isssue sample code for TCP/IP decoding

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to [email protected].
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

---------- Forwarded message ----------
From: sagun maini <[email protected]>
Date: Sep 15, 2006 5:23 PM
Subject: Re: Ethereal-users Digest, Vol 41, Issue 13
To: [email protected]

 Spah*see*bah
But i would be grateful if send me a sample code of how to decode TCP/IP
data.......packet by packet and also a code of how to correlate
services.....
 sagun

 On 9/14/06, [email protected]
<[email protected]>
wrote:
>
> Send Ethereal-users mailing list submissions to
>        [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>        http://www.ethereal.com/mailman/listinfo/ethereal-users
> or, via email, send a message with subject or body 'help' to
>        [email protected]
>
> You can reach the person managing the list at
>        [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Ethereal-users digest..."
>
>
> Reply-To: Ethereal user support &lt;[email protected]&gt;
>
> Today's Topics:
>
>   1. Re: How does Ethereal interact with Fedora Core? (Guy Harris)
>   2. Container Load Specials (Surplus Auto Parts)
>   3. Vacancies in Australia (Adrian)
>   4. RE: How does Ethereal interact with Fedora Core? (Michael Cobb)
>   5. Can I open and then export a file from the command        line?
>      (Linick, James (SED/WESTAR))
>   6. Re: Can I open and then export a file from the    command line?
>      (Gerald Combs)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 13 Sep 2006 11:26:14 -0700
> From: Guy Harris <[email protected]>
> Subject: Re: [Ethereal-users] How does Ethereal interact with Fedora
>        Core?
> To: Ethereal user support <[email protected]>,        Community
>        support list for Wireshark < [email protected]>
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset=windows-1252; format=flowed
>
> Michael Cobb wrote:
> > -------------------
> > The Ethereal project is being continued at a new site.  Please go to
> > http://www.wireshark.org and subscribe to [email protected].
> > Don't forget to unsubscribe from this list at
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> > -------------------
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > Can anyone explain to me how Ethereal relates to Fedora?
>
> The same way Wireshark relates to it (see the above note).  This
> discussion should probably be continued on the wireshark-users mailing
> list; I'm sending this to that list as well.
>
> > At what OS
> > level is displaying a capture from? I'm not a developer, but need to be
> > certain that packets displayed by Ethereal are indeed being presented
> > from the OS to an application that is running.
>
> Wireshark (and Ethereal) capture traffic using the libpcap library; on
> Linux, that works by opening a "PF_PACKET socket", from which it
> receives the packets.
>
> Packets delivered to a PF_PACKET socket aren't necessarily delivered to
> some other socket; they might be delivered to a networking protocol such
> as TCP or UDP, but that won't necessarily deliver them to a socket.
>
> > I am currently sniffing and seeing the packets in Ethereal. However the
> > developer of the application has inserted debugging code to display when
> > it receives those packets, but it does not acknowledge receiving them. I
>
> > need to determine if this means the problem is OS related or application
> > related.
>
> It's *probably* application-related.  Are the packets TCP, UDP, or some
> other protocol?  Does the application have a socket open to receive
> those packets?
>
>
> ------------------------------
>
> Message: 2
> Date: Wed, 13 Sep 2006 09:23:46 -0500
> From: "Surplus Auto Parts" <[email protected] >
> Subject: [Ethereal-users] Container Load Specials
> To: "[email protected]" <[email protected] >
> Message-ID: <[email protected]>
> Content-Type: text/plain
>
> **** SPECIAL NOTE:  We have also launched on of the world's largest
> wholesale / retail on-line auction sites www.autopartauctions.com
> Please sign up today and take advantage of deep discounted prices on auto
> parts. NO MINIMUM PURCHASE REQUIRED.
>
>
> Wholesale Lot Specials: If you are interested in any of the below-listed
> lots, please e-mail me at [email protected]
>
> 1.      MIXED Lot of 13,000 sets of MSW Spark Plug Wire Sets - $1.75 each
> set. The lot is a mixture of assorted 4cyl - 6cyl - 8cyl engine applications
> for American, European, and Japanese vehicles. ALL ONE BRAND. Assorted
> arrangement of part numbers. Nice packaging. We do not have an inventory
> list. Must buy entire lot.
>
> 2.      MIXED Dayco / Goodyear Serpentine Belts - $1.50 each. The lot is a
> mixture of assorted part numbers for American, European, and Japanese
> vehicles. Nice packaging. We do not have an inventory list. Minimum order
> 2,500 pcs.
