From bart.smaalders@Sun.Com Mon Jun 11 13:44:24 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BKiNCO008521 for ; Mon, 11 Jun 2007 13:44:24 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5BKgmKJ008243 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 04:42:51 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00G09O7E8500@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 13:42:50 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00EG4O7EHO20@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 13:42:50 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5BKgoXY001835 for ; Mon, 11 Jun 2007 13:42:50 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5BKgoT1017872 for ; Mon, 11 Jun 2007 13:42:50 -0700 (PDT) Date: Mon, 11 Jun 2007 13:41:00 -0700 From: Bart Smaalders Subject: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: PSARC-EXT@Sun.Com Message-id: <466DB35C.7000603@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA)" X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 5096 This is a multi-part message in MIME format. --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT I'm sponsoring the attached open fasttrack for myself. I'm looking for minor release binding and the case times out 6/13/2007. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA) Content-type: text/plain; name=wireshark.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=wireshark.txt 1. Introduction 1.1. Project/Component Working Name: Add Wireshark 0.99.5 into Solaris 1.2. Name of Document Author/Supplier: Author: Bart Smaalders 1.3 Date of This Document: June 7, 2007 4. Technical Description Summary This project integrates Wireshark v 0.99.5 into Solaris This project requests a minor release binding. Background Wireshark (ne Ethereal) is a very popular network protocol analyzer e.g. a graphical snoop. It runs under a variety of platforms, and is licensed under the GNU General Public License. It captures packets (when run as root) and displays them in a GTK-based GUI. A sample screenshot can be found here: http://wireshark.org/image/front_screen_full.png More information is available at http://wireshark.org Details This project delivers the following binaries: usr/sbin/wireshark Wireshark is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. usr/sbin/editcap Editcap is a program that reads some or all of the captured packets from the infile, optionally converts them in various ways and writes the resulting packets to the capture outfile (or outfiles). usr/sbin/capinfos Capinfos is a program that reads one or more capture files and returns some or all available statistics of each . usr/sbin/text2pcap Text2pcap is a program that reads in an ASCII hex dump and writes the data described into a libpcap capture file. text2pcap can read hexdumps with multiple packets in them, and build a capture file of multiple packets. text2pcap is also capable of generating dummy Ethernet, IP and UDP, TCP, or SCTP headers, in order to build fully processable packet dumps from hexdumps of application-level data only. usr/sbin/tshark TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. usr/sbin/mergecap Mergecap is a program that combines multiple saved capture files into a single output file specified by the -w argument. Mergecap knows how to read libpcap capture files, including those of tcpdump, Wireshark, and other tools that write captures in that format. usr/sbin/dumpcap Dumpcap is a network traffic dump tool. It lets you capture packet data from a live network and write the packets to a file. Dumpcap's native capture file format is libpcap format, which is also the format used by Wireshark, tcpdump and various other tools. Additional files Man pages are provided in /usr/share/man. HTML help pages are delivered into /usr/share/wireshark; these are brought up in a browser if help is selected from within Wireshark. Various other bits of private implementation details can be found under usr/share/wireshark as well. Program plugins are delivered into usr/lib/wireshark/plugins/0.99.5. There are two private libraries delivered into /usr/lib. Following current SFW practice, all binaries, man pages, etc are delivered in a single package, SUNWwireshark. Wireshark appears in the JDS desktop menu under System Tools. A complete list of delivered files is in the case directory in SVR4 package prototype form as prototype_com; the man pages can be found in the man subdirectory. Interfaces The names of the introduced binaries are Unstable. The command line interfaces, output, etc, are all External. 4.2 Bug/RFE Numbers 6567201 Solaris should include Wireshark 5. References PSARC 1999/555: Getting with the Freeware Program PSARC 2005/185: Enabling Serendipitous Discovery http://wireshark.org 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: sfw 6.5. ARC review type: Fasttrack --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA)-- From Garrett.Damore@sun.com Mon Jun 11 13:54:12 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BKsBQS009090 for ; Mon, 11 Jun 2007 13:54:12 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5BKqBAl017828; Mon, 11 Jun 2007 14:52:16 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00H1JONR7G00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 13:52:39 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00KOTONQ4EB0@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 13:52:38 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5BKqcSu004178; Mon, 11 Jun 2007 13:52:38 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJH00M01NH7TM00@fe-sfbay-10.sun.com> (original mail from Garrett.Damore@Sun.COM); Mon, 11 Jun 2007 13:52:38 -0700 (PDT) Received: from [192.168.251.21] ([76.174.83.55]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJH000EWONN0QB0@fe-sfbay-10.sun.com>; Mon, 11 Jun 2007 13:52:35 -0700 (PDT) Date: Mon, 11 Jun 2007 13:50:39 -0700 From: "Garrett D'Amore" Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DB35C.7000603@Sun.COM> Sender: Garrett.Damore@sun.com To: Bart Smaalders Cc: PSARC-EXT@sun.com Message-id: <466DB59F.9070907@sun.com> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> User-Agent: Thunderbird 2.0b2 (X11/20070227) Status: RO Content-Length: 1311 Bart Smaalders wrote: > I'm sponsoring the attached open fasttrack for myself. I'm > looking for minor release binding and the case times out > 6/13/2007. > > - Bart > I don't have any experience with wireshare, although I used ethereal not too long ago. I have a few questions, though. 1) a lot of files seem to be needed for /usr/sbin {wireshark, editcap, capinfos, text2pcap, tshark, mergecap, dumpcap}. Is it likely that an admin is going to want to use all of these? I'm just wondering about "pollution" of the namespace in /usr/sbin. Are these separate programs, or just hardlinks to the same file? Would it make sense to either deliver some of these in a different directory (/usr/lib? /usr/wireshark? I don't know) or (if they are all hardlinks to the same file activated by switching on argv[0]) rely on a command line switch to select behavior? 2) are all the tools only applicable/useful for system administrators? does it make sense to offer the wireshark binary (and maybe tshark) in usr/bin instead of /usr/sbin? 3) i presume wireshark can deal with files captured by snoop(1m)? Either way, it should be called out in the case materials, I think. I don't know what the dominant practice in other FOSS distros, so I'd be interested hear about that, too. -- Garrett From carlsonj@phorcys.east.sun.com Mon Jun 11 14:06:36 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BL6ZHF009434 for ; Mon, 11 Jun 2007 14:06:36 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5BL4tKf014393; Tue, 12 Jun 2007 05:05:02 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00I01P8CF100@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 14:05:00 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00KSFP8B49D0@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 14:04:59 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5BL4x5f003691; Mon, 11 Jun 2007 17:04:59 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5BL4xb5003688; Mon, 11 Jun 2007 17:04:59 -0400 (EDT) Date: Mon, 11 Jun 2007 17:04:59 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DB35C.7000603@Sun.COM> To: Bart Smaalders Cc: PSARC-EXT@sun.com Message-id: <18029.47355.19540.85850@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> Status: RO Content-Length: 1258 Bart Smaalders writes: > It captures packets (when run as root) and displays them > in a GTK-based GUI. Do we have any precedent for non-GNOME use of GTK? It looks to me like those libraries deliver from JDS, not SFW. > Wireshark is a GUI network protocol analyzer. It lets you > interactively browse packet data from a live network or from > a previously saved capture file. Wireshark's native capture > file format is libpcap format, which is also the format used > by tcpdump and various other tools. So, what's the plan for snoop? Does it get removed eventually? It doesn't seem good for users to be bounced back and forth between two different tools to do the same job. > There are two private libraries delivered into /usr/lib. I don't see libpcap. Where does that come from? I see a seriously large number of libraries used by blastwave's ethereal. Are the same ones dragged in here? If so, where are they? If not, then is there functionality missing from the Solaris SFW version? Any features disabled? -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From bart.smaalders@sun.com Mon Jun 11 14:54:25 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BLsOgN010854 for ; Mon, 11 Jun 2007 14:54:25 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5BLqm0m027851 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 05:52:53 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00N0DRG24Z00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 14:52:50 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00KGFRG24GE0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 14:52:50 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5BLqo0O008279; Mon, 11 Jun 2007 14:52:50 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5BLqnX2019398; Mon, 11 Jun 2007 14:52:49 -0700 (PDT) Date: Mon, 11 Jun 2007 14:50:59 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DB59F.9070907@sun.com> To: "Garrett D'Amore" Cc: PSARC-EXT@sun.com Message-id: <466DC3C3.8080107@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <466DB59F.9070907@sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 4235 Garrett D'Amore wrote: > Bart Smaalders wrote: >> I'm sponsoring the attached open fasttrack for myself. I'm >> looking for minor release binding and the case times out >> 6/13/2007. >> >> - Bart >> > I don't have any experience with wireshare, although I used ethereal not > too long ago. > > I have a few questions, though. > > 1) a lot of files seem to be needed for /usr/sbin {wireshark, editcap, > capinfos, text2pcap, tshark, mergecap, dumpcap}. Is it likely that an > admin is going to want to use all of these? I'm just wondering about > "pollution" of the namespace in /usr/sbin. Are these separate programs, > or just hardlinks to the same file? Would it make sense to either > deliver some of these in a different directory (/usr/lib? > /usr/wireshark? I don't know) or (if they are all hardlinks to the same > file activated by switching on argv[0]) rely on a command line switch to > select behavior? > All of the commands above have man pages and are usable by administrators. If one primarily uses Wireshark (the gui), the others may languish used. However, for command line purists and those writing shell scripts tshark and friends will be useful. > 2) are all the tools only applicable/useful for system administrators? > does it make sense to offer the wireshark binary (and maybe tshark) in > usr/bin instead of /usr/sbin? > If someone would like to clearly state the policy, I'll be happy (absent the sort of technical issues that arose in the nmap case) to follow it. Last time, the nmap case was derailed into a full review largely over the /usr/sbin vs /usr/bin controversy. In order to capture packets, wireshark needs the same privs. as snoop; given the presence of snoop in /usr/sbin and the strong similarity in functionality it seems logical to place wireshark in /usr/sbin as well. Basically, I don't have any strong feelings one way or the other. > 3) i presume wireshark can deal with files captured by snoop(1m)? > Either way, it should be called out in the case materials, I think. > Yes. From the wireshark man page (page 1): capture format * libpcap, tcpdump and various other tools using tcpdump's * snoop and atmsnoop * Shomiti/Finisar Surveyor captures * Novell LANalyzer captures * Microsoft Network Monitor captures * AIX's iptrace captures * Cinco Networks NetXRay captures * Network Associates Windows-based Sniffer captures (compressed or uncompressed) captures * Network General/Network Associates DOS-based Sniffer EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures * AG Group/WildPackets * RADCOM's WAN/LAN analyzer captures * Network Instruments Observer version 9 captures * Lucent/Ascend router debug output * files from HP-UX's nettl * Toshiba's ISDN routers dump output * the output from i4btrace from the ISDN4BSD project * traces from the EyeSDN USB S0. Detection System * the output in IPLog format from the Cisco Secure Intrusion * pppd logs (pppdump format) * the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities * the text output from the DBS Etherwatch VMS utility * Visual Networks' Visual UpTime traffic capture * the output from CoSine L2 debug * the output from Accellent's 5Views LAN agents * Endace Measurement Systems' ERF format captures * Linux Bluez Bluetooth stack hcidump -w traces * Catapult DCT2000 .out files There is no need to tell Wireshark what type of file you are reading; it will determine the file type by itself. Wireshark is also capable of reading any of these file formats if they are compressed using gzip. Wireshark recognizes this directly from the file; the '.gz' extension is not required for this purpose. > I don't know what the dominant practice in other FOSS distros, so I'd be > interested hear about that, too. > Wireshark (and friends) install by default into /usr/bin, but will happily work in /usr/sbin as well. I'll take a look at what other systems do... - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From bart.smaalders@sun.com Mon Jun 11 15:14:16 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BMEFfS011104 for ; Mon, 11 Jun 2007 15:14:15 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5BMAYtd015058 for <@newsunmail1brm.central.sun.com:PSARC-EXT@Sun.COM>; Mon, 11 Jun 2007 23:12:43 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00F03SD2UA00@brm-avmta-1.central.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 16:12:38 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00E9TSD17P10@brm-avmta-1.central.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Mon, 11 Jun 2007 16:12:38 -0600 (MDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5BMCbbH009984; Mon, 11 Jun 2007 15:12:37 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5BMCbjt019766; Mon, 11 Jun 2007 15:12:37 -0700 (PDT) Date: Mon, 11 Jun 2007 15:10:46 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18029.47355.19540.85850@gargle.gargle.HOWL> To: James Carlson Cc: PSARC-EXT@sun.com Message-id: <466DC866.8000004@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 5320 James Carlson wrote: > Bart Smaalders writes: >> It captures packets (when run as root) and displays them >> in a GTK-based GUI. > > Do we have any precedent for non-GNOME use of GTK? It looks to me > like those libraries deliver from JDS, not SFW. > Yes. They are committed interfaces, so all of us are free to use them. Nmap (recently reviewed) is also a GTK gui, as you'll remember. >> Wireshark is a GUI network protocol analyzer. It lets you >> interactively browse packet data from a live network or from >> a previously saved capture file. Wireshark's native capture >> file format is libpcap format, which is also the format used >> by tcpdump and various other tools. > > So, what's the plan for snoop? Does it get removed eventually? > That's a possibility. The maintainers of snoop can make that choice. It might make more sense to enhance wireshark rather than to expend the effort needed to update snoop periodically. > It doesn't seem good for users to be bounced back and forth between > two different tools to do the same job. > There's really more of a conflict between tshark and snoop; both are cmdline network packet analyzers. Wireshark is a pretty complete, functional GUI. The wireshark set of tools seems more complete to me, but I'm no networking expert. >> There are two private libraries delivered into /usr/lib. > > I don't see libpcap. Where does that come from? > I'm statically linking that into wireshark; it doesn't really want (eg easily) build a dynamic version OOB. Until such time as we have additional clients, static linking saves effort. > I see a seriously large number of libraries used by blastwave's > ethereal. Are the same ones dragged in here? If so, where are they? > If not, then is there functionality missing from the Solaris SFW > version? Any features disabled? > Here's the DTNEEDED entries from /usr/sbin/wireshark: [0] NEEDED 0xfd29 libwiretap.so.0 [1] NEEDED 0xfd39 libwireshark.so.0 [2] NEEDED 0xfd4b libnetsnmp.so.5 [3] NEEDED 0xfd5b libpkcs11.so.1 [4] NEEDED 0xfd6a libgen.so.1 [5] NEEDED 0xfd76 libkstat.so.1 [6] NEEDED 0xfd84 libelf.so.1 [7] NEEDED 0xfd90 libdl.so.1 [8] NEEDED 0xfca6 libsocket.so.1 [9] NEEDED 0xfd9b libadm.so.1 [10] NEEDED 0xfda7 libcrypto.so.0.9.8 [11] NEEDED 0xfdba libgtk-x11-2.0.so.0 [12] NEEDED 0xfdce libgdk-x11-2.0.so.0 [13] NEEDED 0xfde2 libatk-1.0.so.0 [14] NEEDED 0xfdf2 libgdk_pixbuf-2.0.so.0 [15] NEEDED 0xfcbe libm.so.2 [16] NEEDED 0xfe09 libmlib.so.2 [17] NEEDED 0xfe16 libpangocairo-1.0.so.0 [18] NEEDED 0xfe2d libpango-1.0.so.0 [19] NEEDED 0xfe3f libcairo.so.2 [20] NEEDED 0xfe4d libgobject-2.0.so.0 [21] NEEDED 0xfe61 libgmodule-2.0.so.0 [22] NEEDED 0xfe75 libgthread-2.0.so.0 [23] NEEDED 0xfcd1 libpthread.so.1 [24] NEEDED 0xfcea libthread.so.1 [25] NEEDED 0xfe89 libglib-2.0.so.0 [26] NEEDED 0xfe9a libgnutls.so.12 [27] NEEDED 0xfeaa libgcrypt.so.11 [28] NEEDED 0xfeba libgpg-error.so.0 [29] NEEDED 0xfcf9 libnsl.so.1 [30] NEEDED 0xfecc libz.so.1 [31] NEEDED 0xfd05 libc.so.1 I'm going over the list w/ Dermot; there are a couple for which I'll need contracts. When libpcre integrates, that will appear in the above list as well. I also need contracts w/ Darrin for the crypto libraries. I've disabled building 3 components (dftest, randpkt, and idl2wrs) as these are better suited to Wireshark plugin developers than to a general purpose tool. The configure entry currently looks like this: $(VER)/config.status: $(VER)/configure Makefile.sfw (cd $(VER); env \ MAKE=$(GMAKE) \ PATH=/usr/xpg4/bin:/usr/perl5/bin:/usr/bin:/usr/sfw/bin:/usr/ccs/bin \ LD_OPTIONS="-M $(SRC)/cmd/mapfile_noexstk" \ HTML_VIEWER=firefox \ ./configure \ --disable-usr-local \ --with-pcap=$(ROOT)/usr \ --enable-threads \ --disable-dftest \ --disable-idl2wrs \ --disable-randpkt \ --with-ssl=/usr/sfw \ --mandir=/usr/share/man \ --bindir=/usr/sbin \ --prefix=/usr \ --exec-prefix=/usr \ ) - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Neal.Pollack@Sun.COM Mon Jun 11 15:18:49 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BMInV0011296 for ; Mon, 11 Jun 2007 15:18:49 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5BMHGTr008478; Mon, 11 Jun 2007 15:17:16 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00G05SKR7Z00@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 16:17:16 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00EEWSKR7T10@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 16:17:15 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5BMHFGm013900; Mon, 11 Jun 2007 15:17:15 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJH00F01SKAFJ00@fe-sfbay-09.sun.com> (original mail from Neal.Pollack@Sun.COM); Mon, 11 Jun 2007 15:17:15 -0700 (PDT) Received: from [192.168.1.10] ([71.177.238.15]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJH00BV4SKR5I10@fe-sfbay-09.sun.com>; Mon, 11 Jun 2007 15:17:15 -0700 (PDT) Date: Mon, 11 Jun 2007 15:17:19 -0700 From: Neal Pollack Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18029.47355.19540.85850@gargle.gargle.HOWL> Sender: Neal.Pollack@Sun.COM To: James Carlson Cc: Bart Smaalders , PSARC-EXT@Sun.COM Message-id: <466DC9EF.3020207@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> User-Agent: Thunderbird 1.5.0.12 (Windows/20070509) Status: RO Content-Length: 1362 James Carlson wrote: > > So, what's the plan for snoop? Does it get removed eventually? > > It doesn't seem good for users to be bounced back and forth between > two different tools to do the same job. > I respectfully disagree. Customers like choice. Linux became so popular because of how much choice the user has in tools, applications, file systems, etc. You gain more customers if you have more choices. That is why we are expanding the numbers of products we offer. On the software side, some people like xine, some prefer mplayer. Some like normal upgrade, others enjoy live upgrade. Some like ufs, some veritas, some zfs. Some like firefox, others download different browsers. If you take away all choice, you will discover over time a reduction in total customer count. I do not think the introduction of a new tool should necessitate the removal of an existing tool. I simply view it as a long overdue attempt to make the Solaris distro "more complete". > >> There are two private libraries delivered into /usr/lib. >> > > I don't see libpcap. Where does that come from? > > I see a seriously large number of libraries used by blastwave's > ethereal. Are the same ones dragged in here? If so, where are they? > If not, then is there functionality missing from the Solaris SFW > version? Any features disabled? > > From sommerfeld@sun.com Mon Jun 11 15:21:02 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BML2UP011350 for ; Mon, 11 Jun 2007 15:21:02 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5BMJSOn022542; Mon, 11 Jun 2007 15:19:31 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00G0DSOIEI00@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 16:19:30 -0600 (MDT) Received: from eastmail2bur.East.Sun.COM ([129.148.13.40]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00E47SOH7S10@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 16:19:29 -0600 (MDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail2bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5BMJRDd006176; Mon, 11 Jun 2007 18:19:27 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BMJRxO000835; Mon, 11 Jun 2007 18:19:27 -0400 (EDT) Date: Mon, 11 Jun 2007 18:19:26 -0400 From: Bill Sommerfeld Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DB35C.7000603@Sun.COM> To: Bart Smaalders Cc: PSARC-EXT@sun.com Message-id: <1181600366.27903.79.