher)
   5. Re: Finding mismatched HTTP Content-Length and    the data (Ducky)
   6. Re: how to configure remote captureusing wireshark (Max P)


----------------------------------------------------------------------

Message: 1
Date: Tue, 28 Oct 2008 14:03:32 -0700
From: "Kevin dePfyffer" <kdepfyffer@xxxxxxxxx>
Subject: [Wireshark-users] msn messenger and in-game chat
To: wireshark-users@xxxxxxxxxxxxx
Message-ID:
    <6e9d32750810281403m1b50adeckc6a724003cf385ff@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset=ISO-8859-1

I know this has to have been asked 100 times and there seems to be a
lot of messages containing msn but I can not figure out how to capture
only msn messenger traffic.
I only want to see msn conversations, I don't care about the
attachments or what ever else you can grab. is there an easy way to do
this?
I would also like to grab chat from an online game that runs in java,
is that possible?
thanks for any help you can provide


------------------------------

Message: 2
Date: Tue, 28 Oct 2008 16:58:12 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Wireshark-users] capturing "unlicensed 900 MHz local
    area    network" packets
To: Community support list for Wireshark
    <wireshark-users@xxxxxxxxxxxxx>
Message-ID: <A5AABF55-FAC5-4C0E-97FF-70CBF0C50127@xxxxxxxxxxxx>
Content-Type: text/plain; charset=US-ASCII; format=flowed


On Oct 27, 2008, at 7:07 AM, Joe flowers wrote:

> Is there a recommended way (Wireshark or other) to capture "unlicensed
> 900 MHz local area network" (17,600 bps) packets?
>
> Thanks very much for any help, ideas, recommendations.

See the answer given to your previous message asking this question:

    http://www.wireshark.org/lists/wireshark-users/200810/msg00196.html


------------------------------

Message: 3
Date: Wed, 29 Oct 2008 15:38:13 +1100
From: "Martin Visser" <martinvisser99@xxxxxxxxx>
Subject: Re: [Wireshark-users] Finding mismatched HTTP Content-Length
    and    the data
To: "Community support list for Wireshark"
    <wireshark-users@xxxxxxxxxxxxx>
Message-ID:
    <b3739b0c0810282138i5592039ex214f5ffc52da23fd@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"

You should be able to do this in a tap/dissector written in LUA. I'm working
on a similar problem to look for particular HTTP response time patterns.

My impression is that LUA is intended for writing those "one-off" apps that
don't warrant complicating the standard distribution.

The problem (at least for me ) is that there aren't enough good published
examples. If I get what I want working, I'll try and help remedy that :-)

On Tue, Oct 28, 2008 at 3:03 PM, Ducky <duckyhatezchat@xxxxxxxxx> wrote:

> Steve,
>
> Thanks for the information. Some of the network devices tend to reset
> the connection when it happens, at least within my environment :)
>
> ./D
>
> On Tue, Oct 28, 2008 at 11:16 AM, Stephen Fisher
> <stephentfisher@xxxxxxxxx> wrote:
> > On Tue, Oct 28, 2008 at 10:59:13AM +0800, Ducky wrote:
> >
> >> I'm trying to find the web server's response that includes a
> >> Content-Length header that indicates a smaller value than the length
> >> of the data in the response. For example, if the web server sends a
> >> response with a Content-Length header value of 10 bytes, but the data
> >> size of the response is more than 10 bytes
> >>
> >> I am able to find the data length, by clicking on the data part of the
> >> packet and manually check against the Content-Length in header. It's
> >> too painful for me to look through thousands of packets.
> >
> > This would be fairly easy to add to the HTTP dissector.  However I am
> > wondering what the best way to do it would be and whether this is a
> > common enough problem to warrant such a validation in Wireshark?
> >
> >
> > Steve
> >
> > _______________________________________________
> > Wireshark-users mailing list
> > Wireshark-users@xxxxxxxxxxxxx
> > https://wireshark.org/mailman/listinfo/wireshark-users
> >
>
>
>
> --
> ./D
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>



--
Regards, Martin

MartinVisser99@xxxxxxxxx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.wireshark.org/lists/wireshark-users/attachments/20081029/9c19e7a4/attachment.htm

------------------------------

Message: 4
Date: Tue, 28 Oct 2008 22:47:06 -0600
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Subject: Re: [Wireshark-users] Finding mismatched HTTP Content-Length
    and    the data
To: wireshark-users@xxxxxxxxxxxxx
Message-ID: <20081029044706.GA84964@shadow.local>
Content-Type: text/plain; charset=us-ascii

On Wed, Oct 29, 2008 at 03:38:13PM +1100, Martin Visser wrote:

> You should be able to do this in a tap/dissector written in LUA. I'm
> working on a similar problem to look for particular HTTP response time
> patterns.
>
> My impression is that LUA is intended for writing those "one-off" apps
> that don't warrant complicating the standard distribution.