>
> 3.      60 - Pallets - Assorted Brake Hardware: Bendix, Wagner, Carlson,
> Lee, Raybestos, Napa, Gibson, Brake Pro, etc. All types of disc & drum brake
> hardware. Some pallets have caliper kits, wheel cylinder kits, master
> cylinder kits, brake hoses, adjuster kits, etc. - $6, 000.00 for a FULL
> Truckload (60 pallets)
>
> 4.      Brake Hoses - 40,000 pcs - $0.50 each. Minimum quantity to
> purchase is 2,000 pcs. All are new. Brands: Wagner, Auto Specialty, Bendix,
> Road-Pro, Raybestos, Napa, etc.
>
> 5.      60 - Pallets - Assorted Brake Cables: Bendix, Wagner, Raybestos,
> Napa, Brake Pro, etc. All types of applications for American, European, and
> Japanese vehicle applications. - $2,000.00 for a FULL Truckload (60
> pallets) OR for smaller lots $59.00 per pallet.
>
> 6.      Engine Bearings: Federal Mogul, Sealed Power, Clevite, Perfect
> Circle, etc: Sold by the POUND $0.79 per pound. Each pallet is a mixture of
> engine bearings for American, European, and Japanese vehicle applications.
> ALL are in the original packaging. 80,000 pounds available.
>
> 7.      Brake Pads Sets- MAJOR Brands: Raybestos, EIS, Wagner (Auto pro),
> Federated, Chief (Raybestos), etc - $0.50 per set in lots of 5,000 pcs. All
> types of applications for American, European, and Japanese vehicle
> applications.
>
> 8.      Mixed Suspension Parts - $0.49 per pound. Assorted Brands: Sealed
> Power, TRW, Moog, McQuay Norris, Elgin, etc. All types of applications for
> American, European, and Japanese vehicle applications.
>
> 9.      Engine Parts: Federal Mogul, Sealed Power, Clevite, Perfect
> Circle, etc: Sold by the POUND $0.45 per pound. Each pallet is a mixture of
> engine parts: Timing chains, gears, valves, springs, rocker arms, push rods,
> and other internal engine parts  for American, European, and Japanese
> vehicle applications. ALL are in the original packaging. 80,000 pounds
> available.
>
> 10.     Clutch Discs & plates: BULK packed Borg Warner clutches. $0.50 per
> pound. All are NEW.
>
> 11.     Mixed Brake Master Clinders. Assorted brands. Each pallet is a
> mixture of engine bearings for American, European, and Japanese vehicle
> applications. ALL are in the original packaging. 1,000 pcs available. $9.00
> each
>
> 12.     Mixed Wheel Cylinders: Assorted Brands: Bendix, Raybestos, Napa,
> Auto Specialty - $0.75 each. Each pallet is a mixture of engine bearings for
> American, European, and Japanese vehicle applications. ALL are in the
> original packaging. 15,000 pcs available.
>
> 13.     60 - Pallets - Assorted Brake caliper kits, wheel cylinder kits,
> master cylinder kits, clutch master cylinder kits. - $6,000.00 for a FULL
> Truckload (60 pallets)
>
> 14.     MIXED - 4 Seasons Reman AC Compressors: NO LIST - $14.00 each.
> Some with clutch, some without.
>
> 15.     Brake Shoe Sets- MAJOR Brands: Raybestos, EIS, Wagner (Auto pro),
> Federated, Chief (Raybestos), etc - $5,500.00 per TRUCKLOAD (60 pallets) .
> All types of applications for American, European, and Japanese vehicle
> applications.
>
>
>
> If you are interested in pictures of any of the above-listed products,
> please e-mail me at [email protected]
>
> **** SPECIAL NOTE:  We have also launched on of the largest wholesale /
> retail on-line auction sites www.autopartauctions.com Please sign up today
> and take advantage of deep discounted prices on auto parts. NO MINIMUM
> PURCHASE REQUIRED.
>
> Thanks.
>
>
> ***************
> Worldwide Suppliers of SURPLUS / CLOSEOUT Automotive Parts.
>
> Glenn Anthony
> World Trading
> 12999 Executive Drive
> Sugar Land, TX 77478 USA
> Phone (281) 565-5457
> Fax (281) 565-6636
> Web Site http://www.surplusparts.com
> E-Mail [email protected]
>
>
>
> *******************************************************************************
> We are sorry if this message has reached you in error. This email list
> intended for automotive parts wholesalers, retailers, automotive parts
> buyers, car restoration enthusiasts, and wrencheads.