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> Status: RO Content-Length: 795 On Mon, 2007-06-11 at 13:41 -0700, Bart Smaalders wrote: > The names of the introduced binaries are Unstable. > The command line interfaces, output, etc, are all External. This is old terminology. See http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ for the current interface stability taxonomy. What's the stability level of the format of the packet capture files generated by this project? I'd expect files generated by an older version to be readable by any future version, but Volatile would permit the format to be changed incompatibly in a patch rendering the older files unreadable; the documentation you quoted clealy shows a commitment by the wireshark maintainers akin to Committed on the ability to read varying packet capture formats. - Bill From bart.smaalders@sun.com Mon Jun 11 15:54:52 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BMsp7l012310 for ; Mon, 11 Jun 2007 15:54:52 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5BMrAUG013363; Tue, 12 Jun 2007 06:53:19 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00M05U8SM600@nwk-avmta-2.sfbay.sun.com>; Mon, 11 Jun 2007 15:53:16 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00EXLU8SHN80@nwk-avmta-2.sfbay.sun.com>; Mon, 11 Jun 2007 15:53:16 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5BMrGim013628; Mon, 11 Jun 2007 15:53:16 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5BMrF0G020930; Mon, 11 Jun 2007 15:53:15 -0700 (PDT) Date: Mon, 11 Jun 2007 15:51:25 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1181600366.27903.79.camel@thunk> To: Bill Sommerfeld Cc: PSARC-EXT@sun.com Message-id: <466DD1ED.5030304@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <1181600366.27903.79.camel@thunk> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1385 Bill Sommerfeld wrote: > On Mon, 2007-06-11 at 13:41 -0700, Bart Smaalders wrote: >> The names of the introduced binaries are Unstable. >> The command line interfaces, output, etc, are all External. > > This is old terminology. See > http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ > for the current interface stability taxonomy. > > What's the stability level of the format of the packet capture files > generated by this project? > The stability level will be as determined by the external project; I'm not anticipating making changes to wireshark. > I'd expect files generated by an older version to be readable by any > future version, but Volatile would permit the format to be changed > incompatibly in a patch rendering the older files unreadable; the > documentation you quoted clealy shows a commitment by the wireshark > maintainers akin to Committed on the ability to read varying packet > capture formats. Ok. If you prefer, we can raise the stability level of these files. If wireshark changes to write a new type of file, but can still read the old ones, is it still a committed interface? E.g., do we commit to being able to read old files in the future, or do we commit to always producing the current output file format? - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From John.Plocher@sun.com Mon Jun 11 16:17:09 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5BNH9fu012752 for ; Mon, 11 Jun 2007 16:17:09 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5BNFUmS028184; Tue, 12 Jun 2007 00:15:35 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00001V9XU800@nwk-avmta-2.sfbay.sun.com>; Mon, 11 Jun 2007 16:15:33 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00ECGV9XHNA0@nwk-avmta-2.sfbay.sun.com>; Mon, 11 Jun 2007 16:15:33 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5BNFWfv000937; Mon, 11 Jun 2007 16:15:32 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJH00M01V3S6G00@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM); Mon, 11 Jun 2007 16:15:32 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJH00743V9WUE70@fe-sfbay-09.sun.com>; Mon, 11 Jun 2007 16:15:32 -0700 (PDT) Date: Mon, 11 Jun 2007 16:15:22 -0700 From: John Plocher Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DD1ED.5030304@Sun.COM> Sender: John.Plocher@sun.com To: Bart Smaalders Cc: Bill Sommerfeld , PSARC-EXT@sun.com Message-id: <466DD78A.10007@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <1181600366.27903.79.camel@thunk> <466DD1ED.5030304@Sun.COM> User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 758 Bart Smaalders wrote: > Ok. If you prefer, we can raise the stability level of these > files. If wireshark changes to write a new type of file, but can > still read the old ones, is it still a committed interface? > E.g., do we commit to being able to read old files in the > future, or do we commit to always producing the current > output file format? The former - commit to read old files in the future. This lets you evolve the default output format while not abandoning any troves of historical network logs. If you write out new format by default, it would be good (but not an absolute requirement) to be able to force a specific other version. Could be just for V(n-1), or - if so motivated - for any of the supported input formats. -John From bart.smaalders@Sun.COM Mon Jun 11 17:22:04 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5C0M4DK016564 for ; Mon, 11 Jun 2007 17:22:04 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5C0K8xl053008; Mon, 11 Jun 2007 18:20:08 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00A01YA8TM00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 17:20:32 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH009OZYA6GI50@nwk-avmta-1.sfbay.Sun.COM>; Mon, 11 Jun 2007 17:20:30 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5C0KTPF021089; Mon, 11 Jun 2007 17:20:29 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5C0KTmx005947; Mon, 11 Jun 2007 17:20:29 -0700 (PDT) Date: Mon, 11 Jun 2007 17:18:38 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DD78A.10007@Sun.Com> To: John Plocher Cc: Bill Sommerfeld , PSARC-EXT@Sun.COM Message-id: <466DE65E.2070108@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <1181600366.27903.79.camel@thunk> <466DD1ED.5030304@Sun.COM> <466DD78A.10007@Sun.Com> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1277 John Plocher wrote: > Bart Smaalders wrote: >> Ok. If you prefer, we can raise the stability level of these >> files. If wireshark changes to write a new type of file, but can >> still read the old ones, is it still a committed interface? >> E.g., do we commit to being able to read old files in the >> future, or do we commit to always producing the current >> output file format? > > > The former - commit to read old files in the future. This > lets you evolve the default output format while not abandoning > any troves of historical network logs. > > If you write out new format by default, it would be good > (but not an absolute requirement) to be able to force a > specific other version. Could be just for V(n-1), or - if > so motivated - for any of the supported input formats. > > -John Since this is open source that we're bringing in, the word "you" here is problematic. I cannot promise or commit stability on the part of others. Certainly, the past history of wireshark/ethereal leads me to believe that it will load old capture files... but I certainly would hesitate to say that wireshark will never enhance the current capture format. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From John.Plocher@sun.com Mon Jun 11 17:30:01 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5C0U1Ze016733 for ; Mon, 11 Jun 2007 17:30:01 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5C0STOd013178; Mon, 11 Jun 2007 17:28:30 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJH00209YNHO900@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 18:28:29 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJH00E3VYNH7S70@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 18:28:29 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5C0SSfx026894; Mon, 11 Jun 2007 17:28:28 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJH00I01YKAGS00@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM); Mon, 11 Jun 2007 17:28:28 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJH003RHYNGBYF0@fe-sfbay-09.sun.com>; Mon, 11 Jun 2007 17:28:28 -0700 (PDT) Date: Mon, 11 Jun 2007 17:28:17 -0700 From: John Plocher Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DE65E.2070108@Sun.COM> Sender: John.Plocher@sun.com To: Bart Smaalders Cc: Bill Sommerfeld , PSARC-EXT@sun.com Message-id: <466DE8A1.6010604@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <1181600366.27903.79.camel@thunk> <466DD1ED.5030304@Sun.COM> <466DD78A.10007@Sun.Com> <466DE65E.2070108@Sun.COM> User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 1535 It sure sounds like Input format = Committed Output format = Committed Consolidation = wireshark That is, only promise stability within wireshark release boundries and make it possible for wireshark to evolve at its own pace, independent from the more stable ON consolidation. -John Bart Smaalders wrote: > John Plocher wrote: >> Bart Smaalders wrote: >>> Ok. If you prefer, we can raise the stability level of these >>> files. If wireshark changes to write a new type of file, but can >>> still read the old ones, is it still a committed interface? >>> E.g., do we commit to being able to read old files in the >>> future, or do we commit to always producing the current >>> output file format? >> >> >> The former - commit to read old files in the future. This >> lets you evolve the default output format while not abandoning >> any troves of historical network logs. >> >> If you write out new format by default, it would be good >> (but not an absolute requirement) to be able to force a >> specific other version. Could be just for V(n-1), or - if >> so motivated - for any of the supported input formats. >> >> -John > > Since this is open source that we're bringing in, the > word "you" here is problematic. I cannot promise or commit > stability on the part of others. Certainly, the past history > of wireshark/ethereal leads me to believe that it will load > old capture files... but I certainly would hesitate to say > that wireshark will never enhance the current capture > format. > > - Bart > > From Michael.Hunter@sun.com Mon Jun 11 19:47:52 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5C2lpIP020464 for ; Mon, 11 Jun 2007 19:47:52 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5C2kHUP004646; Tue, 12 Jun 2007 03:46:18 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00D015159O00@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 20:46:17 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI00EJV5157WD0@brm-avmta-1.central.sun.com>; Mon, 11 Jun 2007 20:46:17 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5C2kHtV003036; Mon, 11 Jun 2007 19:46:17 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJI000014SSDI00@fe-sfbay-10.sun.com> (original mail from Michael.Hunter@Sun.COM); Mon, 11 Jun 2007 19:46:17 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJI00FC3514ZM30@fe-sfbay-10.sun.com>; Mon, 11 Jun 2007 19:46:16 -0700 (PDT) Date: Mon, 11 Jun 2007 19:46:16 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DC9EF.3020207@Sun.COM> Sender: Michael.Hunter@sun.com To: Neal Pollack Cc: James Carlson , Bart Smaalders , PSARC-EXT@sun.com Message-id: <20070611194616.00005d36@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.8.1cvs10-csw (GTK+ 2.10.1; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> Status: RO Content-Length: 571 On Mon, 11 Jun 2007 15:17:19 -0700 Neal Pollack wrote: [...] > time a reduction in total customer count. I do not think the > introduction of a new tool should > necessitate the removal of an existing tool. I simply view it as a long > overdue attempt > to make the Solaris distro "more complete". [...] In general its hard to disagree but in this case the disparity between snoop and wireshark is large. I hope the next time somebody brings a protocol to PSARC not supported in snoop they wouldn't feel like they have to update it. mph From Brian.Utterback@sun.com Tue Jun 12 02:54:19 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5C9sJ3g028820 for ; Tue, 12 Jun 2007 02:54:19 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5C9qlce026408; Tue, 12 Jun 2007 02:52:47 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00043ORZ1100@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 03:52:47 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI00904ORXUT90@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 03:52:45 -0600 (MDT) Received: from fe-amer-03.sun.com ([192.18.108.177]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5C9qjC3025049; Tue, 12 Jun 2007 09:52:45 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJI00201O48RM00@mail-amer.sun.com> (original mail from Brian.Utterback@Sun.COM); Tue, 12 Jun 2007 03:52:45 -0600 (MDT) Received: from [192.168.1.4] ([72.71.243.13]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJI008J3ORW3V92@mail-amer.sun.com>; Tue, 12 Jun 2007 03:52:45 -0600 (MDT) Date: Tue, 12 Jun 2007 05:53:47 -0400 From: Brian Utterback Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070611194616.00005d36@localhost> Sender: Brian.Utterback@sun.com To: Michael Hunter Cc: Neal Pollack , James Carlson , Bart Smaalders , PSARC-EXT@sun.com Message-id: <466E6D2B.1070706@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> User-Agent: Thunderbird 2.0.0.0 (Windows/20070326) Status: RO Content-Length: 850 Michael Hunter wrote: > On Mon, 11 Jun 2007 15:17:19 -0700 > Neal Pollack wrote: > > [...] > >> time a reduction in total customer count. I do not think the >> introduction of a new tool should >> necessitate the removal of an existing tool. I simply view it as a long >> overdue attempt >> to make the Solaris distro "more complete". >> > [...] > > In general its hard to disagree but in this case the disparity between > snoop and wireshark is large. I hope the next time somebody brings a > protocol to PSARC not supported in snoop they wouldn't feel like they > have to update it. > > mph > Of course if we stay up to date, the hope would be that any new protocols will already be supported in wireshark. If not, then that same person that would have updated snoop will need to update wireshark. Brian. From carlsonj@phorcys.east.sun.com Tue Jun 12 05:56:47 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CCulNE001815 for ; Tue, 12 Jun 2007 05:56:47 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CCtEhL028097; Tue, 12 Jun 2007 05:55:16 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00C0LX83JO00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 06:55:15 -0600 (MDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI00AE5X7VJ7E0@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 06:55:07 -0600 (MDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CCt6Y7005577; Tue, 12 Jun 2007 08:55:06 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CCt6sQ005574; Tue, 12 Jun 2007 08:55:06 -0400 (EDT) Date: Tue, 12 Jun 2007 08:55:06 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466E6D2B.1070706@sun.com> To: Brian Utterback Cc: Michael Hunter , Neal Pollack , Bart Smaalders , PSARC-EXT@sun.com Message-id: <18030.38826.802183.985973@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> Status: RO Content-Length: 1138 Brian Utterback writes: > Of course if we stay up to date, the hope would be that any new protocols > will already be supported in wireshark. If not, then that same person that > would have updated snoop will need to update wireshark. ... and that leads directly to my concern. The only commitment there is here is to deliver what happens to be in the open source. Thus, we're stuck in a very strange place. We end up with a situation where we deliver a nice new tool that works much better than the old one (and one that many of us in networking in fact have used for years), but the ARC will continue to advise new project teams to enhance the moribund snoop tool for each new protocol, because that's the "official" tool that Sun is supporting. We're not just wasting effort, but, as this proposal isn't aligned with snoop or the networking group itself, we're actually marching in the opposite direction. -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Tue Jun 12 05:57:47 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CCvk3B001834 for ; Tue, 12 Jun 2007 05:57:47 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CCu8jm022709; Tue, 12 Jun 2007 13:56:13 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00D01X9NJ800@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 05:56:11 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI0061BX9MNZF0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 05:56:11 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CCuA0N005583; Tue, 12 Jun 2007 08:56:10 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CCuAMK005580; Tue, 12 Jun 2007 08:56:10 -0400 (EDT) Date: Tue, 12 Jun 2007 08:56:10 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070611194616.00005d36@localhost> To: Michael Hunter Cc: Neal Pollack , PSARC-EXT@sun.com Message-id: <18030.38890.557778.163642@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> Status: RO Content-Length: 1010 Michael Hunter writes: > On Mon, 11 Jun 2007 15:17:19 -0700 > Neal Pollack wrote: > > [...] > > time a reduction in total customer count. I do not think the > > introduction of a new tool should > > necessitate the removal of an existing tool. I simply view it as a long > > overdue attempt > > to make the Solaris distro "more complete". > [...] > > In general its hard to disagree but in this case the disparity between > snoop and wireshark is large. I hope the next time somebody brings a > protocol to PSARC not supported in snoop they wouldn't feel like they > have to update it. We don't really have much of a choice. It's not as though we've decommitted from enhancing and supporting snoop. It's not as though we have any real direction at all. -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Tue Jun 12 06:21:13 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CDLDsD002368 for ; Tue, 12 Jun 2007 06:21:13 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CDJYMt029359; Tue, 12 Jun 2007 14:19:40 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00F0LYCRLR00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 06:19:39 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI00829YCR7N80@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 06:19:39 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CDJch8005993; Tue, 12 Jun 2007 09:19:38 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CDJcdu005990; Tue, 12 Jun 2007 09:19:38 -0400 (EDT) Date: Tue, 12 Jun 2007 09:19:38 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DC866.8000004@Sun.COM> To: Bart Smaalders Cc: PSARC-EXT@sun.com Message-id: <18030.40298.796894.196070@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> Status: RO Content-Length: 4886 Bart Smaalders writes: > > So, what's the plan for snoop? Does it get removed eventually? > > > > That's a possibility. The maintainers of snoop can make that choice. > It might make more sense to enhance wireshark rather than to expend the > effort needed to update snoop periodically. It would make a lot more sense to enhance wireshark ... but it also means we have an at best confused approach to our own system architecture because we don't have an agreement about what we're actually doing. > > It doesn't seem good for users to be bounced back and forth between > > two different tools to do the same job. > > > > There's really more of a conflict between tshark and snoop; both are > cmdline network packet analyzers. Wireshark is a pretty complete, > functional GUI. The wireshark set of tools seems more complete to > me, but I'm no networking expert. No, there's a conflict in both. Tshark and snoop conflict because they're both command line tools that extract packet data. Wireshark conflicts because, although it decodes most protocols you'd want to see, nobody's actually looked to see whether it decodes all the odd things we've added to snoop over the years, or if it should. We're potentially forcing users to jump back and forth, rather than just committing to a good answer. For instance, does it decode labels for TX? (Last I looked, the answer was "no," but that someone at HP was trying to work on a patch for it.) > >> There are two private libraries delivered into /usr/lib. > > > > I don't see libpcap. Where does that come from? > > > > I'm statically linking that into wireshark; it doesn't really want > (eg easily) build a dynamic version OOB. Until such time as we have > additional clients, static linking saves effort. That's odd. Blastwave didn't seem to have a problem with it. It's likely an interesting issue because the Clearview team intends to contribute changes to libpcap to make it work with their /dev/ipnet/ interfaces. See PSARC 2006/475. It'd be a shame if the wireshark we ship doesn't work right with the brand new monitoring interfaces we ship. > > I see a seriously large number of libraries used by blastwave's > > ethereal. Are the same ones dragged in here? If so, where are they? > > If not, then is there functionality missing from the Solaris SFW > > version? Any features disabled? > > > > Here's the DTNEEDED entries from /usr/sbin/wireshark: Have you tried to figure out what things are stable? For instance, libkstat itself is stable, but the kstats themselves often are not. In other words, what guarantees do we have (if any) that this software will continue to operate as the system changes? > [9] NEEDED 0xfd9b libadm.so.1 Really? That's weird. > [10] NEEDED 0xfda7 libcrypto.so.0.9.8 OpenSSL, I think. > [16] NEEDED 0xfe09 libmlib.so.2 That one is pretty weird, too. > [23] NEEDED 0xfcd1 libpthread.so.1 > [24] NEEDED 0xfcea libthread.so.1 I don't think those do anything. > [11] NEEDED 0xfdba libgtk-x11-2.0.so.0 > [12] NEEDED 0xfdce libgdk-x11-2.0.so.0 > [13] NEEDED 0xfde2 libatk-1.0.so.0 > [14] NEEDED 0xfdf2 libgdk_pixbuf-2.0.so.0 > [17] NEEDED 0xfe16 libpangocairo-1.0.so.0 > [18] NEEDED 0xfe2d libpango-1.0.so.0 > [19] NEEDED 0xfe3f libcairo.so.2 > [20] NEEDED 0xfe4d libgobject-2.0.so.0 > [21] NEEDED 0xfe61 libgmodule-2.0.so.0 > [22] NEEDED 0xfe75 libgthread-2.0.so.0 > [25] NEEDED 0xfe89 libglib-2.0.so.0 > [26] NEEDED 0xfe9a libgnutls.so.12 > [27] NEEDED 0xfeaa libgcrypt.so.11 > [28] NEEDED 0xfeba libgpg-error.so.0 No idea about those. > I'm going over the list w/ Dermot; there are a couple for which I'll > need contracts. When libpcre integrates, that will appear in the above > list as well. I also need contracts w/ Darrin for the crypto libraries. > I've disabled building 3 components (dftest, randpkt, and idl2wrs) as > these are better suited to Wireshark plugin developers than to a general > purpose tool. OK. Should we just not support developers, or would those bits be more effective as separate packages? -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From casper@holland.sun.com Tue Jun 12 06:25:19 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CDPJs8002407 for ; Tue, 12 Jun 2007 06:25:19 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CDNKN3044143; Tue, 12 Jun 2007 07:23:21 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJI00M0VYJMAJ00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 06:23:46 -0700 (PDT) Received: from sr1-eaft06-01.holland.sun.com ([129.159.237.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJI00LIQYJKY000@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 06:23:45 -0700 (PDT) Received: from holland (room101 [129.159.130.93]) by sr1-eaft06-01.holland.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CDNh8F059732; Tue, 12 Jun 2007 15:23:43 +0200 (MEST) Date: Tue, 12 Jun 2007 15:23:43 +0200 From: Casper.Dik@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.40298.796894.196070@gargle.gargle.HOWL> Sender: casper@holland.sun.com To: James Carlson Cc: Bart Smaalders , PSARC-EXT@sun.com Message-id: <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> Status: RO Content-Length: 493 >> [10] NEEDED 0xfda7 libcrypto.so.0.9.8 > >OpenSSL, I think. Can't like with that unless you have a contract (and?) or are in the appropriate consolidation. >> [16] NEEDED 0xfe09 libmlib.so.2 > >That one is pretty weird, too. > > >> [23] NEEDED 0xfcd1 libpthread.so.1 >> [24] NEEDED 0xfcea libthread.so.1 > >I don't think those do anything. Indeed. Casper From brian.utterback@sun.com Tue Jun 12 07:07:56 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CE7tYp003964 for ; Tue, 12 Jun 2007 07:07:56 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CE6L1H016299 for <@newsunmail1brm.central.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 15:06:24 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00H300IOC600@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 08:06:24 -0600 (MDT) Received: from eastmail2bur.East.Sun.COM ([129.148.13.40]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00CA30IMM080@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 08:06:22 -0600 (MDT) Received: from [129.148.226.14] (sr1-unsh01-04.East.Sun.COM [129.148.226.14]) by eastmail2bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CE6EJQ017025; Tue, 12 Jun 2007 10:06:15 -0400 (EDT) Date: Tue, 12 Jun 2007 10:06:14 -0400 From: Brian Utterback Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.38826.802183.985973@gargle.gargle.HOWL> To: James Carlson Cc: Michael Hunter , Neal Pollack , Bart Smaalders , PSARC-EXT@sun.com Message-id: <466EA856.20805@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.5pre (X11/20070601) Status: RO Content-Length: 1604 James Carlson wrote: > Brian Utterback writes: >> Of course if we stay up to date, the hope would be that any new protocols >> will already be supported in wireshark. If not, then that same person that >> would have updated snoop will need to update wireshark. > > ... and that leads directly to my concern. The only commitment there > is here is to deliver what happens to be in the open source. > > Thus, we're stuck in a very strange place. We end up with a situation > where we deliver a nice new tool that works much better than the old > one (and one that many of us in networking in fact have used for > years), but the ARC will continue to advise new project teams to > enhance the moribund snoop tool for each new protocol, because that's > the "official" tool that Sun is supporting. > > We're not just wasting effort, but, as this proposal isn't aligned > with snoop or the networking group itself, we're actually marching in > the opposite direction. > Well then, that's why we should EOL snoop as soon as possible. Seriously, as we add more FOSS tools, we will be increasingly in this "strange place", where we will need modifications to those tools to provide proper integration with the O.S. Thus the high cost of "free". -- blu "When Congress started Daylight Savings Time earlier, did they even consider what affect an extra hour of daylight would have on global warming? Well, did they?" ---------------------------------------------------------------------- Brian Utterback - Solaris RPE, Sun Microsystems, Inc. Ph:877-259-7345, Em:brian.utterback-at-ess-you-enn-dot-kom From Garrett.Damore@sun.com Tue Jun 12 07:46:53 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CEkqPp004492 for ; Tue, 12 Jun 2007 07:46:53 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CEjFLD001055; Tue, 12 Jun 2007 15:45:20 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ0022T2BHKF00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 07:45:17 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00LLN2BHY760@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 07:45:17 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CEjHNN021347; Tue, 12 Jun 2007 07:45:17 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ0000125DOO00@fe-sfbay-09.sun.com> (original mail from Garrett.Damore@Sun.COM); Tue, 12 Jun 2007 07:45:17 -0700 (PDT) Received: from [192.168.251.21] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ007692BEIN70@fe-sfbay-09.sun.com>; Tue, 12 Jun 2007 07:45:15 -0700 (PDT) Date: Tue, 12 Jun 2007 07:43:17 -0700 From: "Garrett D'Amore" Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> Sender: Garrett.Damore@sun.com To: Casper.Dik@sun.com Cc: James Carlson , Bart Smaalders , PSARC-EXT@sun.com Message-id: <466EB105.4060602@sun.com> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> User-Agent: Thunderbird 2.0b2 (X11/20070227) Status: RO Content-Length: 704 Casper.Dik@Sun.COM wrote: > >>> [10] NEEDED 0xfda7 libcrypto.so.0.9.8 >>> >> OpenSSL, I think. >> > > Can't like with that unless you have a contract (and?) or are in the > appropriate consolidation. > > >>> [16] NEEDED 0xfe09 libmlib.so.2 >>> >> That one is pretty weird, too. >> Isn't mlib for media enhancements? Does it come in as a result of the GTK or Cairo? >> >> >>> [23] NEEDED 0xfcd1 libpthread.so.1 >>> [24] NEEDED 0xfcea libthread.so.1 >>> >> I don't think those do anything. >> > > Indeed. > > > Casper > > From casper@holland.sun.com Tue Jun 12 07:49:22 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CEnKZF004573 for ; Tue, 12 Jun 2007 07:49:22 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CEljG6024246; Tue, 12 Jun 2007 07:47:45 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00N192FJ4X00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 07:47:43 -0700 (PDT) Received: from sr1-eaft06-01.holland.sun.com ([129.159.237.