It's called Wireshark now. No problem sniffing at 100Mb/s or even 1Gb/s on modern equipment, as long as you have root for promiscuous on NIC.<br><br><a href="http://www.wireshark.org/">http://www.wireshark.org/</a><br>
<br><br><br><br><br><div class="gmail_quote">On Wed, Nov 2, 2011 at 6:41 PM, Walt Smith <span dir="ltr"><<a href="mailto:waltechmail@yahoo.com">waltechmail@yahoo.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
Q:<br>
A demo of a network session should show the protocols in<br>
action at the ethernet level; i.e. some screen showing<br>
request --> ack -> grant payloads included embedded TCP/IP<br>
type of data.<br>
<br>
What should be used for this? Does ethereal software get down to the<br>
grit level?<br>
<br>
Background;<br>
I believe that several software packages will sniff an ethernet card<br>
and be able to symbolically display REQ, ACK for protocols at<br>
the TCP/IP Level. If so confirmation by a reader would be good.<br>
<br>
I don't know ( and maybe I could dig into the docs if I was<br>
relatively sure I was on the right track ) if the software has<br>
capability to get to the actual ethernet level to show the<br>
protocols there-- IS hardware needed such as a logic analyser<br>
(I've used several years ago ) or network analyser ?<br>
<br>
Case in point: ( so I hope I'm clear ).<br>
It is the case that software would format an IDE hard<br>
disk. Hi-level. It could check for errors, sectors etc.<br>
BUT -- there was a lower level -- a low level format -- that<br>
was generally considered to be "factory" which is where the REAL<br>
IDE ( or a lower set ) of instructions took place- so you<br>
(may have) needed to know what was going on for some reason.<br>
(Obviously, tech's don't need that level anymore outside of<br>
the flooded Thai factory - you may have for forensics or<br>
recovery etc... )<br>
<br>
So, if one wants to observe in symbol format the real ethernet<br>
bittys, what would one use ? ( is a fast PC able to get to the lowest<br>
levels with a NIC CHIP today, after all, 100 MBPS isnt' slow.<br>
Perhaps it could be done on a 10 MBPS line without real<br>
hardware )?<br>
<br>
TECH speak: IF the NIC is a shift register and the<br>
bitty's are flying in, it seems like a parallel read of the<br>
shift register real data is possible-- assuming the nic chip is<br>
designed that way.<br>
<br>
<br>
<br>
<br>
thx,<br>
<br>
Walt.........<br>
Celebrating over 14,000 emails in my Yahoo Inbox !<br>
<br>
_______________________________________________<br>
CALUG mailing list<br>
<a href="mailto:CALUG@unknownlamer.org">CALUG@unknownlamer.org</a><br>
<a href="http://lists.unknownlamer.org/listinfo/calug" target="_blank">http://lists.unknownlamer.org/listinfo/calug</a><br>
</blockquote></div><br>