announcing tcpview a motif based tcp ip protocol analyzer tcpview is the result of several problems we had at uw we have several network general sniffers which are heavily used to help debug problems on several hundred subnets these are good tools but they are heavy hard to find when you need one limited in their software expandibility difficult to use to upload data for analysis cannot be remotely operated and cannot resolve names with dns requiring much manual manipulation of the name table we also sometimes use tcpdump but we found it too difficult for most people did not have enough information for many protocols could not be used interactively could not handle tcp streams and could not read sniffer files however tcpdump did do a reasonable job of decoding a large number of protocols and could be easily modified tcpview is an attempt to resolve these problems by adding a motif interface to tcpdump and expanding its features tcpview has been tested on a decstation and sun under ultrix and sunos respectively it should work on the same systems as tcpdump it compiles with cc and gcc on the dec and sun to build tcpview you will need motif or better the following files are available for anonymous ftp from ftp cac washington edu in pub networking tcpview tar z tcpview and tcpdump source code tcpview sun tar z sun binaries tcpview dec tar z dec mips ultrix binaries what tcpview adds to tcpdump easier interface enhanced protocol decoding hex display of frame capture based on time number of frames or user interrupt can show ethernet addresses with manufacturer s name ethernet address host table can easily follow a stream highlighting out of order frames can send tcp data to an external file or filter for additional processing changes to tcpdump new features now reads and writes network general sniffer files when used with r the file type will be automatically detected can now read in and use an snmp mib file the hex format has been changed new time options have been added options were added to allow viewing and processing of the data in tcp packets bugs were fixed in the relative tcp sequence numbers s flag new flags r read sniffer file not usually needed except for reading from stdin ttt prints delta times tttt prints times relative to the first frame w write a sniffer save file use with w x print frame minus link level header in hexdump format sample output jeff cac washington edu nic funet fi ftp s win a c c c f e p d b a d j e p n x print tcp data in hexdump format used with z z write tcp data to stdout use with t to eliminate timestamp z write frames and tcp data to stdout martin m hunt martinh cac washington edu networks distributed computing university of washington martin hunt martinh cac washington edu networks and distributed computing university of washington