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00LRP2FH0H30@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 07:47:42 -0700 (PDT) Received: from holland (room101 [129.159.130.93]) by sr1-eaft06-01.holland.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CEle5N013340; Tue, 12 Jun 2007 16:47:40 +0200 (MEST) Date: Tue, 12 Jun 2007 16:47:40 +0200 From: Casper.Dik@Sun.COM Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EB105.4060602@sun.com> Sender: casper@holland.sun.com To: "Garrett D'Amore" Cc: James Carlson , Bart Smaalders , PSARC-EXT@Sun.COM Message-id: <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> Status: RO Content-Length: 703 >Casper.Dik@Sun.COM wrote: >> >>>> [10] NEEDED 0xfda7 libcrypto.so.0.9.8 >>>> >>> OpenSSL, I think. >>> >> >> Can't like with that unless you have a contract (and?) or are in the >> appropriate consolidation. >> >> >>>> [16] NEEDED 0xfe09 libmlib.so.2 >>>> >>> That one is pretty weird, too. >>> > > >Isn't mlib for media enhancements? Does it come in as a result of the >GTK or Cairo? Indirectly imported libraries should not be listed as "NEEDED"; they should only be listed as dependencies for the libraries themselves. But perhaps this is an artefact of libconfig or whatever it is called. Casper From alan.coopersmith@Sun.COM Tue Jun 12 08:26:32 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CFQVDN005952 for ; Tue, 12 Jun 2007 08:26:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CFOunA015216 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 16:25:00 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ0030145N1V00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 08:24:59 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00LV645M0G70@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 08:24:58 -0700 (PDT) Received: from [192.168.0.101] (vpn-129-150-33-201.Central.Sun.COM [129.150.33.201]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CFOrle028822; Tue, 12 Jun 2007 08:24:54 -0700 (PDT) Date: Tue, 12 Jun 2007 08:23:41 -0700 From: Alan Coopersmith Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> To: Casper.Dik@Sun.COM Cc: "Garrett D'Amore" , James Carlson , Bart Smaalders , PSARC-EXT@Sun.COM Message-id: <466EBA7D.4000208@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> User-Agent: Thunderbird 1.5.0.4 (X11/20060602) Status: RO Content-Length: 668 Casper.Dik@Sun.COM wrote: >> Isn't mlib for media enhancements? Does it come in as a result of the >> GTK or Cairo? Yes - mlib, aka MediaLib, does things like VIS/MMX acceleration for jpeg decoding, and is used by GTK. > > Indirectly imported libraries should not be listed as "NEEDED"; they > should only be listed as dependencies for the libraries themselves. That's the Solaris theory. The pkg-config data files used by GTK list all the dependencies for crippled/non-ELF platforms that don't support library dependencies (or static linking). -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From bart.smaalders@sun.com Tue Jun 12 09:47:29 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CGlSj1008202 for ; Tue, 12 Jun 2007 09:47:29 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CGjrjN012144 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 17:45:58 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ007097WL7G00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 09:45:57 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006MX7WLYQ00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 09:45:57 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CGjtrT023104; Tue, 12 Jun 2007 09:45:55 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CGjtj1024104; Tue, 12 Jun 2007 09:45:55 -0700 (PDT) Date: Tue, 12 Jun 2007 09:44:03 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EBA7D.4000208@sun.com> To: Alan Coopersmith Cc: Casper.Dik@sun.com, PSARC-EXT@sun.com, James Carlson , "Garrett D'Amore" Message-id: <466ECD53.1050006@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> <466EBA7D.4000208@sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 2686 Alan Coopersmith wrote: > Casper.Dik@Sun.COM wrote: >>> Isn't mlib for media enhancements? Does it come in as a result of >>> the GTK or Cairo? > > Yes - mlib, aka MediaLib, does things like VIS/MMX acceleration for jpeg > decoding, and is used by GTK. > >> >> Indirectly imported libraries should not be listed as "NEEDED"; they >> should only be listed as dependencies for the libraries themselves. > > That's the Solaris theory. The pkg-config data files used by GTK > list all the dependencies for crippled/non-ELF platforms that don't > support library dependencies (or static linking). > By adding a -zignore to the LD_OPTIONS, I've manage to reduce the direct dependencies of the wireshark executable to: [0] NEEDED 0xfd18 libwiretap.so.0 [1] NEEDED 0xfd28 libwireshark.so.0 [2] NEEDED 0xfd3a libnetsnmp.so.5 [3] NEEDED 0xfc95 libsocket.so.1 [4] NEEDED 0xfd4a libgtk-x11-2.0.so.0 [5] NEEDED 0xfd5e libgdk-x11-2.0.so.0 [6] NEEDED 0xfd72 libgdk_pixbuf-2.0.so.0 [7] NEEDED 0xfcad libm.so.2 [8] NEEDED 0xfd89 libpango-1.0.so.0 [9] NEEDED 0xfd9b libgobject-2.0.so.0 [10] NEEDED 0xfcc0 libpthread.so.1 [11] NEEDED 0xfcd9 libthread.so.1 [12] NEEDED 0xfdaf libglib-2.0.so.0 [13] NEEDED 0xfce8 libnsl.so.1 [14] NEEDED 0xfcf4 libc.so.1 libwireshark.so still has the following dependencies: [0] NEEDED 0xba2c5 libgmodule-2.0.so.0 [1] NEEDED 0xba2d9 libglib-2.0.so.0 [2] NEEDED 0xba2ea libgnutls.so.12 [3] NEEDED 0xba2fa libgcrypt.so.11 [4] NEEDED 0xba30a libgpg-error.so.0 [5] NEEDED 0xba31c libnetsnmp.so.5 [6] NEEDED 0xba241 libsocket.so.1 [7] NEEDED 0xba259 libm.so.2 [8] NEEDED 0xba26c libnsl.so.1 [9] NEEDED 0xba281 libz.so.1 [10] NEEDED 0xba28b libc.so.1 [11] NEEDED 0xba2af libgcc_s.so.1 - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From bart.smaalders@Sun.COM Tue Jun 12 09:55:21 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CGtLG3008907 for ; Tue, 12 Jun 2007 09:55:21 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CGrM24030244 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 10:53:24 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ0071589OHR00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 09:53:48 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006LM89NYM20@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 09:53:47 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CGrl4V023988; Tue, 12 Jun 2007 09:53:47 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CGrlWL024213; Tue, 12 Jun 2007 09:53:47 -0700 (PDT) Date: Tue, 12 Jun 2007 09:51:55 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.38890.557778.163642@gargle.gargle.HOWL> To: James Carlson Cc: Michael Hunter , PSARC-EXT@Sun.COM, Neal Pollack Message-id: <466ECF2B.3060101@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <18030.38890.557778.163642@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 791 James Carlson wrote: > Thus, we're stuck in a very strange place. We end up with a situation > where we deliver a nice new tool that works much better than the old > one (and one that many of us in networking in fact have used for > years), but the ARC will continue to advise new project teams to > enhance the moribund snoop tool for each new protocol, because that's > the "official" tool that Sun is supporting. I would recommend that the networking group seriously consider EOFing snoop, but this is a decision they need to make. I've also used ethereal/wireshark for years, and cannot justify all of Sun's customers going without or forcing them to compile it themselves. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From bart.smaalders@sun.com Tue Jun 12 10:36:43 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHag7F010589 for ; Tue, 12 Jun 2007 10:36:42 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CHZA3g000605 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Wed, 13 Jun 2007 01:35:11 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00909A6KE200@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 10:35:08 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006EBA6KYP80@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 10:35:08 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CHZ8mG029126; Tue, 12 Jun 2007 10:35:08 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CHZ7g5025801; Tue, 12 Jun 2007 10:35:07 -0700 (PDT) Date: Tue, 12 Jun 2007 10:33:16 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.40298.796894.196070@gargle.gargle.HOWL> To: James Carlson Cc: PSARC-EXT@sun.com Message-id: <466ED8DC.1000108@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 4116 James Carlson wrote: > Bart Smaalders writes: >>> So, what's the plan for snoop? Does it get removed eventually? >>> >> That's a possibility. The maintainers of snoop can make that choice. >> It might make more sense to enhance wireshark rather than to expend the >> effort needed to update snoop periodically. > > It would make a lot more sense to enhance wireshark ... but it also > means we have an at best confused approach to our own system > architecture because we don't have an agreement about what we're > actually doing. > Well, depriving our customers of the better tool while we go on about architectural direction doesn't exactly enhance Solaris. Some degree of duplication/competition between tools is useful. I realize that this can confuse customers somewhat... but introducing this into Nevada seems to be a useful first step in making a decision. Wireshark/Ethereal has been around for year. >>> It doesn't seem good for users to be bounced back and forth between >>> two different tools to do the same job. >>> >> There's really more of a conflict between tshark and snoop; both are >> cmdline network packet analyzers. Wireshark is a pretty complete, >> functional GUI. The wireshark set of tools seems more complete to >> me, but I'm no networking expert. > > No, there's a conflict in both. > > Tshark and snoop conflict because they're both command line tools that > extract packet data. Wireshark conflicts because, although it decodes > most protocols you'd want to see, nobody's actually looked to see > whether it decodes all the odd things we've added to snoop over the > years, or if it should. We're potentially forcing users to jump back > and forth, rather than just committing to a good answer. > > For instance, does it decode labels for TX? (Last I looked, the > answer was "no," but that someone at HP was trying to work on a patch > for it.) > I'm hard pressed to find the list of decoded protocols in the snoop documentation. >>>> There are two private libraries delivered into /usr/lib. >>> I don't see libpcap. Where does that come from? >>> >> I'm statically linking that into wireshark; it doesn't really want >> (eg easily) build a dynamic version OOB. Until such time as we have >> additional clients, static linking saves effort. > > That's odd. Blastwave didn't seem to have a problem with it. > > It's likely an interesting issue because the Clearview team intends to > contribute changes to libpcap to make it work with their /dev/ipnet/ > interfaces. See PSARC 2006/475. > > It'd be a shame if the wireshark we ship doesn't work right with the > brand new monitoring interfaces we ship. > When libpcap gets updated, we'll grab a newer copy. We have to do that whether or not it gets statically or dynamically linked. If someone else introduces a dynamic libpcap, we can use that easily enough. Right now w/ only one client it really doesn't add any value. >>> I see a seriously large number of libraries used by blastwave's >>> ethereal. Are the same ones dragged in here? If so, where are they? >>> If not, then is there functionality missing from the Solaris SFW >>> version? Any features disabled? >>> >> Here's the DTNEEDED entries from /usr/sbin/wireshark: > > Have you tried to figure out what things are stable? For instance, > libkstat itself is stable, but the kstats themselves often are not. > > In other words, what guarantees do we have (if any) that this software > will continue to operate as the system changes? We'll have to debug any problems that arise. It turns out the kstat dependencies went away after I used the -zignore option; they were introduced by libtool (bletch). > OK. Should we just not support developers, or would those bits be > more effective as separate packages? > My thoughts are that anyone wishing to add to wireshark in the form of plugins, etc, will probably grab the source and compile it themselves, so shipping the development tools is probably not terribly useful. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Nicolas.Williams@sun.com Tue Jun 12 10:43:45 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHhi7f010754 for ; Tue, 12 Jun 2007 10:43:45 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CHg8n0001492; Tue, 12 Jun 2007 18:42:12 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ0090HAIBMY00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:42:11 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006PPAIAYP90@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:42:10 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CHfIbR016026; Tue, 12 Jun 2007 12:41:18 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CHfITe016025; Tue, 12 Jun 2007 12:41:18 -0500 (CDT) Date: Tue, 12 Jun 2007 12:41:18 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> To: Casper.Dik@sun.com Cc: James Carlson , PSARC-EXT@sun.com Message-id: <20070612174117.GF15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 321 On Tue, Jun 12, 2007 at 03:23:43PM +0200, Casper.Dik@Sun.COM wrote: > >> [10] NEEDED 0xfda7 libcrypto.so.0.9.8 > > > >OpenSSL, I think. > > Can't like with that unless you have a contract (and?) or are in the > appropriate consolidation. Yeah, you'll need a contract for that. Nico -- From Nicolas.Williams@sun.com Tue Jun 12 10:45:57 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHjuNX010800 for ; Tue, 12 Jun 2007 10:45:57 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CHhoGp003376; Wed, 13 Jun 2007 01:44:18 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00805ALRBQ00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 11:44:15 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KRIALRKND0@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 11:44:15 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CHhNZJ016034; Tue, 12 Jun 2007 12:43:23 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CHhNMd016033; Tue, 12 Jun 2007 12:43:23 -0500 (CDT) Date: Tue, 12 Jun 2007 12:43:23 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466ECD53.1050006@Sun.COM> To: Bart Smaalders Cc: Alan Coopersmith , PSARC-EXT@sun.com, "Garrett D'Amore" , James Carlson , Casper.Dik@sun.com Message-id: <20070612174323.GG15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> <466EBA7D.4000208@sun.com> <466ECD53.1050006@Sun.COM> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 319 On Tue, Jun 12, 2007 at 09:44:03AM -0700, Bart Smaalders wrote: > [2] NEEDED 0xba2ea libgnutls.so.12 > [3] NEEDED 0xba2fa libgcrypt.so.11 > [4] NEEDED 0xba30a libgpg-error.so.0 So, we're including GnuTLS and friends as well? From Nicolas.Williams@sun.com Tue Jun 12 10:51:37 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHpbIn010937 for ; Tue, 12 Jun 2007 10:51:37 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CHo60M029429; Tue, 12 Jun 2007 10:50:06 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00A0BAVI0A00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:50:06 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006ARAVHYQB0@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:50:05 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CHnDB8016047; Tue, 12 Jun 2007 12:49:13 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CHnDkT016046; Tue, 12 Jun 2007 12:49:13 -0500 (CDT) Date: Tue, 12 Jun 2007 12:49:13 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466ED8DC.1000108@Sun.COM> To: Bart Smaalders Cc: James Carlson , PSARC-EXT@sun.com Message-id: <20070612174913.GH15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <466ED8DC.1000108@Sun.COM> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 975 On Tue, Jun 12, 2007 at 10:33:16AM -0700, Bart Smaalders wrote: > James Carlson wrote: > >OK. Should we just not support developers, or would those bits be > >more effective as separate packages? > > My thoughts are that anyone wishing to add to wireshark in the form of > plugins, etc, will probably grab the source and compile it themselves, > so shipping the development tools is probably not terribly useful. If Wireshark (getting used to not saying "Ethereal" is difficult) has a plug-in interface with a stability that suitably matches our needs then we should expose it, no? I wouldn't mind having a Wireshark plug-in interface that is Volatile and can break on patch -- the difference between forcing a developer to get and build their own copy of Wireshark (and re-build their plug-ins any time they update that) and forcing them to re-build their plug-ins every time we update Wireshark in patch/micro/minor Solaris releases seems rather minor to me. Nico -- From Alan.Coopersmith@sun.com Tue Jun 12 10:53:31 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHrViu011000 for ; Tue, 12 Jun 2007 10:53:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CHpXkJ046097 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 11:51:34 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00A0HAYN2O00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 10:51:59 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006F0AYMYPB0@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 10:51:58 -0700 (PDT) Received: from [129.146.108.211] (almas.SFBay.Sun.COM [129.146.108.211]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CHpuKW024296; Tue, 12 Jun 2007 10:51:56 -0700 (PDT) Date: Tue, 12 Jun 2007 10:51:56 -0700 From: Alan Coopersmith Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612174323.GG15858@Sun.COM> To: Nicolas Williams Cc: Bart Smaalders , PSARC-EXT@sun.com, "Garrett D'Amore" , James Carlson , Casper.Dik@sun.com Message-id: <466EDD3C.3010001@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> <466EBA7D.4000208@sun.com> <466ECD53.1050006@Sun.COM> <20070612174323.GG15858@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 650 Nicolas Williams wrote: > On Tue, Jun 12, 2007 at 09:44:03AM -0700, Bart Smaalders wrote: >> [2] NEEDED 0xba2ea libgnutls.so.12 >> [3] NEEDED 0xba2fa libgcrypt.so.11 >> [4] NEEDED 0xba30a libgpg-error.so.0 > > So, we're including GnuTLS and friends as well? I believe GnuTLS is a Consolidate Private interface in the JDS consolidation (see the Evolution & JDS ARC cases for the arguments about why we need yet another encryption library). -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From carlsonj@phorcys.east.sun.com Tue Jun 12 10:55:32 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHtTgq011347 for ; Tue, 12 Jun 2007 10:55:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CHrrgr005999; Wed, 13 Jun 2007 01:53:56 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00A01B1V5700@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:53:55 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ0063ZB1UYME0@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 10:53:54 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CHrsbn007177; Tue, 12 Jun 2007 13:53:54 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CHrrnv007174; Tue, 12 Jun 2007 13:53:53 -0400 (EDT) Date: Tue, 12 Jun 2007 13:53:53 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466ED8DC.1000108@Sun.COM> To: Bart Smaalders Cc: PSARC-EXT@sun.com Message-id: <18030.56753.913078.761365@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <466ED8DC.1000108@Sun.COM> Status: RO Content-Length: 2467 Bart Smaalders writes: > James Carlson wrote: > > It would make a lot more sense to enhance wireshark ... but it also > > means we have an at best confused approach to our own system > > architecture because we don't have an agreement about what we're > > actually doing. > > > > Well, depriving our customers of the better tool while we go on about > architectural direction doesn't exactly enhance Solaris. So, in the interest of not "going on about" direction, how about if an ARC member derails this and TCRs it to include snoop obsolescence, and thus a formal change of direction to prohibit new features in snoop. > Some degree > of duplication/competition between tools is useful. I realize that this > can confuse customers somewhat... but introducing this into Nevada seems > to be a useful first step in making a decision. Wireshark/Ethereal has > been around for year. Ethereal's quite a bit older than that. My guess is about 9 years old. > > For instance, does it decode labels for TX? (Last I looked, the > > answer was "no," but that someone at HP was trying to work on a patch > > for it.) > > > > I'm hard pressed to find the list of decoded protocols in the snoop > documentation. Indeed. > When libpcap gets updated, we'll grab a newer copy. We have to do that > whether or not it gets statically or dynamically linked. If someone > else introduces a dynamic libpcap, we can use that easily enough. > Right now w/ only one client it really doesn't add any value. I see. > > In other words, what guarantees do we have (if any) that this software > > will continue to operate as the system changes? > > We'll have to debug any problems that arise. It turns out the kstat > dependencies went away after I used the -zignore option; they were > introduced by libtool (bletch). I'm not sure "debug any problems that arise" counts as architecture ... > > OK. Should we just not support developers, or would those bits be > > more effective as separate packages? > > > > My thoughts are that anyone wishing to add to wireshark in the form of > plugins, etc, will probably grab the source and compile it themselves, > so shipping the development tools is probably not terribly useful. OK, that makes sense. -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Nicolas.Williams@Sun.COM Tue Jun 12 10:58:34 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CHwX43011511 for ; Tue, 12 Jun 2007 10:58:33 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CHusbj005794; Tue, 12 Jun 2007 18:56:58 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00E1TB6W1800@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 10:56:56 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ009J2B6VAXC0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 10:56:56 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CHu416016056; Tue, 12 Jun 2007 12:56:04 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CHu4Ck016055; Tue, 12 Jun 2007 12:56:04 -0500 (CDT) Date: Tue, 12 Jun 2007 12:56:04 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.38826.802183.985973@gargle.gargle.HOWL> To: James Carlson Cc: Brian Utterback , Michael Hunter , PSARC-EXT@Sun.COM, Neal Pollack Message-id: <20070612175603.GI15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1917 On Tue, Jun 12, 2007 at 08:55:06AM -0400, James Carlson wrote: > Brian Utterback writes: > > Of course if we stay up to date, the hope would be that any new protocols > > will already be supported in wireshark. If not, then that same person that > > would have updated snoop will need to update wireshark. > > ... and that leads directly to my concern. The only commitment there > is here is to deliver what happens to be in the open source. Well, folks who need to resort to packet inspection tools *already* often have to use multiple differnt tools because they provide different degrees of dissector support for different protocols. I've used snoop and ethereal on the same captures before and likely will again. And netmon and ethereal on Windows for that matter. > Thus, we're stuck in a very strange place. We end up with a situation > where we deliver a nice new tool that works much better than the old > one (and one that many of us in networking in fact have used for > years), but the ARC will continue to advise new project teams to > enhance the moribund snoop tool for each new protocol, because that's > the "official" tool that Sun is supporting. > > We're not just wasting effort, but, as this proposal isn't aligned > with snoop or the networking group itself, we're actually marching in > the opposite direction. I'd say: EOF snoop, ask for funding to add to Wireshark any dissector functionality that is in snoop but not in Wireshark, and require that future projects that would have had to update snoop to update Wireshark instead. Requiring that the i-team here update Wireshark with any functionality in snoop that's missing in Wireshark might be (I bet would be) a deal breaker; I'd rather have Wireshark in OpenSolaris with this "strange place" situation than no Wireshark in OpenSolaris. If funding to update Wireshark with snoop functionality never shows up, oh well. Nico -- From Nicolas.Williams@sun.com Tue Jun 12 11:03:01 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CI31os011682 for ; Tue, 12 Jun 2007 11:03:01 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CI1Q53002136; Tue, 12 Jun 2007 11:01:28 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00905BEFIQ00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:01:27 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KZBBEEKQD0@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:01:26 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CI0YPV016063; Tue, 12 Jun 2007 13:00:34 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CI0Yej016062; Tue, 12 Jun 2007 13:00:34 -0500 (CDT) Date: Tue, 12 Jun 2007 13:00:34 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EDD3C.3010001@sun.com> To: Alan Coopersmith Cc: Bart Smaalders , PSARC-EXT@sun.com, "Garrett D'Amore" , James Carlson , Casper.Dik@sun.com Message-id: <20070612180033.GJ15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <200706121323.l5CDNh8F059732@sr1-eaft06-01.holland.sun.com> <466EB105.4060602@sun.com> <200706121447.l5CEle5N013340@sr1-eaft06-01.holland.sun.com> <466EBA7D.4000208@sun.com> <466ECD53.1050006@Sun.COM> <20070612174323.GG15858@Sun.COM> <466EDD3C.3010001@sun.com> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 820 On Tue, Jun 12, 2007 at 10:51:56AM -0700, Alan Coopersmith wrote: > Nicolas Williams wrote: > >On Tue, Jun 12, 