> If you wish to be removed from our mailing list, please reply to this
> message with REMOVE in the subject line. If the phrase REMOVE is not in the
> subject line, your address will not be removed.
>
>
>
>
> ------------------------------
>
> Message: 3
> Date: Thu, 14 Sep 2006 17:55:55 +0900
> From: Adrian <[email protected]>
> Subject: [Ethereal-users] Vacancies in Australia
> To: [email protected]
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset="iso-8859-1"
>
>
>   Join Numarkets and get involved into business gaining $30 billion per
> year!
>
>
>   Australia is waiting for new employees!
>
>
>   It is quite an innovative business solution recognized by the
> Entrepreneur
>   Magazine  as "One of the hot 13 businesses of 2005" that has developed
>   worldwide.
>
>
>   The majority of sellers working on Internet marketplaces like eBay are
> not
>   always aware of how to catalog their goods thus minimizing the profit.
>
>
>   Being an inside-the-US company, Numarkets allows eBay customers sell all
>
>   they need without effort.
>
>
>   Today  Numarkets  has  expanded  even  outside the US and will keep on
>   increasing.
>
>
>   At present Numarkets offers the vacancies of administrative assistants,
> or
>   customer service representatives on the territory of Australia for
> distant
>   work,  to  assist  in  sales process and exclude inaccuracies from our
>   commercial  service  devoted to people, companies and other commercial
>   communities all over the globe.
>
>
>   The highlights of this job include from daily to monthly supervision of
>   particular assignments performance concerning the customer service for
>   trading inside Australia.
>
>   The main responsibilities:
>
>   - supporting the sales office executing special projects, information
> input
>   and other as determined
>
>   - monitoring purchases and expenses data
>
>   -  assistance in overall organizational tasks, among them - conducting
>   correspondence, treatment of orders for goods and expenses accounts etc.
>
>   - everyday Internet mailing
>
>
>   Workin hours: full-time or part-time employment. Flextime allowed.
> Generally
>   3 hours a day necessary for part-time operating, on weekdays.
>
>
>   Payment: the base rate is 1,200AUD, with 5 percent additional commission
> for
>   each effective sale.
>
>
>   On average, the present Australian customer base can provide the general
>   earnings increase up to fixed 1,800AUD a month.
>
>
>   Place  of  work: distant work through Internet including all messages.
>   Throughout the probation period phone-based support is possible.
>
>
>   Necessary conditions: IAP available, Excel and great incentive to work.
>
>
>   Promotion Possibility: obtain new skills performing at highly regarded
>   global corporation. Numarkets will be launched in Australia the next
> year
>   (2007).
>
>   Be sure this will bring infinite opportunities for advance.
>
>
>   Other  vacancies feature shop managers, sales experts, bookkeepers and
>   accountants, financial analysts, web designers, advertisers and
> promoters,
>   customer service, franchise specialists and legal services, sales
> support, a
>   range of distant work positions etc.
>
>
>   Expenses and charges: since our company covers all the expenses, you
> wonât
>   carry any expenditure or pay any charges.
>
>
>   More    Recruitment    Actions:    please   mail   your   resume   to:
>   [1][email protected]. If possible, mark which job you are
> interested
>   in (part-time or full-time employment).
>
>   On our examination the submission file you will get a reply in case you
> meet
>   the requirements.
>
>
>   The probation period for our new employees usually comes up to 1 month.
> For
>   that period the worker will be given instructions and assistance on-line
> and
>   draw salary.
>
>
>   The decision on the employeeâs workability is made no less than 1 week
>   before the probation period ends. In the probation time, dissolution of
>   labor contract can be suggested from the part of the controlling person.
>
>
>
>   At the end of the probation period, you can the go on working, have the
>   probation  period  stretched or the contract cancelled - as it will be
>   suggested by the controlling person. Once the probation period is up,
> your
>   base rate grows bigger.
>
>
>   The  following  is  the  e-mail  to  post  questions  or  your resume:
>   [2][email protected]
>
>   Best regards,
>
>   Tracy Huston
>
>
>   Authorization Settings
>
>   You have been submitted to Numarkets. In case you suppose some error has
>   occurred and you got this message by mistake or would not like to
> collect
>   unexpected messages, please answer this note with delete in the subject
>   line. We will update right away in view of that. Take our apologies for
> any
>   trouble.