Good idea!

> The problem (at least for me ) is that there aren't enough good
> published examples. If I get what I want working, I'll try and help
> remedy that :-)

Have you seen this?

  http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html

If you figure out anything that isn't there, please open a bug report at
https://bugs.wireshark.org and submit an enhancement request with the
information so we can include it in the user's guide.  We can even put
more examples.


Steve



------------------------------

Message: 5
Date: Wed, 29 Oct 2008 13:04:52 +0800
From: Ducky <duckyhatezchat@xxxxxxxxx>
Subject: Re: [Wireshark-users] Finding mismatched HTTP Content-Length
    and    the data
To: "Community support list for Wireshark"
    <wireshark-users@xxxxxxxxxxxxx>
Message-ID:
    <de2610f90810282204t3386199etd88d15db9d014f13@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset=UTF-8

Lua is quite new to me, let's see what I can do with that.

On Wed, Oct 29, 2008 at 12:47 PM, Stephen Fisher
<stephentfisher@xxxxxxxxx> wrote:
> On Wed, Oct 29, 2008 at 03:38:13PM +1100, Martin Visser wrote:
>
>> You should be able to do this in a tap/dissector written in LUA. I'm
>> working on a similar problem to look for particular HTTP response time
>> patterns.
>>
>> My impression is that LUA is intended for writing those "one-off" apps
>> that don't warrant complicating the standard distribution.
>
> Good idea!
>
>> The problem (at least for me ) is that there aren't enough good
>> published examples. If I get what I want working, I'll try and help
>> remedy that :-)
>
> Have you seen this?
>
>  http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html
>
> If you figure out anything that isn't there, please open a bug report at
> https://bugs.wireshark.org and submit an enhancement request with the
> information so we can include it in the user's guide.  We can even put
> more examples.
>
>
> Steve
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>



--
../D


------------------------------

Message: 6
Date: Wed, 29 Oct 2008 00:34:25 -0700
From: "Max P" <addax.ws@xxxxxxxxx>
Subject: Re: [Wireshark-users] how to configure remote captureusing
    wireshark
To: "Community support list for Wireshark"
    <wireshark-users@xxxxxxxxxxxxx>
Message-ID:
    <11c7db630810290034o3e50d5a9w128231d76c46e474@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="iso-8859-1"

Hi,

Found your post. Probably you already found information but maybe not.

I did some implementation to support Remote functionality in GUI. I compiled
version which I'm using for my work. It can be download from
here<http://pankratov.us/wireshark-0.99.6-remote-1.zip>.
It's Win32 version.

Sorry I did not create installer version so just unpack archive to any
directory and start wireshark.exe.
Local installed WinPCAP required. If you do not know how to install WinPCAP
just run regular WireShark installation (0.99.6 recommended). It'll do
everything needed.

If you want capture from remote Windows PC go to WinPCAP installation
directory on remote PC and start rpcapd.exe. Copy from your Windows PC
should also work.

To remote capture from Linux PC rpcapd should be started. Check for
information how to build rpcapd for linux
here<http://www.mirrors.wiretapped.net/security/packet-capture/winpcap/docs/docs31/html/group__remote.html>.


I have compiled development version of rpcapd for FC4  (can work on other
linux'es as well). Available here <http://pankratov.us/rpcapd>.

You need to use -n flag for now when rpcapd started. Read documentation
(link I posted above) if have any questions on rpcapd.

After you start rpcapd, lunch my version of wireshark. Go
Properties->Capture->Edit..... You'll find a way to add new remote
interface.
Then go to Capture->Interfaces you'll see new interface in list. It should
work as regular interface.

Any comments welcome.
Max



On Sun, May 11, 2008 at 11:35 PM, vijaya n <vnemakal2@xxxxxxxxx> wrote:

> Hi,
> I am a newbie to wireshark. I am interested in using the remote capture
> capabilities of wireshark.I have downloaded the 1.0 version of wireshark.
> The release notes of earlier release says that the remote capture facility
> is integrated in the wireshark.
>  But I do not see any options on the wireshark gui to do remote capture.
> I could not get much help from any of the documents or in the web either on
> the usage of remote capture functionality using wireshark.
> I wanted to know the steps to follow to configure the remote capture.
>
> I went through
> http://www.mail-archive.com/wireshark-users@xxxxxxxxxxxxx/msg02940.html
> mail chain but that didn't help much.
>
> And in linux, the rpcap feature is not enabled by default. I enabled it and
> the compilation is failing.
>
> Any information on how to configure wireshark for using the remote capture
> functionality and how it is designed would be much appreciated
> Thanks in advance for the help
> regards
> Vijaya
>
> ------------------------------
> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it
> now.<http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ>
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.wireshark.org/lists/wireshark-users/attachments/20081029/f67f0d2d/attachment.htm

------------------------------

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users


End of Wireshark-users Digest, Vol 29, Issue 50
***********************************************