2007 at 09:44:03AM -0700, Bart Smaalders wrote: > >> [2] NEEDED 0xba2ea libgnutls.so.12 > >> [3] NEEDED 0xba2fa libgcrypt.so.11 > >> [4] NEEDED 0xba30a libgpg-error.so.0 > > > >So, we're including GnuTLS and friends as well? > > I believe GnuTLS is a Consolidate Private interface in the JDS > consolidation (see the Evolution & JDS ARC cases for the arguments > about why we need yet another encryption library). Why should it be private? Why shouldn't we ship both, OpenSSL and GnuTLS as supported interfaces that third parties can use? I don't see "yet another encryption library" as bad in this case. Nico -- From carlsonj@phorcys.east.sun.com Tue Jun 12 11:08:18 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CI8Hrg011729 for ; Tue, 12 Jun 2007 11:08:17 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CI6I8j008504; Tue, 12 Jun 2007 19:06:41 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00A0LBN3RW00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:06:39 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AEWBN2GC00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:06:39 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CI6cDN007334; Tue, 12 Jun 2007 14:06:38 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CI6cLI007331; Tue, 12 Jun 2007 14:06:38 -0400 (EDT) Date: Tue, 12 Jun 2007 14:06:38 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612175603.GI15858@Sun.COM> To: Nicolas Williams Cc: Brian Utterback , Michael Hunter , PSARC-EXT@sun.com, Neal Pollack Message-id: <18030.57518.421570.221797@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> Status: RO Content-Length: 1137 Nicolas Williams writes: > I'd say: EOF snoop, ask for funding to add to Wireshark any dissector > functionality that is in snoop but not in Wireshark, and require that > future projects that would have had to update snoop to update Wireshark > instead. I think that's an excellent answer. It's just not the one on the table at the moment, and there's no clear indication that we'll ever get there. The people who would presumably do that work haven't committed any resources to it. > If funding to update Wireshark with snoop functionality never shows up, > oh well. And what of current and future projects that require decode support? "Oh, well" to them, too? At one point, I was almost convinced that we had some rough consensus that building a system was a shared goal. I'm no longer so sure, as projects like this look much more like "mere accumulation" than any sort of intentionally planned effort. -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From wyllys.ingersoll@sun.com Tue Jun 12 11:10:53 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIAr00012057 for ; Tue, 12 Jun 2007 11:10:53 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CI9Lrx014824; Tue, 12 Jun 2007 11:09:21 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00E5ZBRJWK00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 11:09:19 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ009C6BRGAUC0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 11:09:17 -0700 (PDT) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CI9Beb122205 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 12 Jun 2007 11:09:15 -0700 (PDT) Date: Tue, 12 Jun 2007 14:09:11 -0400 From: Wyllys Ingersoll Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612175603.GI15858@Sun.COM> To: Nicolas Williams Cc: James Carlson , Brian Utterback , Michael Hunter , PSARC-EXT@sun.com, Neal Pollack Message-id: <466EE147.4070901@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070508) Status: RO Content-Length: 1617 Nicolas Williams wrote: > >> Thus, we're stuck in a very strange place. We end up with a situation >> where we deliver a nice new tool that works much better than the old >> one (and one that many of us in networking in fact have used for >> years), but the ARC will continue to advise new project teams to >> enhance the moribund snoop tool for each new protocol, because that's >> the "official" tool that Sun is supporting. >> >> We're not just wasting effort, but, as this proposal isn't aligned >> with snoop or the networking group itself, we're actually marching in >> the opposite direction. > > I'd say: EOF snoop, ask for funding to add to Wireshark any dissector > functionality that is in snoop but not in Wireshark, and require that > future projects that would have had to update snoop to update Wireshark > instead. Agreed - EOF snoop and focus efforts on Wireshark. If we are trying to attract new users and developers who are familiar with Linux, we need to offer tools that they know and understand. snoop is nice, but if it comes down to supporting only 1, we should choose the one with the bigger userbase and community support as long as it covers most of the existing functionality of the other. > Requiring that the i-team here update Wireshark with any functionality > in snoop that's missing in Wireshark might be (I bet would be) a deal > breaker; I'd rather have Wireshark in OpenSolaris with this "strange > place" situation than no Wireshark in OpenSolaris. I also don't see the logic behind forcing the wireshark project to address the missing functionality in snoop. -Wyllys From Nicolas.Williams@sun.com Tue Jun 12 11:13:45 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIDiwb012227 for ; Tue, 12 Jun 2007 11:13:45 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CIBxAh011348; Wed, 13 Jun 2007 02:12:07 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00A0TBW55I00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:12:05 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KPUBW4KQE0@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:12:04 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CIBCV0016079; Tue, 12 Jun 2007 13:11:12 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CIBCVK016078; Tue, 12 Jun 2007 13:11:12 -0500 (CDT) Date: Tue, 12 Jun 2007 13:11:12 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.57518.421570.221797@gargle.gargle.HOWL> To: James Carlson Cc: Brian Utterback , Michael Hunter , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612181112.GK15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1599 On Tue, Jun 12, 2007 at 02:06:38PM -0400, James Carlson wrote: > Nicolas Williams writes: > > I'd say: EOF snoop, ask for funding to add to Wireshark any dissector > > functionality that is in snoop but not in Wireshark, and require that > > future projects that would have had to update snoop to update Wireshark > > instead. > > I think that's an excellent answer. It's just not the one on the > table at the moment, and there's no clear indication that we'll ever > get there. The people who would presumably do that work haven't > committed any resources to it. > > > If funding to update Wireshark with snoop functionality never shows up, > > oh well. > > And what of current and future projects that require decode support? > "Oh, well" to them, too? No, they get to contribute Wireshark support. It's the existing functionality in snoop but not in Wireshark that we'd be saying "oh well" about. > At one point, I was almost convinced that we had some rough consensus > that building a system was a shared goal. I'm no longer so sure, as > projects like this look much more like "mere accumulation" than any > sort of intentionally planned effort. I think you misunderstood what I wrote. Now, to a degree, yes, orphaning some protocol dissection support (if funding never shows up) is less than "building a system." But the flip side is holding the system hostage to funding that may never show up. Wireshark is *far* superior to snoop, so not including Wireshark if noone will commit to making it a strict superset of snoop would also be less than "building a system." Nico -- From Michael.Hunter@Sun.COM Tue Jun 12 11:23:43 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CINhmf012338 for ; Tue, 12 Jun 2007 11:23:43 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CIMCDT017617 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 11:22:12 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00B09CCZFY00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:22:11 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ006YGCCZYPD0@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:22:11 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CIMBd3018882 for ; Tue, 12 Jun 2007 11:22:11 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00801C36VI00@fe-sfbay-10.sun.com> (original mail from Michael.Hunter@Sun.COM) for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:22:11 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ00F9ACCPRO00@fe-sfbay-10.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:22:02 -0700 (PDT) Date: Tue, 12 Jun 2007 11:22:01 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EE147.4070901@sun.com> Sender: Michael.Hunter@Sun.COM To: Wyllys Ingersoll Cc: Nicolas Williams , James Carlson , Brian Utterback , PSARC-EXT@Sun.COM, Neal Pollack Message-id: <20070612112201.000010db@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.9.2-csw (GTK+ 2.10.11; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> Status: RO Content-Length: 1234 On Tue, 12 Jun 2007 14:09:11 -0400 Wyllys Ingersoll wrote: > Nicolas Williams wrote: [...] > Agreed - EOF snoop and focus efforts on Wireshark. If we are > trying to attract new users and developers who are familiar with Linux, > we need to offer tools that they know and understand. snoop is nice, > but if it comes down to supporting only 1, we should choose the one > with the bigger userbase and community support as long as it > covers most of the existing functionality of the other. > > > > Requiring that the i-team here update Wireshark with any functionality > > in snoop that's missing in Wireshark might be (I bet would be) a deal > > breaker; I'd rather have Wireshark in OpenSolaris with this "strange > > place" situation than no Wireshark in OpenSolaris. > > I also don't see the logic behind forcing the wireshark > project to address the missing functionality in snoop. I don't either. But I would like to see a statement about the wireshark community and maintainers and how easy it is estimated to be to get them to accept patches. Its not an architectural concern. But the cost of long term maintenance should effect which of the two we put effort into. mph > > -Wyllys From carlsonj@phorcys.east.sun.com Tue Jun 12 11:24:10 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIOAMT012355 for ; Tue, 12 Jun 2007 11:24:10 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CIMbVw006552; Tue, 12 Jun 2007 11:22:38 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00B0PCDPGI00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:22:37 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AAVCDPG210@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:22:37 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CIMbPU007461; Tue, 12 Jun 2007 14:22:37 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CIMbah007458; Tue, 12 Jun 2007 14:22:37 -0400 (EDT) Date: Tue, 12 Jun 2007 14:22:37 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612181112.GK15858@Sun.COM> To: Nicolas Williams Cc: Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <18030.58477.20949.350724@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> Status: RO Content-Length: 967 Nicolas Williams writes: > No, they get to contribute Wireshark support. It's the existing > functionality in snoop but not in Wireshark that we'd be saying "oh > well" about. Unless we mark snoop as "obsolete" (as I previously suggested), we really have no good grounds for directing new projects one way or the other. I don't see that we have a good committed direction at all. > But the flip side is holding the system hostage to funding that may > never show up. Wireshark is *far* superior to snoop, so not including > Wireshark if noone will commit to making it a strict superset of snoop > would also be less than "building a system." At least by this proposal, it seems can't even get our act together enough to nuke snoop away. -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Nicolas.Williams@sun.com Tue Jun 12 11:28:59 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CISwUY012378 for ; Tue, 12 Jun 2007 11:28:59 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CIRKvK015768; Wed, 13 Jun 2007 02:27:21 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00B03CLK5P00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:27:20 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B5ACLJ0Q00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:27:19 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CIQRTa016094; Tue, 12 Jun 2007 13:26:27 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CIQRs7016093; Tue, 12 Jun 2007 13:26:27 -0500 (CDT) Date: Tue, 12 Jun 2007 13:26:27 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612112201.000010db@localhost> To: Michael Hunter Cc: Wyllys Ingersoll , James Carlson , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612182626.GL15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 656 On Tue, Jun 12, 2007 at 11:22:01AM -0700, Michael Hunter wrote: > On Tue, 12 Jun 2007 14:09:11 -0400 > Wyllys Ingersoll wrote: > > I also don't see the logic behind forcing the wireshark > > project to address the missing functionality in snoop. > > I don't either. But I would like to see a statement about the > wireshark community and maintainers and how easy it is estimated to be > to get them to accept patches. Its not an architectural concern. But > the cost of long term maintenance should effect which of the two we put > effort into. Or for us to simply ship any plug-ins not accepted by the Wireshark community. From Nicolas.Williams@Sun.COM Tue Jun 12 11:32:29 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIWS0B012440 for ; Tue, 12 Jun 2007 11:32:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CIUmbS016925; Wed, 13 Jun 2007 02:30:51 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00G1VCRDP600@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 11:30:49 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00FL2CRCE330@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 11:30:48 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CITum8016101; Tue, 12 Jun 2007 13:29:56 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CITuFp016100; Tue, 12 Jun 2007 13:29:56 -0500 (CDT) Date: Tue, 12 Jun 2007 13:29:56 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.58477.20949.350724@gargle.gargle.HOWL> To: James Carlson Cc: Michael Hunter , PSARC-EXT@Sun.COM, Brian Utterback , Neal Pollack Message-id: <20070612182956.GM15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1412 On Tue, Jun 12, 2007 at 02:22:37PM -0400, James Carlson wrote: > Nicolas Williams writes: > > No, they get to contribute Wireshark support. It's the existing > > functionality in snoop but not in Wireshark that we'd be saying "oh > > well" about. > > Unless we mark snoop as "obsolete" (as I previously suggested), we > really have no good grounds for directing new projects one way or the > other. I don't see that we have a good committed direction at all. But that was part of what I was saying: EOF snoop. And you proposed that some ARC member step up, de-rail and TCR the EOF of snoop. You are an ARC member who could do just that ;) And that might not even be necessary if the i-team just agrees to add the EOF of snoop to their materials before you derail. > > But the flip side is holding the system hostage to funding that may > > never show up. Wireshark is *far* superior to snoop, so not including > > Wireshark if noone will commit to making it a strict superset of snoop > > would also be less than "building a system." > > At least by this proposal, it seems can't even get our act together > enough to nuke snoop away. We can't? As long as we agree that this case shouldn't have to include adding functionality to Wireshark that is currently only available in snoop then I think it should be near trivial to "get our act together to nuke snoop." Or am I missing something? Nico -- From peter.tribble@gmail.com Tue Jun 12 11:45:02 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIj2LF012645 for ; Tue, 12 Jun 2007 11:45:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CIhVJv011287 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 11:43:32 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00C05DCI7700@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:43:30 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00APODCIG220@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:43:30 -0700 (PDT) Received: from relay2.sun.com (relay2.sun.com [150.143.103.24] (may be forged)) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5CIVhIk003552 for ; Tue, 12 Jun 2007 18:43:29 +0000 (GMT) Received: from mms03es.sun.com ([150.143.104.54] [150.143.104.54]) by relay2.sun.com with ESMTP id BT-MMP-1845617 for PSARC-EXT@sun.com; Tue, 12 Jun 2007 18:43:29 +0000 (Z) Received: from relay1.sun.com (relay1.sun.com [150.143.103.14]) by mms03es.sun.com with ESMTP id BT-MMP-2361915 for PSARC-EXT@sun.com; Tue, 12 Jun 2007 18:43:29 +0000 (Z) Received: from relay43i.sun.com ([192.5.209.74] [192.5.209.74]) by relay1.sun.com with ESMTP id BT-MMP-16246235 for PSARC-EXT@sun.com; Tue, 12 Jun 2007 18:43:29 +0000 (Z) Received: from py-out-1112.google.com ([64.233.166.180] [64.233.166.180]) by relay4i.sun.com with ESMTP id BT-MMP-3833205 for PSARC-EXT@sun.com; Tue, 12 Jun 2007 18:43:29 +0000 (Z) Received: by py-out-1112.google.com with SMTP id u77so3508735pyb for ; Tue, 12 Jun 2007 11:43:29 -0700 (PDT) Received: by 10.65.193.16 with SMTP id v16mr11934827qbp.1181673808831; Tue, 12 Jun 2007 11:43:28 -0700 (PDT) Received: by 10.65.189.19 with HTTP; Tue, 12 Jun 2007 11:43:28 -0700 (PDT) Date: Tue, 12 Jun 2007 19:43:28 +0100 From: Peter Tribble Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612182956.GM15858@Sun.COM> To: Nicolas Williams Cc: James Carlson , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack , Bart Smaalders Message-id: MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT Content-disposition: inline DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=enMNSh084OflRChCF0D8cM0HBouzFLA1EJr/y5Ftn+wvzFkFN4Qqxv2iAKI4bKdEJP83rbYZlxRvV3aYd9kQl7BGsgbmhk0FVBnyRER/kFNH2BIXT9vA3/W20SBLnmfyKQi1MxFcV5ckRcaZ0QUDj8A7YlqORgX2CUPBOikmx3s= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=l4M31fBEgiuNFhc7yW152KRgRwX8gfYmp84nqwd6dwq7ZdtiIm+VzSy7NNCMBOTIi4TufD+vbhLgWKPCTb448basOXosP5bHKQgJhI+hNj+BkgGUV2QbShT9OeD0KUaDwtvNUDjcu/ymZIssb/vtS4fQk0s68KwZ8u559D/Khdo= X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <20070612182956.GM15858@Sun.COM> Status: RO Content-Length: 1091 On 6/12/07, Nicolas Williams wrote: > > At least by this proposal, it seems can't even get our act together > > enough to nuke snoop away. > > We can't? As long as we agree that this case shouldn't have to include > adding functionality to Wireshark that is currently only available in > snoop then I think it should be near trivial to "get our act together to > nuke snoop." Or am I missing something? Earlier Bart gave a list of dependencies for the gui, which is quite extensive. Also, it was indicated that all the components of wireshark would be delivered as a single package. Two questions: What external dependencies do the command line tools have? On a minimized system, snoop will work - will the wireshark cli utilities or do they need a lot of extra stuff? If snoop is removed and replaced by some wireshark cli utility, should the gui and cli components be packaged separately so as to allow snoop functionality to be present on machines with no gui installed? -- -Peter Tribble http://www.petertribble.co.uk/ - http://ptribble.blogspot.com/ From sommerfeld@sun.com Tue Jun 12 11:50:42 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIog5n012691 for ; Tue, 12 Jun 2007 11:50:42 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CInB6p023530; Tue, 12 Jun 2007 11:49:11 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00C07DLYSR00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:49:10 -0600 (MDT) Received: from eastmail4bur.east.Sun.COM ([129.148.13.1]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B87DLV0M20@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 12:49:07 -0600 (MDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail4bur.east.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CImw20020796; Tue, 12 Jun 2007 14:48:58 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CImvJq004561; Tue, 12 Jun 2007 14:48:57 -0400 (EDT) Date: Tue, 12 Jun 2007 14:48:56 -0400 From: Bill Sommerfeld Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612174913.GH15858@Sun.COM> To: Nicolas Williams Cc: Bart Smaalders , PSARC-EXT@sun.com, James Carlson Message-id: <1181674137.3743.41.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <466ED8DC.1000108@Sun.COM> <20070612174913.GH15858@Sun.COM> Status: RO Content-Length: 859 On Tue, 2007-06-12 at 12:49 -0500, Nicolas Williams wrote: > If Wireshark (getting used to not saying "Ethereal" is difficult) has a > plug-in interface with a stability that suitably matches our needs then > we should expose it, no? if there is a plug-in interface to wireshark which permits it to decode new protocols then it may be sufficient in many cases to change or supplement our stock advice to "enhance snoop to decode your protocol" to "write and ship a wireshark plugin as part of (open)solaris to decode your protocol"; pushing that plugin back upstream to the wireshark maintainers could happen asynchronously. (yes, there's still the issue of what to do about the protocols snoop copes with but wireshark doesn't; that would be a prerequisite to obsoleting snoop but I don't think the two have to happen at the same time). - Bill From bart.smaalders@sun.com Tue Jun 12 11:57:19 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIvIfo013137 for ; Tue, 12 Jun 2007 11:57:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CItZCJ024495 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Wed, 13 Jun 2007 02:55:46 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00C03DWXQ300@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 11:55:45 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AAXDWXG430@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 11:55:45 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CIti7o008996; Tue, 12 Jun 2007 11:55:44 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CIthZU000169; Tue, 12 Jun 2007 11:55:44 -0700 (PDT) Date: Tue, 12 Jun 2007 11:53:52 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: To: Peter Tribble Cc: Nicolas Williams , James Carlson , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <466EEBC0.5080102@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <20070612182956.GM15858@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1293 Peter Tribble wrote: > On 6/12/07, Nicolas Williams wrote: > >> > At least by this proposal, it seems can't even get our act together >> > enough to nuke snoop away. >> >> We can't? As long as we agree that this case shouldn't have to include >> adding functionality to Wireshark that is currently only available in >> snoop then I think it should be near trivial to "get our act together to >> nuke snoop." Or am I missing something? > > Earlier Bart gave a list of dependencies for the gui, which is quite > extensive. Also, it was indicated that all the components of wireshark > would be delivered as a single package. > > Two questions: > > What external dependencies do the command line tools have? On a > minimized system, snoop will work - will the wireshark cli utilities or > do they need a lot of extra stuff? > > If snoop is removed and replaced by some wireshark cli utility, should > the gui and cli components be packaged separately so as to allow > snoop functionality to be present on machines with no gui installed? > I can certainly introduce a separate package for the GUI component (Wireshark itself) if that's deemed useful. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Michael.Hunter@sun.com Tue Jun 12 11:59:01 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CIx0ht013173 for ; Tue, 12 Jun 2007 11:59:00 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CIvQeU025247 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 02:57:29 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00C0WDZQS200@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:57:26 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AIFDZQG430@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:57:26 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CIvQa2023775 for ; Tue, 12 Jun 2007 11:57:26 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00F01DVIP300@fe-sfbay-10.sun.com> (original mail from Michael.Hunter@Sun.COM) for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:57:26 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ00DA1DZPOE20@fe-sfbay-10.