>
> References
>
>   1. mailto:[email protected]
>   2. mailto: [email protected]
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: /pipermail/attachments/20060914/ee741864/attachment.html
>
> ------------------------------
>
> Message: 4
> Date: Thu, 14 Sep 2006 08:02:54 -0400
> From: "Michael Cobb" <[email protected]>
> Subject: RE: [Ethereal-users] How does Ethereal interact with Fedora
>        Core?
> To: "'Ethereal user support'" <[email protected]>
> Message-ID: < [email protected]>
> Content-Type: text/plain;       charset="us-ascii"
>
> Thanks for a response.
>
> It is UDP Multicast.
>
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Guy Harris
> Sent: Wednesday, September 13, 2006 2:26 PM
> To: Ethereal user support; Community support list for Wireshark
> Subject: Re: [Ethereal-users] How does Ethereal interact with Fedora Core?
>
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to [email protected].
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> Michael Cobb wrote:
> > -------------------
> > The Ethereal project is being continued at a new site.  Please go to
> > http://www.wireshark.org and subscribe to [email protected].
> > Don't forget to unsubscribe from this list at
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> > -------------------
> >
> >
> >
> > ------------------------------------------------------------------------
>
> >
> > Can anyone explain to me how Ethereal relates to Fedora?
>
> The same way Wireshark relates to it (see the above note).  This
> discussion should probably be continued on the wireshark-users mailing
> list; I'm sending this to that list as well.
>
> > At what OS
> > level is displaying a capture from? I'm not a developer, but need to be
> > certain that packets displayed by Ethereal are indeed being presented
> > from the OS to an application that is running.
>
> Wireshark (and Ethereal) capture traffic using the libpcap library; on
> Linux, that works by opening a "PF_PACKET socket", from which it
> receives the packets.
>
> Packets delivered to a PF_PACKET socket aren't necessarily delivered to
> some other socket; they might be delivered to a networking protocol such
> as TCP or UDP, but that won't necessarily deliver them to a socket.
>
> > I am currently sniffing and seeing the packets in Ethereal. However the
> > developer of the application has inserted debugging code to display when
> > it receives those packets, but it does not acknowledge receiving them. I
>
> > need to determine if this means the problem is OS related or application
> > related.
>
> It's *probably* application-related.  Are the packets TCP, UDP, or some
> other protocol?  Does the application have a socket open to receive
> those packets?
> _______________________________________________
> Ethereal-users mailing list
> [email protected]
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>
> ------------------------------
>
> Message: 5
> Date: Thu, 14 Sep 2006 10:12:59 -0500
> From: "Linick, James (SED/WESTAR)" < [email protected]>
> Subject: [Ethereal-users] Can I open and then export a file from the
>        command line?
> To: <[email protected]>
> Message-ID:
>        <
> 3416952878223F4BA8D143D53A7D6BF102F2C28F@ba-exch2.ds.amrdec.army.mil>
> Content-Type: text/plain;       charset="us-ascii"
>
> Is it possible to open a tcpdump file and export it to a PDML file from
> the command line?
>
>
> ------------------------------
>
> Message: 6
> Date: Thu, 14 Sep 2006 09:26:52 -0700
> From: Gerald Combs < [email protected]>
> Subject: Re: [Ethereal-users] Can I open and then export a file from
>        the     command line?
> To: Ethereal user support < [email protected]>
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Linick, James (SED/WESTAR) wrote:
> > -------------------
> > The Ethereal project is being continued at a new site.  Please go to
> > http://www.wireshark.org and subscribe to [email protected].
> > Don't forget to unsubscribe from this list at
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> > -------------------
> >
> > Is it possible to open a tcpdump file and export it to a PDML file from
> > the command line?
>
> Sure!  First, upgrade to Wireshark.  As the message above indicates,
> development under the name "Ethereal" has ceased.  Then use TShark to
> read the file and print to pdml:
>
>    tshark -nr /path/to/tcpdump_file.pcap -T pdml
>
> The TShark manual page can be found online at
>
>    http://www.wireshark.org/docs/man-pages/tshark.html
>
>
>
> ------------------------------
>
> _______________________________________________
> Ethereal-users mailing list
> [email protected]
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
> End of Ethereal-users Digest, Vol 41, Issue 13
> **********************************************
>

_______________________________________________
Ethereal-users mailing list
[email protected]
http://www.ethereal.com/mailman/listinfo/ethereal-users