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 11:57:26 -0700 (PDT) Date: Tue, 12 Jun 2007 11:57:25 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612182626.GL15858@Sun.COM> Sender: Michael.Hunter@sun.com To: Nicolas Williams Cc: Wyllys Ingersoll , James Carlson , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612115725.00007251@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.9.2-csw (GTK+ 2.10.11; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> Status: RO Content-Length: 997 On Tue, 12 Jun 2007 13:26:27 -0500 Nicolas Williams wrote: > On Tue, Jun 12, 2007 at 11:22:01AM -0700, Michael Hunter wrote: > > On Tue, 12 Jun 2007 14:09:11 -0400 > > Wyllys Ingersoll wrote: > > > I also don't see the logic behind forcing the wireshark > > > project to address the missing functionality in snoop. > > > > I don't either. But I would like to see a statement about the > > wireshark community and maintainers and how easy it is estimated to be > > to get them to accept patches. Its not an architectural concern. But > > the cost of long term maintenance should effect which of the two we put > > effort into. > > Or for us to simply ship any plug-ins not accepted by the Wireshark > community. I didn't agree with your (?) request earlier in this thread to ARC that interface as it seems like more of an impediment then necessary to the integration of wireshark. But if this is the answer then that is needed. mph From bart.smaalders@sun.com Tue Jun 12 12:01:07 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJ168a013315 for ; Tue, 12 Jun 2007 12:01:06 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CIxQte025758; Tue, 12 Jun 2007 19:59:35 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00C0NE39V400@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:59:33 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00ARPE38G020@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 11:59:32 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CIxWCn009490; Tue, 12 Jun 2007 11:59:32 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CIxVwA000280; Tue, 12 Jun 2007 11:59:32 -0700 (PDT) Date: Tue, 12 Jun 2007 11:57:40 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1181674137.3743.41.camel@thunk> To: Bill Sommerfeld Cc: Nicolas Williams , PSARC-EXT@sun.com, James Carlson Message-id: <466EECA4.5080006@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <18030.40298.796894.196070@gargle.gargle.HOWL> <466ED8DC.1000108@Sun.COM> <20070612174913.GH15858@Sun.COM> <1181674137.3743.41.camel@thunk> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1214 Bill Sommerfeld wrote: > On Tue, 2007-06-12 at 12:49 -0500, Nicolas Williams wrote: > >> If Wireshark (getting used to not saying "Ethereal" is difficult) has a >> plug-in interface with a stability that suitably matches our needs then >> we should expose it, no? > > if there is a plug-in interface to wireshark which permits it to decode > new protocols then it may be sufficient in many cases to change or > supplement our stock advice to "enhance snoop to decode your protocol" > to "write and ship a wireshark plugin as part of (open)solaris to decode > your protocol"; pushing that plugin back upstream to the wireshark > maintainers could happen asynchronously. > Yes; this is how Wireshark decodes additional protocols. Files are in /usr/lib/wireshark/plugins/0.99.5/... > (yes, there's still the issue of what to do about the protocols snoop > copes with but wireshark doesn't; that would be a prerequisite to > obsoleting snoop but I don't think the two have to happen at the same > time). > Can we get a list somewhere of these protocols, or is the only documentation the source code? - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Nicolas.Williams@sun.com Tue Jun 12 12:02:23 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJ2NqB013361 for ; Tue, 12 Jun 2007 12:02:23 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJ0ph7015595; Tue, 12 Jun 2007 12:00:51 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00D01E5EMW00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 13:00:50 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00BQCE5C0M30@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 13:00:48 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CIxvsT016153; Tue, 12 Jun 2007 13:59:57 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CIxv0H016152; Tue, 12 Jun 2007 13:59:57 -0500 (CDT) Date: Tue, 12 Jun 2007 13:59:57 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612115725.00007251@localhost> To: Michael Hunter Cc: Wyllys Ingersoll , James Carlson , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612185956.GO15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 670 On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: > On Tue, 12 Jun 2007 13:26:27 -0500 > Nicolas Williams wrote: > > Or for us to simply ship any plug-ins not accepted by the Wireshark > > community. > > I didn't agree with your (?) request earlier in this thread to ARC that > interface as it seems like more of an impediment then necessary to the > integration of wireshark. But if this is the answer then that is > needed. I don't understand. Why can't we ship Wireshark with any plug-in interface (does it have one) marked as Volatile? How is that worse than not shipping it, or not shipping Wireshark at all? Nico -- From carlsonj@phorcys.east.sun.com Tue Jun 12 12:11:03 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJB3Qv013594 for ; Tue, 12 Jun 2007 12:11:03 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJ9TA4028743; Tue, 12 Jun 2007 12:09:30 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00D0VEJTGQ00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:09:29 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AXMEJSG940@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:09:29 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CJ9SEF007925; Tue, 12 Jun 2007 15:09:28 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CJ9Sd2007922; Tue, 12 Jun 2007 15:09:28 -0400 (EDT) Date: Tue, 12 Jun 2007 15:09:28 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612185956.GO15858@Sun.COM> To: Nicolas Williams Cc: Michael Hunter , Wyllys Ingersoll , Brian Utterback , PSARC-EXT@Sun.COM, Neal Pollack Message-id: <18030.61288.454280.300564@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> Status: RO Content-Length: 1657 Nicolas Williams writes: > On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: > > I didn't agree with your (?) request earlier in this thread to ARC that > > interface as it seems like more of an impediment then necessary to the > > integration of wireshark. But if this is the answer then that is > > needed. > > I don't understand. Why can't we ship Wireshark with any plug-in > interface (does it have one) marked as Volatile? How is that worse than > not shipping it, or not shipping Wireshark at all? We're potentially creating fun for future project teams: ARC: You should ship a protocol decoder so that administrators can debug problems. Team: good idea! We'll update snoop. ARC: No, don't do that. Snoop is dead. Ship a Wireshark module. Team: great! We'll add that module to our delivery. ARC: No, you can't do that, either. The interfaces you must depend on are all Volatile and controlled by an external entity, so your module won't necessarily work past the next patch. Team: uh ... ok ... so what were we talking about again? It potentially works for the code that swims upstream to the Matrix Mainframe, but perhaps not so cool for others. (I'm actually not so concerned about this as I am with the disconnect between snoop maintenance and wireshark. I want wireshark, but I also want a commitment to it, rather than a drive-by integration. Is that simply asking too much?) -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From bart.smaalders@sun.com Tue Jun 12 12:11:39 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJBcC9013613 for ; Tue, 12 Jun 2007 12:11:38 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJ9f2J064765 for <@newsunmail1brm.central.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 13:09:41 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00E0NEKV8400@brm-avmta-1.central.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 13:10:07 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B0PEKU0U40@brm-avmta-1.central.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 13:10:06 -0600 (MDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CJA5Gr010940; Tue, 12 Jun 2007 12:10:05 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CJA3fh000667; Tue, 12 Jun 2007 12:10:04 -0700 (PDT) Date: Tue, 12 Jun 2007 12:08:12 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.58477.20949.350724@gargle.gargle.HOWL> To: James Carlson Cc: Nicolas Williams , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <466EEF1C.9010609@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1425 James Carlson wrote: > Nicolas Williams writes: >> No, they get to contribute Wireshark support. It's the existing >> functionality in snoop but not in Wireshark that we'd be saying "oh >> well" about. > > Unless we mark snoop as "obsolete" (as I previously suggested), we > really have no good grounds for directing new projects one way or the > other. I don't see that we have a good committed direction at all. > >> But the flip side is holding the system hostage to funding that may >> never show up. Wireshark is *far* superior to snoop, so not including >> Wireshark if noone will commit to making it a strict superset of snoop >> would also be less than "building a system." > > At least by this proposal, it seems can't even get our act together > enough to nuke snoop away. > Declaring snoop obsolete is simple enough. Validating that wireshark is a proper superset is rather more involved than seems appropriate to add to this case. I can certainly file the man page bugs post wireshark integration to have snoop marked as obsolete and point to tshark & wireshark as it's replacements. I can also split the packaging so as to mollify those who find any presence of gnome on their systems to be anathema. Is this what is wanted? I'm pretty unwilling to add to this case the removal of snoop. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Nicolas.Williams@sun.com Tue Jun 12 12:16:24 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJGNma013670 for ; Tue, 12 Jun 2007 12:16:24 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJEjL4001185; Tue, 12 Jun 2007 20:14:48 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00K0LESLNG00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:14:45 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KKAESKH700@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:14:44 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CJDqHN016225; Tue, 12 Jun 2007 14:13:52 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CJDqgP016224; Tue, 12 Jun 2007 14:13:52 -0500 (CDT) Date: Tue, 12 Jun 2007 14:13:52 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.61288.454280.300564@gargle.gargle.HOWL> To: James Carlson Cc: Michael Hunter , Wyllys Ingersoll , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612191351.GQ15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 949 On Tue, Jun 12, 2007 at 03:09:28PM -0400, James Carlson wrote: > Nicolas Williams writes: > > On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: > > > I didn't agree with your (?) request earlier in this thread to ARC that > > > interface as it seems like more of an impediment then necessary to the > > > integration of wireshark. But if this is the answer then that is > > > needed. > > > > I don't understand. Why can't we ship Wireshark with any plug-in > > interface (does it have one) marked as Volatile? How is that worse than > > not shipping it, or not shipping Wireshark at all? > > We're potentially creating fun for future project teams: I meant, Volatile for folks outside the WOS, or preferably outside ON (i.e., dissector plug-ins would have to be integrated into Wireshark or into ON). Then anyone updating Wireshark in Solaris would be responsible for fixing an dissectors in ON-but-not-in-Wireshark that break. From carlsonj@phorcys.east.sun.com Tue Jun 12 12:17:29 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJHTpp013689 for ; Tue, 12 Jun 2007 12:17:29 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJFSik000256; Tue, 12 Jun 2007 13:15:30 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00K0DEUJRU00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:15:55 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KULEUIH700@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:15:55 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id l5CJFsuk008002; Tue, 12 Jun 2007 15:15:54 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id l5CJFsUd007999; Tue, 12 Jun 2007 15:15:54 -0400 (EDT) Date: Tue, 12 Jun 2007 15:15:54 -0400 From: James Carlson Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EEF1C.9010609@Sun.COM> To: Bart Smaalders Cc: Nicolas Williams , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <18030.61674.230260.685321@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <466EEF1C.9010609@Sun.COM> Status: RO Content-Length: 599 Bart Smaalders writes: > Is this what is wanted? I'm pretty unwilling to add to this > case the removal of snoop. I wasn't necessarily asking for the removal now, just the obsolescence. The only obvious question to ask at that point, though, is whether the folks who own snoop agree with this direction and with supporting ethereal^Wwireshark. Have you talked with them? -- James Carlson, Solaris Networking Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Michael.Hunter@sun.com Tue Jun 12 12:23:16 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJNGkm013739 for ; Tue, 12 Jun 2007 12:23:16 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJLgZq003152 for <@newsunmail1brm.central.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 20:21:44 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00F0FF462U00@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 13:21:42 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B55F460U50@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 13:21:42 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CJLfqg026687 for ; Tue, 12 Jun 2007 12:21:41 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00101F1PLQ00@fe-sfbay-10.sun.com> (original mail from Michael.Hunter@Sun.COM) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 12:21:41 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ00DS3F3XOED0@fe-sfbay-10.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 12:21:34 -0700 (PDT) Date: Tue, 12 Jun 2007 12:21:33 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612185956.GO15858@Sun.COM> Sender: Michael.Hunter@sun.com To: Nicolas Williams Cc: Wyllys Ingersoll , James Carlson , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612122133.00005e0c@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.9.2-csw (GTK+ 2.10.11; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> Status: RO Content-Length: 1418 On Tue, 12 Jun 2007 13:59:57 -0500 Nicolas Williams wrote: > On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: > > On Tue, 12 Jun 2007 13:26:27 -0500 > > Nicolas Williams wrote: > > > Or for us to simply ship any plug-ins not accepted by the Wireshark > > > community. > > > > I didn't agree with your (?) request earlier in this thread to ARC that > > interface as it seems like more of an impediment then necessary to the > > integration of wireshark. But if this is the answer then that is > > needed. > > I don't understand. Why can't we ship Wireshark with any plug-in > interface (does it have one) marked as Volatile? How is that worse than > not shipping it, or not shipping Wireshark at all? I guess this is really an issue for the EOF of snoop although I would hope we would understand most of the issues behind that sooner rather then later. If you are going to say that the interface for enhancing wireshark when there is disagreement between Sun and the wireshark community is the plugin interface then I think that needs to be stable. I'd be happy with somebody saying they were reasonable hooked into the wireshark community and thought it was a viable community with good direciton and leadership. Its been 1/2 a decade or so since I poked around the etheral community and I was never more then slightly interested. mph From John.Plocher@sun.com Tue Jun 12 12:26:38 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJQaZb013778 for ; Tue, 12 Jun 2007 12:26:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CJOlK6003532; Wed, 13 Jun 2007 03:25:04 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00L07F9NMG00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:24:59 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00KXWF9MH720@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 12:24:58 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CJOwIv029584; Tue, 12 Jun 2007 12:24:58 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00101F1PLQ00@fe-sfbay-10.sun.com> (original mail from John.Plocher@Sun.COM); Tue, 12 Jun 2007 12:24:58 -0700 (PDT) Received: from [129.146.58.87] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ00DAXF9AOEF0@fe-sfbay-10.sun.com>; Tue, 12 Jun 2007 12:24:46 -0700 (PDT) Date: Tue, 12 Jun 2007 12:24:35 -0700 From: John Plocher Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466EEF1C.9010609@Sun.COM> Sender: John.Plocher@sun.com To: Bart Smaalders Cc: James Carlson , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <466EF2F3.2090706@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <466EEF1C.9010609@Sun.COM> User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) Status: RO Content-Length: 2131 The ARC process is one that tries to focus on systems-level strategic intent, and not the tactics of short term fixes and band-aids. I think what is being asked here is that you do some homework and talk to the networking stakeholders, who, as of now, are still committed to snoop. Once you have done that, you all can come back with the systems-level perspective that says how you (the wireshark proponent) and they (the snoop-invested) intend to handle this issue together going forward. As I understand your position, it seems to be "Didn't bother to talk to them, don't have a clue as to what the long term intent should be; all I want to do is put wireshark into the mix and move on." This seems incomplete. -John Bart Smaalders wrote: > James Carlson wrote: >> Nicolas Williams writes: >>> No, they get to contribute Wireshark support. It's the existing >>> functionality in snoop but not in Wireshark that we'd be saying "oh >>> well" about. >> >> Unless we mark snoop as "obsolete" (as I previously suggested), we >> really have no good grounds for directing new projects one way or the >> other. I don't see that we have a good committed direction at all. >> >>> But the flip side is holding the system hostage to funding that may >>> never show up. Wireshark is *far* superior to snoop, so not including >>> Wireshark if noone will commit to making it a strict superset of snoop >>> would also be less than "building a system." >> >> At least by this proposal, it seems can't even get our act together >> enough to nuke snoop away. >> > > Declaring snoop obsolete is simple enough. Validating that > wireshark is a proper superset is rather more involved than > seems appropriate to add to this case. > > I can certainly file the man page bugs post wireshark > integration to have snoop marked as obsolete and point > to tshark & wireshark as it's replacements. > > I can also split the packaging so as to mollify those > who find any presence of gnome on their systems to be > anathema. > > Is this what is wanted? I'm pretty unwilling to add to this > case the removal of snoop. > > - Bart > > > From Michael.Hunter@sun.com Tue Jun 12 12:26:50 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJQnNP013871 for ; Tue, 12 Jun 2007 12:26:50 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CJP8o1003724 for <@newsunmail1brm.central.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 03:25:18 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00F07FA3A300@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 13:25:15 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B1HFA20O60@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 13:25:15 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CJPEV7029628 for ; Tue, 12 Jun 2007 12:25:14 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00N01F7D2I00@fe-sfbay-09.sun.com> (original mail from Michael.Hunter@Sun.COM) for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 12:25:14 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ008EFFA2T760@fe-sfbay-09.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 12:25:14 -0700 (PDT) Date: Tue, 12 Jun 2007 12:25:13 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612191351.GQ15858@Sun.COM> Sender: Michael.Hunter@sun.com To: Nicolas Williams Cc: James Carlson , Wyllys Ingersoll , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612122513.00005b93@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.9.2-csw (GTK+ 2.10.11; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <20070612191351.GQ15858@Sun.COM> Status: RO Content-Length: 598 On Tue, 12 Jun 2007 14:13:52 -0500 Nicolas Williams wrote: > On Tue, Jun 12, 2007 at 03:09:28PM -0400, James Carlson wrote: > > Nicolas Williams writes: > > > On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: [...] > > We're potentially creating fun for future project teams: > > I meant, Volatile for folks outside the WOS, or preferably outside ON > (i.e., dissector plug-ins would have to be integrated into Wireshark or > into ON). [...] Which reduces it to an implementation technique not substantially better then saying "fork the source". mph From sommerfeld@sun.com Tue Jun 12 12:33:30 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJXUGm013983 for ; Tue, 12 Jun 2007 12:33:30 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJVxHd021507; Tue, 12 Jun 2007 12:31:59 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00F01FLBRZ00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 13:31:59 -0600 (MDT) Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00B5NFLA0U60@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 13:31:58 -0600 (MDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail1bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CJVprZ024000; Tue, 12 Jun 2007 15:31:51 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJVpNn004734; Tue, 12 Jun 2007 15:31:51 -0400 (EDT) Date: Tue, 12 Jun 2007 15:31:49 -0400 From: Bill Sommerfeld Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.61674.230260.685321@gargle.gargle.HOWL> To: James Carlson Cc: Bart Smaalders , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback , Neal Pollack Message-id: <1181676709.3743.49.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <466EEF1C.9010609@Sun.COM> <18030.61674.230260.685321@gargle.gargle.HOWL> Status: RO Content-Length: 535 IMHO I don't think we (PSARC) need a definitive list of the "implemented by solaris, in snoop but not in wireshark" protocols to declare snoop Obsolete now. (declaring the intent to remove in the future). Rather, we need something non-technical: a credible commitment (by *somebody*) to actually do the work to make that list empty, either by supplementing wireshark (or ripping obsolete cruft out of solaris...). That somebody probably wants to see the list to understand how much work it's signing up for. - Bill From Brian.Utterback@sun.com Tue Jun 12 12:35:42 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJZfo8014009 for ; Tue, 12 Jun 2007 12:35:41 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJY0Dc007149 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Tue, 12 Jun 2007 20:34:10 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00M01FOYG200@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 12:34:10 -0700 (PDT) Received: from eastmail2bur.East.Sun.COM ([129.148.13.40]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00K1HFOXH760@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Tue, 12 Jun 2007 12:34:10 -0700 (PDT) Received: from [129.148.226.14] (sr1-unsh01-04.East.Sun.COM [129.148.226.14]) by eastmail2bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CJY5L3020683; Tue, 12 Jun 2007 15:34:05 -0400 (EDT) Date: Tue, 12 Jun 2007 15:34:04 -0400 From: Brian Utterback Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.61674.230260.685321@gargle.gargle.HOWL> To: James Carlson Cc: Bart Smaalders , Nicolas Williams , Michael Hunter , PSARC-EXT@sun.com, Neal Pollack Message-id: <466EF52C.5090800@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <18030.57518.421570.221797@gargle.gargle.HOWL> <20070612181112.GK15858@Sun.COM> <18030.58477.20949.350724@gargle.gargle.HOWL> <466EEF1C.9010609@Sun.COM> <18030.61674.230260.685321@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.5pre (X11/20070601) Status: RO Content-Length: 1333 Unless I completely misunderstand the product lifecycle, I believe that snoop is in sustaining mode. And Solaris RPE management made the decision that given current resources we will not implement any RFE's for sustaining mode products that are not directly required for completion of a customer escalation. Of course, that does not preclude a project team from adding protocol decoders themselves, but we will not do it. So, given this status and situation, I will go out on a limb and say that we would be just as happy for snoop go away as anybody else. James Carlson wrote: > Bart Smaalders writes: >> Is this what is wanted? I'm pretty unwilling to add to this >> case the removal of snoop. > > I wasn't necessarily asking for the removal now, just the > obsolescence. > > The only obvious question to ask at that point, though, is whether the > folks who own snoop agree with this direction and with supporting > ethereal^Wwireshark. Have you talked with them? > -- blu "When Congress started Daylight Savings Time earlier, did they even consider what affect an extra hour of daylight would have on global warming? Well, did they?" ---------------------------------------------------------------------- Brian Utterback - Solaris RPE, Sun Microsystems, Inc. Ph:877-259-7345, Em:brian.utterback-at-ess-you-enn-dot-kom From sommerfeld@sun.com Tue Jun 12 12:39:20 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJdJBh014076 for ; Tue, 12 Jun 2007 12:39:20 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CJbMjq004526; Tue, 12 Jun 2007 13:37:22 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00E01FV1N000@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:37:49 -0700 (PDT) Received: from eastmail2bur.East.Sun.COM ([129.148.13.40]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00ALIFV0G260@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:37:48 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail2bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CJbgMT021413; Tue, 12 Jun 2007 15:37:42 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJbdbw004750; Tue, 12 Jun 2007 15:37:39 -0400 (EDT) Date: Tue, 12 Jun 2007 15:37:38 -0400 From: Bill Sommerfeld Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612122513.00005b93@localhost> To: Michael Hunter Cc: Nicolas Williams , PSARC-EXT@sun.com, Wyllys Ingersoll , Brian Utterback , James Carlson , Neal Pollack Message-id: <1181677058.3743.56.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <20070612191351.GQ15858@Sun.COM> <20070612122513.00005b93@localhost> Status: RO Content-Length: 588 On Tue, 2007-06-12 at 12:25 -0700, Michael Hunter wrote: > Which reduces it to an implementation technique not substantially better > then saying "fork the source". Strongly disagree. Using a documented plugin interface in the way intended by its creator is substantially different from "forking", even if that plugin interface is Volatile in our terms (often they're Volatile in ABI terms but closer to Committed at source level, which means that building the plugin as part of the same consolidation as the framework will not involve substantial maintainance overhead. - Bill From Nicolas.Williams@sun.com Tue Jun 12 12:52:28 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CJqRJ9014395 for ; Tue, 12 Jun 2007 12:52:27 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CJon7c011723; Wed, 13 Jun 2007 03:50:49 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00F01GGO8V00@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:50:48 -0700 (PDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AKLGGNG270@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 12:50:47 -0700 (PDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CJntdO016273; Tue, 12 Jun 2007 14:49:55 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CJntZK016272; Tue, 12 Jun 2007 14:49:55 -0500 (CDT) Date: Tue, 12 Jun 2007 14:49:55 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612122513.00005b93@localhost> To: Michael Hunter Cc: James Carlson , Wyllys Ingersoll , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <20070612194955.GR15858@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <20070612191351.GQ15858@Sun.COM> <20070612122513.00005b93@localhost> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 758 On Tue, Jun 12, 2007 at 12:25:13PM -0700, Michael Hunter wrote: > On Tue, 12 Jun 2007 14:13:52 -0500 > Nicolas Williams wrote: > > > On Tue, Jun 12, 2007 at 03:09:28PM -0400, James Carlson wrote: > > > Nicolas Williams writes: > > > > On Tue, Jun 12, 2007 at 11:57:25AM -0700, Michael Hunter wrote: > [...] > > > We're potentially creating fun for future project teams: > > > > I meant, Volatile for folks outside the WOS, or preferably outside ON > > (i.e., dissector plug-ins would have to be integrated into Wireshark or > > into ON). > [...] > > Which reduces it to an implementation technique not substantially better > then saying "fork the source". Shipping a plug-in without integrating it != fork, not by any stretch. From Michael.Hunter@sun.com Tue Jun 12 13:23:45 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CKNivR015115 for ; Tue, 12 Jun 2007 13:23:45 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5CKM4ne020432; Wed, 13 Jun 2007 04:22:13 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00G03HWZV400@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 13:22:11 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AJNHWZG480@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 13:22:11 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5CKMBwU004132; Tue, 12 Jun 2007 13:22:11 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00301HS6G200@fe-sfbay-09.sun.com> (original mail from Michael.Hunter@Sun.COM); Tue, 12 Jun 2007 13:22:11 -0700 (PDT) Received: from sun.com ([10.7.251.174]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ006HGHWP36F0@fe-sfbay-09.sun.com>; Tue, 12 Jun 2007 13:22:02 -0700 (PDT) Date: Tue, 12 Jun 2007 13:22:01 -0700 From: Michael Hunter Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1181677058.3743.56.camel@thunk> Sender: Michael.Hunter@sun.com To: Bill Sommerfeld Cc: Nicolas Williams , PSARC-EXT@sun.com, Wyllys Ingersoll , Brian Utterback , James Carlson , Neal Pollack Message-id: <20070612132201.0000784d@localhost> Organization: SMI MIME-version: 1.0 X-Mailer: Claws Mail 2.9.2-csw (GTK+ 2.10.11; i386-pc-solaris2.8) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <20070612191351.GQ15858@Sun.COM> <20070612122513.00005b93@localhost> <1181677058.3743.56.camel@thunk> Status: RO Content-Length: 1209 On Tue, 12 Jun 2007 15:37:38 -0400 Bill Sommerfeld wrote: > On Tue, 2007-06-12 at 12:25 -0700, Michael Hunter wrote: > > Which reduces it to an implementation technique not substantially better > > then saying "fork the source". > > Strongly disagree. Using a documented plugin interface in the way > intended by its creator is substantially different from "forking", even > if that plugin interface is Volatile in our terms (often they're > Volatile in ABI terms but closer to Committed at source level, which > means that building the plugin as part of the same consolidation as the > framework will not involve substantial maintainance overhead. If you hadn't said "strongly" I would have thought we were just disagreeing on terms. But since you did... In the normal case I agree that it provides two things: 1) less likelyhood of interface change due to its documentation and use 2) less likelyhood of merge issues due to implied source organization The case in question is where we can't get the community to accept a patch. I think that is correlated with the case where this interface changes. Thus my "not substantially" and not agreeing with your "strongly". mph From bart.smaalders@sun.com Tue Jun 12 14:17:33 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CLHXub016602 for ; Tue, 12 Jun 2007 14:17:33 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CLG1cs023440 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Tue, 12 Jun 2007 14:16:03 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00J0ZKEQET00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 14:16:02 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00ACSKEQG0C0@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Tue, 12 Jun 2007 14:16:02 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CLG1Cv024021; Tue, 12 Jun 2007 14:16:01 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CLG06H005237; Tue, 12 Jun 2007 14:16:01 -0700 (PDT) Date: Tue, 12 Jun 2007 14:14:08 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18030.61288.454280.300564@gargle.gargle.HOWL> To: James Carlson Cc: Nicolas Williams , Michael Hunter , Wyllys Ingersoll , Brian Utterback , PSARC-EXT@sun.com, Neal Pollack Message-id: <466F0CA0.2080402@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 999 James Carlson wrote: > > (I'm actually not so concerned about this as I am with the disconnect > between snoop maintenance and wireshark. I want wireshark, but I also > want a commitment to it, rather than a drive-by integration. Is that > simply asking too much?) > I'm planning on maintaining Wireshark in the sfw consolidation by keeping it up-to-date with the community releases. I do not currently plan on removing snoop from ON. If those who currently maintain snoop wish to redirect their efforts to making sure that wireshark protocol support is a proper superset of that in snoop and then EOF snoop, that's fine w/ me. Apparently, snoop has been placed in sustaining mode already. If no resources are available to do even that much, leaving snoop alone and declared Obsolete certainly won't set any precedents; much of our userland code is defacto in the same state. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Darren.Reed@sun.com Tue Jun 12 14:59:01 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CLx0m4019160 for ; Tue, 12 Jun 2007 14:59:01 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CLvGrX018312; Tue, 12 Jun 2007 22:57:28 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00L0BMBQ9700@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 14:57:26 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00AZOMBOG0E0@nwk-avmta-2.sfbay.sun.com>; Tue, 12 Jun 2007 14:57:25 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5CLvOqo015250; Tue, 12 Jun 2007 21:57:24 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJJ00601MAMQG00@mail-apac.sun.com> (original mail from Darren.Reed@Sun.COM); Wed, 13 Jun 2007 05:57:24 +0800 (SGT) Received: from [129.146.106.55] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJJ00DOCMBL94YN@mail-apac.sun.com>; Wed, 13 Jun 2007 05:57:24 +0800 (SGT) Date: Tue, 12 Jun 2007 14:57:21 -0700 From: Darren.Reed@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466E6D2B.1070706@sun.com> Sender: Darren.Reed@sun.com To: Brian Utterback Cc: Michael Hunter , Neal Pollack , James Carlson , Bart Smaalders , PSARC-EXT@sun.com Message-id: <466F16C1.5000102@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20060120 Status: RO Content-Length: 1135 Brian Utterback wrote: > Michael Hunter wrote: > >> On Mon, 11 Jun 2007 15:17:19 -0700 >> Neal Pollack wrote: >> >> [...] >> >> >>> time a reduction in total customer count. I do not think the >>> introduction of a new tool should >>> necessitate the removal of an existing tool. I simply view it as a >>> long overdue attempt >>> to make the Solaris distro "more complete". >>> >> >> [...] >> >> In general its hard to disagree but in this case the disparity between >> snoop and wireshark is large. I hope the next time somebody brings a >> protocol to PSARC not supported in snoop they wouldn't feel like they >> have to update it. >> >> mph >> > > Of course if we stay up to date, the hope would be that any new protocols > will already be supported in wireshark. If not, then that same person > that > would have updated snoop will need to update wireshark. Agreed. And I'd go further and say that if we're adding a new protocol that isn't supported by Wireshark (or isn't likely to be unless Sun does the work) then we should be thinking twice about that protocol. Darren From sommerfeld@sun.com Tue Jun 12 15:04:55 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CM4sCp019476 for ; Tue, 12 Jun 2007 15:04:55 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CM3FXS020210; Tue, 12 Jun 2007 23:03:23 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00301MLNBC00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:03:23 -0600 (MDT) Received: from eastmail2bur.East.Sun.COM ([129.148.13.40]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00N3IMLM3620@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:03:22 -0600 (MDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail2bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CM3IVd016277; Tue, 12 Jun 2007 18:03:18 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CM3Hu5005148; Tue, 12 Jun 2007 18:03:17 -0400 (EDT) Date: Tue, 12 Jun 2007 18:03:17 -0400 From: Bill Sommerfeld Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466F0CA0.2080402@Sun.COM> To: Bart Smaalders Cc: James Carlson , Neal Pollack , Wyllys Ingersoll , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback Message-id: <1181685797.3743.102.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <466F0CA0.2080402@Sun.COM> Status: RO Content-Length: 1137 On Tue, 2007-06-12 at 14:14 -0700, Bart Smaalders wrote: > I'm planning on maintaining Wireshark in the sfw consolidation by > keeping it up-to-date with the community releases. I do not currently > plan on removing snoop from ON. If those who currently maintain > snoop wish to redirect their efforts to making sure that wireshark > protocol support is a proper superset of that in snoop and then EOF > snoop, that's fine w/ me. Apparently, snoop has been placed in > sustaining mode already. If no resources are available to do even > that much, leaving snoop alone and declared Obsolete certainly won't > set any precedents; much of our userland code is defacto in the same > state. PSARC and the ON cteam have operated for some time with a general architectural principle that our observability tools (snoop, truss, dtrace, pfiles, etc.,) ought to be able to observe what our implementation does and thus projects which add new artifacts ought to extend these tools accordingly. Do you believe this principle is in error? If not, how should we instruct project teams to let us deliver this system property via wireshark? From Nicolas.Williams@sun.com Tue Jun 12 15:09:13 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CM9DXQ019963 for ; Tue, 12 Jun 2007 15:09:13 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CM7d1v021451; Tue, 12 Jun 2007 15:07:39 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00301MSOMX00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:07:36 -0600 (MDT) Received: from localhost.Central.Sun.COM ([129.153.128.213]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00NPCMSN3A10@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:07:36 -0600 (MDT) Received: from localhost.Central.Sun.COM (localhost [127.0.0.1]) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l5CM6hn3016489; Tue, 12 Jun 2007 17:06:43 -0500 (CDT) Received: (from nw141292@localhost) by localhost.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l5CM6hc4016488; Tue, 12 Jun 2007 17:06:43 -0500 (CDT) Date: Tue, 12 Jun 2007 17:06:43 -0500 From: Nicolas Williams Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466F16C1.5000102@Sun.COM> To: Darren.Reed@sun.com Cc: Brian Utterback , Michael Hunter , PSARC-ext@sun.com, James Carlson , Neal Pollack Message-id: <20070612220643.GD16317@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <466F16C1.5000102@Sun.COM> X-Authentication-warning: localhost.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 912 On Tue, Jun 12, 2007 at 02:57:21PM -0700, Darren.Reed@Sun.COM wrote: > Agreed. And I'd go further and say that if we're adding a new > protocol that isn't supported by Wireshark (or isn't likely to be > unless Sun does the work) then we should be thinking twice > about that protocol. That's a bit extreme. You can teach Wireshark about lots of application protocols, such as RPC protocols. Application protocols often aren't standardized, either at all or until the protocol becomes popular, so what, we should not develop any new application protocols without first standardizing them and/or waiting for others to implement them? I imagine that you must have meant protocols below the application layer. Even then, if Wireshark had no, say, RDDP dissector does that reflect poorly on RDDP? Or does it nothing of note about RDDP? (IMO, the latter.) Surely Sun can lead rather than trail, no? Nico -- From bart.smaalders@sun.com Tue Jun 12 15:17:13 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CMHCjb020352 for ; Tue, 12 Jun 2007 15:17:12 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CMFbia022537; Tue, 12 Jun 2007 23:15:41 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00401N627L00@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:15:38 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00NVLN613F20@brm-avmta-1.central.sun.com>; Tue, 12 Jun 2007 16:15:37 -0600 (MDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5CMFaOr029683; Tue, 12 Jun 2007 15:15:36 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5CMFZ9U007238; Tue, 12 Jun 2007 15:15:36 -0700 (PDT) Date: Tue, 12 Jun 2007 15:13:43 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1181685797.3743.102.camel@thunk> To: Bill Sommerfeld Cc: James Carlson , Neal Pollack , Wyllys Ingersoll , Michael Hunter , PSARC-EXT@sun.com, Brian Utterback Message-id: <466F1A97.5030303@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <466F0CA0.2080402@Sun.COM> <1181685797.3743.102.camel@thunk> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1683 Bill Sommerfeld wrote: > On Tue, 2007-06-12 at 14:14 -0700, Bart Smaalders wrote: >> I'm planning on maintaining Wireshark in the sfw consolidation by >> keeping it up-to-date with the community releases. I do not currently >> plan on removing snoop from ON. If those who currently maintain >> snoop wish to redirect their efforts to making sure that wireshark >> protocol support is a proper superset of that in snoop and then EOF >> snoop, that's fine w/ me. Apparently, snoop has been placed in >> sustaining mode already. If no resources are available to do even >> that much, leaving snoop alone and declared Obsolete certainly won't >> set any precedents; much of our userland code is defacto in the same >> state. > > PSARC and the ON cteam have operated for some time with a general > architectural principle that our observability tools (snoop, truss, > dtrace, pfiles, etc.,) ought to be able to observe what our > implementation does and thus projects which add new artifacts ought to > extend these tools accordingly. > > Do you believe this principle is in error? If not, how should we > instruct project teams to let us deliver this system property via > wireshark? > > > > I would suggest the following: 1) project teams introducing new network protocols should be contributing these changes back to the wireshark project. 2) failing this, teams could enhance our copy of wireshark with a new plug-in. I would much prefer 1) above, as it's simpler and allows users using other OSes to observe traffic generated on Solaris more completely. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Darren.Reed@sun.com Tue Jun 12 15:18:16 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CMIFfN020481 for ; Tue, 12 Jun 2007 15:18:15 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CMGesa022909 for <@newsunmail1brm.central.sun.com:PSARC-ext@sun.com>; Tue, 12 Jun 2007 23:16:44 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00405N7V9W00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 12 Jun 2007 16:16:43 -0600 (MDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ00NQ9N7U3520@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 12 Jun 2007 16:16:43 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5CMGfec015468 for ; Tue, 12 Jun 2007 22:16:41 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJJ00701N0A7500@mail-apac.sun.com> (original mail from Darren.Reed@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 06:16:41 +0800 (SGT) Received: from [129.146.106.55] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJJ000Q5N7R8I46@mail-apac.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 13 Jun 2007 06:16:41 +0800 (SGT) Date: Tue, 12 Jun 2007 15:16:38 -0700 From: Darren.Reed@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <20070612220643.GD16317@Sun.COM> Sender: Darren.Reed@sun.com To: Nicolas Williams Cc: Brian Utterback , Michael Hunter , PSARC-ext@sun.com, James Carlson , Neal Pollack Message-id: <466F1B46.7090205@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <466F16C1.5000102@Sun.COM> <20070612220643.GD16317@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20060120 Status: RO Content-Length: 1471 Nicolas Williams wrote: >On Tue, Jun 12, 2007 at 02:57:21PM -0700, Darren.Reed@Sun.COM wrote: > > >>Agreed. And I'd go further and say that if we're adding a new >>protocol that isn't supported by Wireshark (or isn't likely to be >>unless Sun does the work) then we should be thinking twice >>about that protocol. >> >> > >That's a bit extreme. You can teach Wireshark about lots of application >protocols, such as RPC protocols. Application protocols often aren't >standardized, either at all or until the protocol becomes popular, so >what, we should not develop any new application protocols without first >standardizing them and/or waiting for others to implement them? > >I imagine that you must have meant protocols below the application >layer. Even then, if Wireshark had no, say, RDDP dissector does that >reflect poorly on RDDP? Or does it nothing of note about RDDP? (IMO, >the latter.) Surely Sun can lead rather than trail, no? > > Wireshark has protocol dissectors and file input formats supported that I've never heard of through commuity input and interest. The line I'm drawing from that is that if there is relatively no interest or use of a protocol outside of Sun then what are we doing it for? Bear in mind that most of the protocols we implement or support, these days, should be coming from IETF, etc, so it is highly likely that others will want them too. Darren (dragging the thread of coversation well and truely off topic) From Darren.Reed@sun.com Tue Jun 12 16:12:00 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5CNBxV0022203 for ; Tue, 12 Jun 2007 16:11:59 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5CN9MH2005490; Wed, 13 Jun 2007 00:10:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00IBRPP8GH00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 16:10:20 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ001PWPMWRY90@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 16:08:58 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l5CN8uqP016241; Tue, 12 Jun 2007 23:08:56 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JJJ00001PFY8000@mail-apac.sun.com> (original mail from Darren.Reed@Sun.COM); Wed, 13 Jun 2007 07:08:56 +0800 (SGT) Received: from [129.146.106.55] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JJJ00DEXPMT945O@mail-apac.sun.com>; Wed, 13 Jun 2007 07:08:56 +0800 (SGT) Date: Tue, 12 Jun 2007 16:08:52 -0700 From: Darren.Reed@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466F1A97.5030303@Sun.COM> Sender: Darren.Reed@sun.com To: Bart Smaalders Cc: Bill Sommerfeld , James Carlson , Neal Pollack , Wyllys Ingersoll , Michael Hunter , PSARC-ext@sun.com, Brian Utterback Message-id: <466F2784.6070709@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <466F0CA0.2080402@Sun.COM> <1181685797.3743.102.camel@thunk> <466F1A97.5030303@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20060120 Status: RO Content-Length: 1668 Bart Smaalders wrote: > Bill Sommerfeld wrote: > >> On Tue, 2007-06-12 at 14:14 -0700, Bart Smaalders wrote: >> >>> I'm planning on maintaining Wireshark in the sfw consolidation by >>> keeping it up-to-date with the community releases. I do not currently >>> plan on removing snoop from ON. If those who currently maintain >>> snoop wish to redirect their efforts to making sure that wireshark >>> protocol support is a proper superset of that in snoop and then EOF >>> snoop, that's fine w/ me. Apparently, snoop has been placed in >>> sustaining mode already. If no resources are available to do even >>> that much, leaving snoop alone and declared Obsolete certainly won't >>> set any precedents; much of our userland code is defacto in the same >>> state. >> >> >> PSARC and the ON cteam have operated for some time with a general >> architectural principle that our observability tools (snoop, truss, >> dtrace, pfiles, etc.,) ought to be able to observe what our >> implementation does and thus projects which add new artifacts ought to >> extend these tools accordingly. >> >> Do you believe this principle is in error? If not, how should we >> instruct project teams to let us deliver this system property via >> wireshark? >> >> >> >> > > I would suggest the following: > > 1) project teams introducing new network protocols should be > contributing these changes back to the wireshark project. > > 2) failing this, teams could enhance our copy of wireshark with > a new plug-in. I would much prefer 1) above, as it's simpler and > allows users using other OSes to observe traffic generated on Solaris > more completely. +1 on option (1). Darren From James.Hughes@sun.com Tue Jun 12 17:08:10 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5D089Tg022990 for ; Tue, 12 Jun 2007 17:08:10 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5D06Z3E021179; Wed, 13 Jun 2007 08:06:36 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJJ00M0DSAYEQ00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 17:06:34 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJJ001ZBSASS6A0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 12 Jun 2007 17:06:28 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l5D06S4R000265; Tue, 12 Jun 2007 17:06:28 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JJJ00A01S6MOU00@fe-sfbay-09.sun.com> (original mail from James.Hughes@Sun.COM); Tue, 12 Jun 2007 17:06:28 -0700 (PDT) Received: from [129.146.227.204] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JJJ003AHSASWND0@fe-sfbay-09.sun.com>; Tue, 12 Jun 2007 17:06:28 -0700 (PDT) Date: Tue, 12 Jun 2007 17:06:28 -0700 From: James Hughes Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466F2784.6070709@Sun.COM> Sender: James.Hughes@sun.com To: Darren.Reed@sun.com Cc: James Hughes , Bart Smaalders , Bill Sommerfeld , James Carlson , Neal Pollack , Wyllys Ingersoll , Michael Hunter , PSARC-ext@sun.com, Brian Utterback Message-id: <63CDE575-9358-4DE3-8BBA-985BA2E8A2B1@sun.com> MIME-version: 1.0 X-Mailer: Apple Mail (2.880) Content-type: text/plain; delsp=yes; format=flowed; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC9EF.3020207@Sun.COM> <20070611194616.00005d36@localhost> <466E6D2B.1070706@sun.com> <18030.38826.802183.985973@gargle.gargle.HOWL> <20070612175603.GI15858@Sun.COM> <466EE147.4070901@sun.com> <20070612112201.000010db@localhost> <20070612182626.GL15858@Sun.COM> <20070612115725.00007251@localhost> <20070612185956.GO15858@Sun.COM> <18030.61288.454280.300564@gargle.gargle.HOWL> <466F0CA0.2080402@Sun.COM> <1181685797.3743.102.camel@thunk> <466F1A97.5030303@Sun.COM> <466F2784.6070709@Sun.COM> Status: RO Content-Length: 470 On Jun 12, 2007, at 4:08 PM, Darren.Reed@Sun.COM wrote: > Bart Smaalders wrote: >> I would suggest the following: >> >> 1) project teams introducing new network protocols should be >> contributing these changes back to the wireshark project. +1 on this... ...and I would add that if someone pines for an obscure protocol that is currently only in snoop, converting this would be a simple bite- sized bug (that would be contributed back to the wireshark project). From gww@eng.sun.com Wed Jun 13 08:39:19 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DFdIeB008964 for ; Wed, 13 Jun 2007 08:39:19 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5DFbDLB021649 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.Com>; Wed, 13 Jun 2007 23:37:46 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJK00409ZEXGN00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.Com (ORCPT PSARC-EXT@Sun.Com); Wed, 13 Jun 2007 08:37:45 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJK000UBZEXBD60@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.Com (ORCPT PSARC-EXT@Sun.Com); Wed, 13 Jun 2007 08:37:45 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DFbiuC000277; Wed, 13 Jun 2007 08:37:44 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DFeJWi012106; Wed, 13 Jun 2007 08:40:19 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DFeJsD012105; Wed, 13 Jun 2007 08:40:19 -0700 (PDT) Date: Wed, 13 Jun 2007 08:40:19 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <200706131540.l5DFeJsD012105@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 5706 > From bart.smaalders@Sun.Com Mon Jun 11 13:44:24 2007 > Date: Mon, 11 Jun 2007 13:41:00 -0700 > From: Bart Smaalders > Subject: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris > To: PSARC-EXT@Sun.Com > X-PMX-Version: 5.2.0.264296 > User-Agent: Thunderbird 2.0.0.0 (X11/20070423) > > This is a multi-part message in MIME format. > > --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA) > Content-type: text/plain; charset=ISO-8859-1; format=flowed > Content-transfer-encoding: 7BIT > > I'm sponsoring the attached open fasttrack for myself. I'm > looking for minor release binding and the case times out > 6/13/2007. > > - Bart > > -- > Bart Smaalders Solaris Kernel Performance > barts@cyber.eng.sun.com http://blogs.sun.com/barts > > --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA) > Content-type: text/plain; name=wireshark.txt > Content-transfer-encoding: 7BIT > Content-disposition: inline; filename=wireshark.txt > > 1. Introduction > 1.1. Project/Component Working Name: > Add Wireshark 0.99.5 into Solaris > 1.2. Name of Document Author/Supplier: > Author: Bart Smaalders > 1.3 Date of This Document: > June 7, 2007 > 4. Technical Description > > Summary > This project integrates Wireshark v 0.99.5 into Solaris > This project requests a minor release binding. > > Background > > Wireshark (ne Ethereal) is a very popular network protocol > analyzer e.g. a graphical snoop. It runs under a variety > of platforms, and is licensed under the GNU General Public License. > It captures packets (when run as root) and displays them > in a GTK-based GUI. A sample screenshot can be found > here: http://wireshark.org/image/front_screen_full.png > > More information is available at http://wireshark.org > > Details > > This project delivers the following binaries: > > usr/sbin/wireshark > > Wireshark is a GUI network protocol analyzer. It lets you > interactively browse packet data from a live network or from > a previously saved capture file. Wireshark's native capture > file format is libpcap format, which is also the format used > by tcpdump and various other tools. > > > usr/sbin/editcap > > Editcap is a program that reads some or all of the captured > packets from the infile, optionally converts them in various > ways and writes the resulting packets to the capture outfile > (or outfiles). > > usr/sbin/capinfos > > Capinfos is a program that reads one or more capture files > and returns some or all available statistics of each > . > > > usr/sbin/text2pcap > > Text2pcap is a program that reads in an ASCII hex dump and > writes the data described into a libpcap capture file. > text2pcap can read hexdumps with multiple packets in them, > and build a capture file of multiple packets. text2pcap is > also capable of generating dummy Ethernet, IP and UDP, TCP, > or SCTP headers, in order to build fully processable packet > dumps from hexdumps of application-level data only. > > usr/sbin/tshark > > TShark is a network protocol analyzer. It lets you capture > packet data from a live network, or read packets from a > previously saved capture file, either printing a decoded > form of those packets to the standard output or writing the > packets to a file. TShark's native capture file format is > libpcap format, which is also the format used by tcpdump and > various other tools. > > usr/sbin/mergecap > > Mergecap is a program that combines multiple saved capture > files into a single output file specified by the -w > argument. Mergecap knows how to read libpcap capture files, > including those of tcpdump, Wireshark, and other tools that > write captures in that format. > > usr/sbin/dumpcap > > Dumpcap is a network traffic dump tool. It lets you capture > packet data from a live network and write the packets to a > file. Dumpcap's native capture file format is libpcap > format, which is also the format used by Wireshark, tcpdump > and various other tools. > > Additional files > > Man pages are provided in /usr/share/man. HTML help pages > are delivered into /usr/share/wireshark; these are brought > up in a browser if help is selected from within Wireshark. > Various other bits of private implementation details can be > found under usr/share/wireshark as well. Program plugins > are delivered into usr/lib/wireshark/plugins/0.99.5. > > There are two private libraries delivered into /usr/lib. > > Following current SFW practice, all binaries, man pages, etc are > delivered in a single package, SUNWwireshark. > > Wireshark appears in the JDS desktop menu under System Tools. > > A complete list of delivered files is in the case directory > in SVR4 package prototype form as prototype_com; the man pages > can be found in the man subdirectory. > > Interfaces > > The names of the introduced binaries are Unstable. > The command line interfaces, output, etc, are all External. > > 4.2 Bug/RFE Numbers > 6567201 Solaris should include Wireshark > > 5. References > PSARC 1999/555: Getting with the Freeware Program > PSARC 2005/185: Enabling Serendipitous Discovery > http://wireshark.org > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > sfw > 6.5. ARC review type: Fasttrack > > > --Boundary_(ID_+oh8VFzdjZoIBxVPk3QGVA)-- > From gww@eng.sun.com Wed Jun 13 08:42:39 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DFgcTC009316 for ; Wed, 13 Jun 2007 08:42:39 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5DFf402022715 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 23:41:06 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJK00F27ZKF7E00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 08:41:03 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJK00KQYZK3NNE0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 08:40:51 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DFeotS001240; Wed, 13 Jun 2007 08:40:50 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DFhPrP012127; Wed, 13 Jun 2007 08:43:25 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DFhPnC012126; Wed, 13 Jun 2007 08:43:25 -0700 (PDT) Date: Wed, 13 Jun 2007 08:43:25 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: Garrett.Damore@sun.com, bart.smaalders@sun.com Cc: PSARC-EXT@sun.com Message-id: <200706131543.l5DFhPnC012126@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 357 > All of the commands above have man pages and are usable by > administrators. If one primarily uses Wireshark (the gui), I hate to continue to sing the same song, however the project team seems to what me to do so: What Rights Profiles will these commands be delivered into? Should I suggest "Network Management" (where snoop resides ;-)? Gary.. From gww@eng.sun.com Wed Jun 13 08:45:49 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DFjmsK009357 for ; Wed, 13 Jun 2007 08:45:48 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5DFiCYU024231 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 23:44:16 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJK00F0FZPPG900@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 08:44:13 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJK00KOQZPONFC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 08:44:13 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DFiBfY001755; Wed, 13 Jun 2007 08:44:12 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DFklnq012140; Wed, 13 Jun 2007 08:46:47 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DFklYq012139; Wed, 13 Jun 2007 08:46:47 -0700 (PDT) Date: Wed, 13 Jun 2007 08:46:47 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: PSARC-EXT@Sun.COM, bart.smaalders@Sun.COM, gww@eng.sun.com Message-id: <200706131546.l5DFklYq012139@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 263 > > I'm sponsoring the attached open fasttrack for myself. I'm > > looking for minor release binding and the case times out > > 6/13/2007. Apologies this inadvertantly escaped without my intended comment. See my next comment of 08:43:25 -0700 (PDT). Gary.. From bart.smaalders@sun.com Wed Jun 13 11:17:35 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DIHY3l018737 for ; Wed, 13 Jun 2007 11:17:34 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DIFtlH012196 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@Sun.COM>; Wed, 13 Jun 2007 19:16:01 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL003136QO6C00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 13 Jun 2007 11:16:00 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00H7B6QOCBB0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 13 Jun 2007 11:16:00 -0700 (PDT) Received: from zion.eng.sun.com (zion.SFBay.Sun.COM [129.146.17.75]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DIG0ea021026 for ; Wed, 13 Jun 2007 11:16:00 -0700 (PDT) Received: from [129.146.228.109] (cyber [129.146.228.109]) by zion.eng.sun.com (8.13.7+Sun/8.13.7) with ESMTP id l5DIFxW2002865 for ; Wed, 13 Jun 2007 11:15:59 -0700 (PDT) Date: Wed, 13 Jun 2007 11:14:07 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DB35C.7000603@Sun.COM> To: PSARC-EXT@sun.com Message-id: <467033EF.7040607@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_RKiu7cYp6vt3WfFwqZh+YQ)" X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 5597 This is a multi-part message in MIME format. --Boundary_(ID_RKiu7cYp6vt3WfFwqZh+YQ) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT This case was derailed and then approved at today's PSARC meeting with the following spec changes: 1) introduction of a separate package for the GUI component 2) addition of a rights profile to match snoop's. An amended spec is attached. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts --Boundary_(ID_RKiu7cYp6vt3WfFwqZh+YQ) Content-type: text/plain; name=wireshark.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=wireshark.txt 1. Introduction 1.1. Project/Component Working Name: Add Wireshark 0.99.5 into Solaris 1.2. Name of Document Author/Supplier: Author: Bart Smaalders 1.3 Date of This Document: June 7, 2007 4. Technical Description Summary This project integrates Wireshark v 0.99.5 into Solaris This project requests a minor release binding. Background Wireshark (ne Ethereal) is a very popular network protocol analyzer e.g. a graphical snoop. It runs under a variety of platforms, and is licensed under the GNU General Public License. It captures packets (when run as root) and displays them in a GTK-based GUI. A sample screenshot can be found here: http://wireshark.org/image/front_screen_full.png More information is available at http://wireshark.org Details This project delivers the following binaries: usr/sbin/wireshark Wireshark is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. usr/sbin/editcap Editcap is a program that reads some or all of the captured packets from the infile, optionally converts them in various ways and writes the resulting packets to the capture outfile (or outfiles). usr/sbin/capinfos Capinfos is a program that reads one or more capture files and returns some or all available statistics of each . usr/sbin/text2pcap Text2pcap is a program that reads in an ASCII hex dump and writes the data described into a libpcap capture file. text2pcap can read hexdumps with multiple packets in them, and build a capture file of multiple packets. text2pcap is also capable of generating dummy Ethernet, IP and UDP, TCP, or SCTP headers, in order to build fully processable packet dumps from hexdumps of application-level data only. usr/sbin/tshark TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. usr/sbin/mergecap Mergecap is a program that combines multiple saved capture files into a single output file specified by the -w argument. Mergecap knows how to read libpcap capture files, including those of tcpdump, Wireshark, and other tools that write captures in that format. usr/sbin/dumpcap Dumpcap is a network traffic dump tool. It lets you capture packet data from a live network and write the packets to a file. Dumpcap's native capture file format is libpcap format, which is also the format used by Wireshark, tcpdump and various other tools. Additional files Man pages are provided in /usr/share/man. HTML help pages are delivered into /usr/share/wireshark; these are brought up in a browser if help is selected from within Wireshark. Various other bits of private implementation details can be found under usr/share/wireshark as well. Program plugins are delivered into usr/lib/wireshark/plugins/0.99.5. There are two private libraries delivered into /usr/lib. The command line tools and their libraries, man pages, plugins, etc are delivered in SUNWwireshark. The GUI itself (the only component with Gnome dependencies) is delivered in a separate package SUNWwiresharkgui to faciliate the use of the command line tools in otherwise minimized systems. The Wireshark GUI appears in the JDS desktop menu under System Tools. Two rights profiles are added to /etc/security/exec_attr as follows: Network Management:suser:cmd:::/usr/sbin/tshark:uid=0 Network Management:suser:cmd:::/usr/sbin/wireshark:uid=0 A complete list of delivered files is in the case directory in SVR4 package prototype form as prototype_com; the man pages can be found in the man subdirectory. Interfaces The names of the introduced binaries are Unstable. The command line interfaces, output, etc, are all External. 4.2 Bug/RFE Numbers 6567201 Solaris should include Wireshark 5. References PSARC 1999/555: Getting with the Freeware Program PSARC 2005/185: Enabling Serendipitous Discovery http://wireshark.org 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: sfw 6.5. ARC review type: Fasttrack --Boundary_(ID_RKiu7cYp6vt3WfFwqZh+YQ)-- From gww@eng.sun.com Wed Jun 13 12:25:38 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DJPcBq020893 for ; Wed, 13 Jun 2007 12:25:38 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DJO6gG025028 for <@sunmail3mpk.sfbay.sun.com:PSARC-EXT@Sun.COM>; Wed, 13 Jun 2007 12:24:06 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00E019W5BD00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 13 Jun 2007 12:24:05 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00AG19W4UN40@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 13 Jun 2007 12:24:04 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DJO3PF028564; Wed, 13 Jun 2007 12:24:03 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DJQdUC012525; Wed, 13 Jun 2007 12:26:39 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DJQdUd012524; Wed, 13 Jun 2007 12:26:39 -0700 (PDT) Date: Wed, 13 Jun 2007 12:26:39 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: PSARC-EXT@Sun.COM, bart.smaalders@Sun.COM Message-id: <200706131926.l5DJQdUd012524@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 386 > Two rights profiles are added to /etc/security/exec_attr as > follows: > > Network Management:suser:cmd:::/usr/sbin/tshark:uid=0 > Network Management:suser:cmd:::/usr/sbin/wireshark:uid=0 As we discussed today, I clearly thought we can do better than this. Also since there is no backward compatibility issue, the policy field should be "solaris", not "suser". Gary.. From casper@holland.sun.com Wed Jun 13 12:36:43 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DJahOu021078 for ; Wed, 13 Jun 2007 12:36:43 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DJZAJ6027651; Wed, 13 Jun 2007 12:35:11 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00105AEM2900@brm-avmta-1.central.sun.com>; Wed, 13 Jun 2007 13:35:10 -0600 (MDT) Received: from sr1-eaft06-01.holland.sun.com ([129.159.237.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00I2NAELUQ40@brm-avmta-1.central.sun.com>; Wed, 13 Jun 2007 13:35:10 -0600 (MDT) Received: from holland (room101 [129.159.130.93]) by sr1-eaft06-01.holland.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DJZ6IU050992; Wed, 13 Jun 2007 21:35:07 +0200 (MEST) Date: Wed, 13 Jun 2007 21:35:06 +0200 From: Casper.Dik@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706131926.l5DJQdUd012524@marduk.eng.sun.com> Sender: casper@holland.sun.com To: Gary Winiger Cc: PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <200706131935.l5DJZ6IU050992@sr1-eaft06-01.holland.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706131926.l5DJQdUd012524@marduk.eng.sun.com> Status: RO Content-Length: 848 > >> Two rights profiles are added to /etc/security/exec_attr as >> follows: >> >> Network Management:suser:cmd:::/usr/sbin/tshark:uid=0 >> Network Management:suser:cmd:::/usr/sbin/wireshark:uid=0 > > As we discussed today, I clearly thought we can do better than > this. Also since there is no backward compatibility issue, > the policy field should be "solaris", not "suser". Yes, this seems wrong; certainly if it allows creating output files. Solaris snoop runs as "nobody" after doing setup (open output files, configure snooping and filtering) and running with just the appropriate privileges at start seems much preferred, specifically as there applications are prone to stumbling over odd packets. And running GUI apps under uid 0 is a big NO-NO. They always have too many security bugs by virtue of their size alone. Casper From alan.coopersmith@sun.com Wed Jun 13 13:14:25 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DKEOfh021846 for ; Wed, 13 Jun 2007 13:14:24 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DKCWQI021316 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 21:12:52 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00D05C5DTD00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 13:12:49 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00833C5CJV40@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 13:12:48 -0700 (PDT) Received: from [129.146.108.211] (almas.SFBay.Sun.COM [129.146.108.211]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DKCka4029544; Wed, 13 Jun 2007 13:12:46 -0700 (PDT) Date: Wed, 13 Jun 2007 13:12:46 -0700 From: Alan Coopersmith Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706131935.l5DJZ6IU050992@sr1-eaft06-01.holland.sun.com> To: Casper.Dik@sun.com Cc: Gary Winiger , PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <46704FBE.1010706@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706131926.l5DJQdUd012524@marduk.eng.sun.com> <200706131935.l5DJZ6IU050992@sr1-eaft06-01.holland.sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 1080 Casper.Dik@Sun.COM wrote: >>> Two rights profiles are added to /etc/security/exec_attr as >>> follows: >>> >>> Network Management:suser:cmd:::/usr/sbin/tshark:uid=0 >>> Network Management:suser:cmd:::/usr/sbin/wireshark:uid=0 >> As we discussed today, I clearly thought we can do better than >> this. Also since there is no backward compatibility issue, >> the policy field should be "solaris", not "suser". > > Yes, this seems wrong; certainly if it allows creating output files. > > Solaris snoop runs as "nobody" after doing setup (open output files, > configure snooping and filtering) and running with just the > appropriate privileges at start seems much preferred, specifically > as there applications are prone to stumbling over odd packets. > > And running GUI apps under uid 0 is a big NO-NO. They always have > too many security bugs by virtue of their size alone. GTK just exits on startup if it detects it's being used in a setuid app. -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From casper@holland.sun.com Wed Jun 13 13:41:20 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DKfKVd022533 for ; Wed, 13 Jun 2007 13:41:20 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DKdlHV010890; Wed, 13 Jun 2007 13:39:48 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00G01DEACI00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 13 Jun 2007 13:39:46 -0700 (PDT) Received: from sr1-eaft06-01.holland.sun.com ([129.159.237.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL008SWDE8JN40@nwk-avmta-1.sfbay.Sun.COM>; Wed, 13 Jun 2007 13:39:45 -0700 (PDT) Received: from holland (room101 [129.159.130.93]) by sr1-eaft06-01.holland.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DKdcQ2046591; Wed, 13 Jun 2007 22:39:38 +0200 (MEST) Date: Wed, 13 Jun 2007 22:39:38 +0200 From: Casper.Dik@sun.com Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <46704FBE.1010706@sun.com> Sender: casper@holland.sun.com To: Alan Coopersmith Cc: Gary Winiger , PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <200706132039.l5DKdcQ2046591@sr1-eaft06-01.holland.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706131926.l5DJQdUd012524@marduk.eng.sun.com> <200706131935.l5DJZ6IU050992@sr1-eaft06-01.holland.sun.com> <46704FBE.1010706@sun.com> Status: RO Content-Length: 1072 >Casper.Dik@Sun.COM wrote: >>>> Two rights profiles are added to /etc/security/exec_attr as >>>> follows: >>>> >>>> Network Management:suser:cmd:::/usr/sbin/tshark:uid=0 >>>> Network Management:suser:cmd:::/usr/sbin/wireshark:uid=0 >>> As we discussed today, I clearly thought we can do better than >>> this. Also since there is no backward compatibility issue, >>> the policy field should be "solaris", not "suser". >> >> Yes, this seems wrong; certainly if it allows creating output files. >> >> Solaris snoop runs as "nobody" after doing setup (open output files, >> configure snooping and filtering) and running with just the >> appropriate privileges at start seems much preferred, specifically >> as there applications are prone to stumbling over odd packets. >> >> And running GUI apps under uid 0 is a big NO-NO. They always have >> too many security bugs by virtue of their size alone. > >GTK just exits on startup if it detects it's being used in a setuid app. But not if it's run with eui d= ruid = 0, right, and that is the plan here. Casper From gww@eng.sun.com Wed Jun 13 13:48:18 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DKmIes022701 for ; Wed, 13 Jun 2007 13:48:18 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5DKkkeN017706 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 13 Jun 2007 13:46:46 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00H03DPY0I00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 13:46:46 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL008DWDPXJT50@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 13:46:45 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DKkgwe007823; Wed, 13 Jun 2007 13:46:42 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5DKnIBr012878; Wed, 13 Jun 2007 13:49:18 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5DKnIY3012877; Wed, 13 Jun 2007 13:49:18 -0700 (PDT) Date: Wed, 13 Jun 2007 13:49:18 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: Casper.Dik@sun.com, alan.coopersmith@sun.com Cc: gww@eng.sun.com, PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <200706132049.l5DKnIY3012877@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 154 > GTK just exits on startup if it detects it's being used in a setuid app. It's not suid 0 it's started from pfexec and as stated ruid=euid=0. Gary.. From alan.coopersmith@sun.com Wed Jun 13 13:52:06 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5DKq5PP022829 for ; Wed, 13 Jun 2007 13:52:06 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5DKoRWF026373 for <@newsunmail1brm.central.sun.com:PSARC-EXT@sun.com>; Thu, 14 Jun 2007 04:50:32 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJL00605DW52000@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 14:50:29 -0600 (MDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJL00I9RDW4U8A0@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 13 Jun 2007 14:50:28 -0600 (MDT) Received: from [129.146.108.211] (almas.SFBay.Sun.COM [129.146.108.211]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5DKoPfv019600; Wed, 13 Jun 2007 13:50:25 -0700 (PDT) Date: Wed, 13 Jun 2007 13:50:25 -0700 From: Alan Coopersmith Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <200706132049.l5DKnIY3012877@marduk.eng.sun.com> To: Gary Winiger Cc: Casper.Dik@sun.com, PSARC-EXT@sun.com, bart.smaalders@sun.com Message-id: <46705891.6070706@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200706132049.l5DKnIY3012877@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.0 (X11/20070423) Status: RO Content-Length: 457 Gary Winiger wrote: >> GTK just exits on startup if it detects it's being used in a setuid app. > > It's not suid 0 it's started from pfexec and as stated ruid=euid=0. Then if any environment variables pass through, it's a trivial security hole, as GTK allows you to set environment variables that specify additional modules to dlopen(). -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From carlsonj@phorcys.east.sun.com Mon Nov 5 09:39:31 2007 Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5HdVqG009557 for ; Mon, 5 Nov 2007 09:39:31 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5HZEbW022209 for ; Mon, 5 Nov 2007 12:35:14 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA5HZEHk022206; Mon, 5 Nov 2007 12:35:14 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.21586.807006.687516@gargle.gargle.HOWL> Date: Mon, 5 Nov 2007 12:35:14 -0500 From: James Carlson To: psarc-ext@sac.sfbay.sun.com Subject: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 8890 Please review and submit any comments you have to me by 11/12/2007. Note to the project team and external observers: this is just a review of the written opinion itself, to make sure that it accurately reflects the issues discussed at the review. It's not intended as a means to reopen or reargue the case, nor does it require project team input or approval. If you do have issues with the project, please submit those separately (preferably as the topic of a new project for review). sun microsystems Systems Architecture Committee _________________________________________________________________ Subject: Add Wireshark 0.99.5 into Solaris Submitted by: Bart Smaalders File: PSARC/2007/334/opinion.ms Date: June 13th, 2007 Committee: James D. Carlson, Kais Belgaied, Mark Carl- son, Glenn Skinner, Gary Winiger. Product Approval Committee: Solaris PAC solaris-pac-opinion@sun.com 1. Summary This project integrates Wireshark (the current name for the open source project better known as "ethereal") into Solaris. Wireshark provides network packet capture and display facilities that are, in general, substantially better than those provided by our native snoop(1M) utility. 2. Decision & Precedence Information This project is approved as specified in reference [1-9]. The project may be delivered in a Minor release of Solaris via the SFW consolidation. 3. Interfaces The project exports the following interfaces. ______________________________________________________________________ | Interfaces Exported | |________________________|_________________|_________________________| |Interface | Classification | Comments | |________________________|_________________|_________________________| |/usr/share/wireshark/ | Project Private| Internal configuration | |/usr/lib/libwireshark.* | Project Private| Internal library | |/usr/lib/libwiretap.* | Project Private| Internal library | |/usr/lib/wireshark/ | Project Private| Plugins | |/usr/sbin/editcap | Unstable | Binary location | |/usr/sbin/capinfos | Unstable | Binary location | |/usr/sbin/text2pcap | Unstable | Binary location | |________________________|_________________|_________________________| PSARC/2007/334 Copyright 2007 Sun Microsystems - 2 - ______________________________________________________________________ | Interfaces Exported | |________________________|_________________|_________________________| |Interface | Classification | Comments | |________________________|_________________|_________________________| |/usr/sbin/tshark | Unstable | Binary location | |/usr/sbin/wireshark | Unstable | Binary location | |/usr/sbin/mergecap | Unstable | Binary location | |/usr/sbin/dumpcap | Unstable | Binary location | |Command lines and output| Volatile | | |Legacy file formats | Committed | | |SUNWwireshark | Unstable | Main package | |SUNWwiresharkgui | Unstable | Graphical interface | |libpcap.a | Project Private| Internal static library| |________________________|_________________|_________________________| The project imports the following interfaces. ______________________________________________________________________ | Interfaces Imported | |________________________|________________|__________________________| |Interface | Classification| Comments | |________________________|________________|__________________________| |/usr/share/applications/| Committed | LSARC 2006/462 | |/usr/share/pixmaps/ | Committed | | |libXfixes.so.1 | Volatile | PSARC 2004/318, 2006/702| |libXrandr.so.2 | Volatile | PSARC 2004/187 | |libXrender.so.1 | Volatile | LSARC 2001/125 | |libatk-1.0.so.0 | Stable | LSARC 2006/202 | |libcairo.so.2 | Volatile | LSARC 2006/202 | |libexpat.so.0 | Volatile | LSARC 2007/378 | |libfontconfig.so.1 | Volatile | | |libfreetype.so.6 | Volatile | LSARC 2002/291 | |libgcrypt.so.11 | Volatile | LSARC 2006/202 | |libgdk-x11-2.0.so.0 | Stable | LSARC 2006/202 | |libgdk_pixbuf-2.0.so.0 | Stable | LSARC 2006/202 | |libglib-2.0.so.0 | Stable | LSARC 2006/202 | |libgmodule-2.0.so.0 | Stable | LSARC 2006/202 | |libgnutls.so.11 | Volatile | LSARC 2006/202 | |libgobject-2.0.so.0 | Stable | LSARC 2006/202 | |libgpg-error.so.0 | Volatile | LSARC 2006/202 | |libgtk-x11-2.0.so.0 | Stable | LSARC 2006/202 | |libnetsnmp.so.5 | Stable | LSARC 2003/103 | |libpango-1.0.so.0 | Stable | LSARC 2006/202 | |libpangocairo-1.0.so.0 | Stable | LSARC 2006/202 | |libpangoft2-1.0.so.0 | Stable | LSARC 2006/202 | |libpng12.so.0 | Volatile | LSARC 2006/202 | |libz.so.1 | Committed | PSARC 2006/537 | |________________________|________________|__________________________| PSARC/2007/334 Copyright 2007 Sun Microsystems - 3 - 4. Opinion 4.1. File Format Commitment Several ARC members asked about the supported file formats. After discussion with the submitter, we agreed that the list of supported formats can be volatile, but that the project has a commitment to read old formats. 4.2. Volatile Libraries During review, one member noted that libcrypto and GNU TLS will require contracts. However, subsequent updates from the project team have removed the libcrypto usage, and the project intends to integrate via the SFW consolidation along with GNU TLS. Based on this update, no contracts have been presented. 4.3. Rights Profiles One member asked about rights profiles required to make tshark and wireshark work on Solaris. The project team updated the materials to include rights profile entries for these two programs in the "Network Management" profile with the least privilege necessary (net_rawaccess). 4.4. Snoop Obsolescence The integration of wireshark effectively makes legacy Solaris obsolete, and turns it into a burden both for sup- port and for future networking projects that may be required to provide both snoop and wireshark enhancements. Accordingly, several ARC members asked about the project team's intended direction for snoop. After discussing this issue with the project team, the ARC members agreed that the resource allocation required to obsolete snoop and remove it from the system is an issue that needs to be addressed by management. This issue led to the advisory information listed below. 5. Minority Opinion(s) None. 6. Advisory Information The ARC advises Solaris management and the Solaris PAC to raise the priority of an effort to remove the legacy snoop utility from Solaris and OpenSolaris. The ARC members plan to direct and approve future projects with the assumption that snoop removal is the intended direction, but may need to revisit this issue (likely at substantial expense and PSARC/2007/334 Copyright 2007 Sun Microsystems - 4 - inconvenience to other project teams) if prompt action is not taken. 7. Appendices 7.1. Appendix A: Technical Changes Required None. 7.2. Appendix B: Technical Changes Advised None. 7.3. Appendix C: Reference Material Unless stated otherwise, path names are relative to the case directory PSARC/2007/334. 1. Wireshark project description File: wireshark2.txt 2. capinfos(1) File: man/capinfos.1 3. dumpcap(1) File: man/dumpcap.1 4. editcap(1) File: man/editcap.1 5. mergecap(1) File: man/mergecap.1 6. text2pcap(1) File: man/text2pcap.1 7. tshark(1) File: man/tshark.1 8. wireshark-filter(4) File: man/wireshark-filter.4 9. wireshark(1) File: man/wireshark.1 PSARC/2007/334 Copyright 2007 Sun Microsystems From jbeck@eng.sun.com Mon Nov 5 09:47:46 2007 Received: from opal.eng.sun.com (opal [129.146.228.54]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5Hljvr010120 for ; Mon, 5 Nov 2007 09:47:45 -0800 (PST) Received: from opal (localhost [127.0.0.1]) by opal.eng.sun.com (8.14.2+Sun/8.14.2) with ESMTP id lA5Hi7ES225856; Mon, 5 Nov 2007 09:44:07 -0800 (PST) Message-Id: <200711051744.lA5Hi7ES225856@opal.eng.sun.com> X-Mailer: exmh version 2.7.2 2005-Jan-07 with nmh-1.0.3 To: James Carlson cc: psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris X-Image-URL: http://playground.sun.com/~jbeck/gif/Misc/john-face.jpg In-reply-to: Your message of "Mon, 05 Nov 2007 12:35:14 EST." <18223.21586.807006.687516@gargle.gargle.HOWL> References: <18223.21586.807006.687516@gargle.gargle.HOWL> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Mon, 05 Nov 2007 09:44:07 -0800 From: John Beck Status: RO Content-Length: 453 James> 4.4. Snoop Obsolescence James> The integration of wireshark effectively makes legacy Solaris obsolete, James> and turns it into a burden both for support and for future networking James> projects that may be required to provide both snoop and wireshark James> enhancements. Is the first part of the sentence ("legacy Solaris") a typo, or ARC short- hand with which I am not familiar? The rest looks fine. -- John http://blogs.sun.com/jbeck From scott.rotondo@sun.com Mon Nov 5 09:51:07 2007 Received: from domus.sfbay.sun.com (domus [10.6.64.11]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5Hp7CB010185 for ; Mon, 5 Nov 2007 09:51:07 -0800 (PST) Received: from [129.146.108.62] (vinifera.SFBay.Sun.COM [129.146.108.62]) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) with ESMTP id lA5HlSs10886; Mon, 5 Nov 2007 09:47:28 -0800 (PST) Message-ID: <472F5730.30302@sun.com> Date: Mon, 05 Nov 2007 09:47:28 -0800 From: Scott Rotondo User-Agent: Thunderbird 2.0.0.6 (X11/20071009) MIME-Version: 1.0 To: James Carlson CC: psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris References: <18223.21586.807006.687516@gargle.gargle.HOWL> In-Reply-To: <18223.21586.807006.687516@gargle.gargle.HOWL> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Status: RO Content-Length: 421 James Carlson wrote: > 4.4. Snoop Obsolescence > > The integration of wireshark effectively makes legacy > Solaris obsolete, and turns it into a burden both for sup- > port and for future networking projects that may be required > to provide both snoop and wireshark enhancements. I think the word "snoop" is missing in the introductory clause, unless this project makes all of Solaris obsolete. ;-) Scott From carlsonj@phorcys.east.sun.com Mon Nov 5 09:54:23 2007 Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5HsMh3010481 for ; Mon, 5 Nov 2007 09:54:22 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5Ho5F9022308; Mon, 5 Nov 2007 12:50:05 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA5Ho5Nh022305; Mon, 5 Nov 2007 12:50:05 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.22477.464163.728273@gargle.gargle.HOWL> Date: Mon, 5 Nov 2007 12:50:05 -0500 From: James Carlson To: John Beck , Scott Rotondo Cc: psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris In-Reply-To: <200711051744.lA5Hi7ES225856@opal.eng.sun.com> References: <18223.21586.807006.687516@gargle.gargle.HOWL> <472F5730.30302@sun.com> <200711051744.lA5Hi7ES225856@opal.eng.sun.com> X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 663 John Beck writes: > Is the first part of the sentence ("legacy Solaris") a typo, or ARC short- > hand with which I am not familiar? The rest looks fine. Scott Rotondo writes: > I think the word "snoop" is missing in the introductory clause, unless > this project makes all of Solaris obsolete. ;-) Also noted by others in private messages ... yes, the key word left out is "snoop." Wireshark is pretty magical, but not *that* much so. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From sommerfeld@sun.com Mon Nov 5 10:33:36 2007 Received: from dm-east-02.east.sun.com (dm-east-02.East.Sun.COM [129.148.13.5]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5IXaj2011424 for ; Mon, 5 Nov 2007 10:33:36 -0800 (PST) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by dm-east-02.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id lA5ITgJ1044390; Mon, 5 Nov 2007 13:29:42 -0500 (EST) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5ITfHi025784; Mon, 5 Nov 2007 13:29:41 -0500 (EST) Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris From: Bill Sommerfeld To: James Carlson Cc: John Beck , Scott Rotondo , psarc-ext@sac.sfbay.sun.com In-Reply-To: <18223.22477.464163.728273@gargle.gargle.HOWL> References: <18223.21586.807006.687516@gargle.gargle.HOWL> <472F5730.30302@sun.com> <200711051744.lA5Hi7ES225856@opal.eng.sun.com> <18223.22477.464163.728273@gargle.gargle.HOWL> Content-Type: text/plain Date: Mon, 05 Nov 2007 13:29:41 -0500 Message-Id: <1194287381.25598.24.camel@thunk> Mime-Version: 1.0 X-Mailer: Evolution 2.12.0 Content-Transfer-Encoding: 7bit Status: RO Content-Length: 864 On Mon, 2007-11-05 at 12:50 -0500, James Carlson wrote: > John Beck writes: > > Is the first part of the sentence ("legacy Solaris") a typo, or ARC short- > > hand with which I am not familiar? The rest looks fine. > Scott Rotondo writes: > > I think the word "snoop" is missing in the introductory clause, unless > > this project makes all of Solaris obsolete. ;-) > > Also noted by others in private messages ... yes, the key word left > out is "snoop." Wireshark is pretty magical, but not *that* much so. I generally find the word "legacy" somewhere between meaningless to overtly counterproductive in technical contexts. I don't believe it adds anything to the opinion and if anything it detracts from it. In this case: "The integration of wireshark effectively makes snoop obsolete" gets the same message across in many fewer words. - Bill From carlsonj@phorcys.east.sun.com Mon Nov 5 10:39:45 2007 Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5IdjkU011467 for ; Mon, 5 Nov 2007 10:39:45 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5IZSnR022786; Mon, 5 Nov 2007 13:35:28 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA5IZRFM022783; Mon, 5 Nov 2007 13:35:27 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.25199.938008.171432@gargle.gargle.HOWL> Date: Mon, 5 Nov 2007 13:35:27 -0500 From: James Carlson To: Bill Sommerfeld Cc: John Beck , Scott Rotondo , psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris In-Reply-To: <1194287381.25598.24.camel@thunk> References: <18223.21586.807006.687516@gargle.gargle.HOWL> <472F5730.30302@sun.com> <200711051744.lA5Hi7ES225856@opal.eng.sun.com> <18223.22477.464163.728273@gargle.gargle.HOWL> <1194287381.25598.24.camel@thunk> X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 407 Bill Sommerfeld writes: > In this case: > > "The integration of wireshark effectively makes snoop obsolete" > > gets the same message across in many fewer words. OK; will change. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From gww@eng.sun.com Mon Nov 5 11:05:07 2007 Received: from engmail3mpk.sfbay.Sun.COM (engmail3mpk [129.146.11.26]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5J57Lj012379 for ; Mon, 5 Nov 2007 11:05:07 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id lA5J1S4T004007; Mon, 5 Nov 2007 11:01:28 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id lA5J0TRh017676; Mon, 5 Nov 2007 11:00:29 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id lA5J0Ssb017675; Mon, 5 Nov 2007 11:00:28 -0800 (PST) Date: Mon, 5 Nov 2007 11:00:28 -0800 (PST) From: Gary Winiger Message-Id: <200711051900.lA5J0Ssb017675@marduk.eng.sun.com> To: psarc-ext@sac.sfbay.sun.com, james.d.carlson@sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris X-Sun-Charset: US-ASCII Status: RO Content-Length: 1670 > ______________________________________________________________________ > | Interfaces Exported | > |________________________|_________________|_________________________| > |Interface | Classification | Comments | > |________________________|_________________|_________________________| > |/usr/share/wireshark/ | Project Private| Internal configuration | > |/usr/lib/libwireshark.* | Project Private| Internal library | > |/usr/lib/libwiretap.* | Project Private| Internal library | > |/usr/lib/wireshark/ | Project Private| Plugins | > |/usr/sbin/editcap | Unstable | Binary location | > |/usr/sbin/capinfos | Unstable | Binary location | > |/usr/sbin/text2pcap | Unstable | Binary location | > |/usr/sbin/tshark | Unstable | Binary location | > |/usr/sbin/wireshark | Unstable | Binary location | > |/usr/sbin/mergecap | Unstable | Binary location | > |/usr/sbin/dumpcap | Unstable | Binary location | > |Command lines and output| Volatile | | > |Legacy file formats | Committed | | > |SUNWwireshark | Unstable | Main package | > |SUNWwiresharkgui | Unstable | Graphical interface | > |libpcap.a | Project Private| Internal static library| > |________________________|_________________|_________________________| Nit: Unstable isn't a current taxonomy. Uncommitted? Gary.. From carlsonj@phorcys.east.sun.com Mon Nov 5 11:19:40 2007 Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5JJdRt013105 for ; Mon, 5 Nov 2007 11:19:39 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5JFMDT023094; Mon, 5 Nov 2007 14:15:22 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA5JFMGX023091; Mon, 5 Nov 2007 14:15:22 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.27594.264914.62906@gargle.gargle.HOWL> Date: Mon, 5 Nov 2007 14:15:22 -0500 From: James Carlson To: Gary Winiger Cc: psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris In-Reply-To: <200711051900.lA5J0Ssb017675@marduk.eng.sun.com> References: <200711051900.lA5J0Ssb017675@marduk.eng.sun.com> X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 337 Gary Winiger writes: > Nit: Unstable isn't a current taxonomy. Uncommitted? Yes; that leaked through. Fixed. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Darren.Moffat@Sun.COM Mon Nov 5 14:07:54 2007 Received: from sfbaymail1sca.SFBay.Sun.COM (sfbaymail1sca [129.145.154.35]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5M7skf019985 for ; Mon, 5 Nov 2007 14:07:54 -0800 (PST) Received: from gmp-eb-mail-1.sun.com (gmp-eb-mail-1.EU.Sun.COM [192.18.6.21]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id lA5M4F2Y012778 for ; Mon, 5 Nov 2007 14:04:15 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id lA5M490B022901 for ; Mon, 5 Nov 2007 22:04:09 GMT Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JR100M01ZQQ0M00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for psarc-ext@sac.sfbay.sun.com; Mon, 05 Nov 2007 22:04:09 +0000 (GMT) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JR100KBPZYWZV30@fe-emea-10.sun.com> for psarc-ext@sac.sfbay.sun.com; Mon, 05 Nov 2007 22:04:08 +0000 (GMT) Date: Mon, 05 Nov 2007 22:04:08 +0000 From: Darren J Moffat Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <18223.21586.807006.687516@gargle.gargle.HOWL> Sender: Darren.Moffat@Sun.COM To: James Carlson Cc: psarc-ext@sac.sfbay.sun.com Message-id: <472F9358.7040602@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT References: <18223.21586.807006.687516@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.6 (X11/20070924) Status: RO Content-Length: 788 James Carlson wrote: > During review, one member noted that libcrypto and GNU TLS > will require contracts. However, subsequent updates from > the project team have removed the libcrypto usage, and the > project intends to integrate via the SFW consolidation along > with GNU TLS. Based on this update, no contracts have been > presented. Which project team ? The Solaris integration project team or upstream ? Is any originally reviewed functionality lost or changed now that OpenSSL's libcrypto isn't being used ? Also I don't believe that GNUtls is in SFW I thought it came via the JDS consolidation so does this case move which consolidation GNUtls is in and who owns it ? That impacts this case and at least one other in the pipeline for xVM. -- Darren J Moffat From carlsonj@phorcys.east.sun.com Mon Nov 5 14:30:35 2007 Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA5MUZPP022090 for ; Mon, 5 Nov 2007 14:30:35 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA5MQJAX024288; Mon, 5 Nov 2007 17:26:19 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.1+Sun/8.14.1/Submit) id lA5MQJGM024285; Mon, 5 Nov 2007 17:26:19 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <18223.39051.422660.413536@gargle.gargle.HOWL> Date: Mon, 5 Nov 2007 17:26:19 -0500 From: James Carlson To: Darren J Moffat Cc: psarc-ext@sac.sfbay.sun.com Subject: Re: opinion for review: 2007/334 Add Wireshark 0.99.5 into Solaris In-Reply-To: <472F9358.7040602@Sun.COM> References: <18223.21586.807006.687516@gargle.gargle.HOWL> <472F9358.7040602@Sun.COM> X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 1258 Darren J Moffat writes: > James Carlson wrote: > > During review, one member noted that libcrypto and GNU TLS > > will require contracts. However, subsequent updates from > > the project team have removed the libcrypto usage, and the > > project intends to integrate via the SFW consolidation along > > with GNU TLS. Based on this update, no contracts have been > > presented. > > Which project team ? The Solaris integration project team or upstream ? The Solaris project team (Bart) reported the updated list of libraries to me. > Is any originally reviewed functionality lost or changed now that > OpenSSL's libcrypto isn't being used ? None that I know of. > Also I don't believe that GNUtls is in SFW I thought it came via the JDS > consolidation so does this case move which consolidation GNUtls is in > and who owns it ? That impacts this case and at least one other in the > pipeline for xVM. Yes; this was noted privately by one other reviewer. I'm unclear on the issue and will have to chase it down. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Darren.Reed@sun.com Tue Nov 6 13:14:50 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA6LEogA025109 for ; Tue, 6 Nov 2007 13:14:50 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id lA6LBACK005219; Tue, 6 Nov 2007 13:11:10 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JR300I05S5VYX00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 06 Nov 2007 13:10:43 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JR300B6BS5T0Y20@nwk-avmta-1.sfbay.Sun.COM>; Tue, 06 Nov 2007 13:10:42 -0800 (PST) Received: from fe-apac-03.sun.com (fe-apac-03.sun.com [192.18.19.174] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id lA6LAeF2002467; Tue, 06 Nov 2007 21:10:40 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JR300201RDJEX00@mail-apac.sun.com> (original mail from Darren.Reed@Sun.COM); Wed, 07 Nov 2007 05:10:40 +0800 (SGT) Received: from [129.146.106.55] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JR3008FZS5QXDJ0@mail-apac.sun.com>; Wed, 07 Nov 2007 05:10:40 +0800 (SGT) Date: Tue, 06 Nov 2007 13:10:38 -0800 From: Darren Reed Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <466DC866.8000004@Sun.COM> Sender: Darren.Reed@sun.com To: Bart Smaalders Cc: James Carlson , PSARC-EXT@sun.com Message-id: <4730D84E.9070408@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-Accept-Language: en-au, en X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20060120 Status: RO Content-Length: 893 Bart Smaalders wrote: > James Carlson wrote: > ... > >>> There are two private libraries delivered into /usr/lib. >> >> >> I don't see libpcap. Where does that come from? >> > > I'm statically linking that into wireshark; it doesn't really want > (eg easily) build a dynamic version OOB. Until such time as we have > additional clients, static linking saves effort. While at first this seems worthwhile, this could be a gotcha. By delivering wireshark with its own libpcap, we're potentially introducing a bundle that will not work to the full extent that it should - see this thread on clearview-discuss: http://www.opensolaris.org/jive/thread.jspa?threadID=41287&tstart=15 While I don't want to suggest that this case should fix libpcap, it is perhaps worth thinking about whether or not there is benefit from delivering it as a .so instead of being staticly linked in. Darren From bart.smaalders@sun.com Tue Nov 6 13:52:53 2007 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lA6Lqr1Q026084 for ; Tue, 6 Nov 2007 13:52:53 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id lA6LnAGF019958; Tue, 6 Nov 2007 13:49:11 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JR30010DTXVJD00@brm-avmta-1.central.sun.com>; Tue, 06 Nov 2007 14:49:07 -0700 (MST) Received: from zion.sfbay.sun.com ([129.146.17.75]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JR3006WGTXU99D0@brm-avmta-1.central.sun.com>; Tue, 06 Nov 2007 14:49:06 -0700 (MST) Received: from [129.146.228.109] (cyber.SFBay.Sun.COM [129.146.228.109]) by zion.sfbay.sun.com (8.14.1+Sun/8.14.1) with ESMTP id lA6Ln51j675621; Tue, 06 Nov 2007 21:49:05 +0000 (GMT) Date: Tue, 06 Nov 2007 13:45:16 -0800 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <4730D84E.9070408@Sun.COM> To: Darren Reed Cc: James Carlson , PSARC-EXT@sun.com Message-id: <4730E06C.5030700@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <466DB35C.7000603@Sun.COM> <18029.47355.19540.85850@gargle.gargle.HOWL> <466DC866.8000004@Sun.COM> <4730D84E.9070408@Sun.COM> User-Agent: Thunderbird 2.0.0.4 (X11/20070723) Status: RO Content-Length: 1209 Darren Reed wrote: > Bart Smaalders wrote: > >> James Carlson wrote: >> ... >> >>>> There are two private libraries delivered into /usr/lib. >>> >>> >>> I don't see libpcap. Where does that come from? >>> >> >> I'm statically linking that into wireshark; it doesn't really want >> (eg easily) build a dynamic version OOB. Until such time as we have >> additional clients, static linking saves effort. > > > While at first this seems worthwhile, this could be a gotcha. > > By delivering wireshark with its own libpcap, we're potentially > introducing a bundle that will not work to the full extent that it > should - see this thread on clearview-discuss: > > http://www.opensolaris.org/jive/thread.jspa?threadID=41287&tstart=15 > > While I don't want to suggest that this case should fix libpcap, > it is perhaps worth thinking about whether or not there is benefit > from delivering it as a .so instead of being staticly linked in. > > Darren > I'm willing to entertain this; the change isn't difficult. At the time (mid summer), no other likely users of libpcap requested otherwise. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts From Sebastien.Roy@sun.com Tue Apr 29 13:16:13 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m3TKGCke019315 for ; Tue, 29 Apr 2008 13:16:12 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m3TKCJ27004622 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Tue, 29 Apr 2008 21:12:26 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K0300B0BS4PQA00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 29 Apr 2008 14:12:25 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K0300IDWS4OVZF0@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 29 Apr 2008 14:12:24 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m3TKCOgg011937 for ; Tue, 29 Apr 2008 20:12:24 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K0300G01QQBTB00@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 29 Apr 2008 14:12:24 -0600 (MDT) Received: from [129.148.174.103] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K0300LJQS4M4H30@mail-amer.sun.com>; Tue, 29 Apr 2008 14:12:22 -0600 (MDT) Date: Tue, 29 Apr 2008 16:12:21 -0400 From: Sebastien Roy Subject: 2007/334 Add Wireshark 0.99.5 into Solaris (libpcap update) Sender: Sebastien.Roy@sun.com To: psarc-ext Cc: barts@cyber.eng.sun.com, sagun shakya Message-id: <1209499941.3986.35.camel@strat> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.0 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 264 The following case: PSARC 2008/288 Intgrate libpcap ... updates this case. Since libpcap will be delivered by 2008/288 as a shared object, this case does not need to do so. As such, this case can simply import the libpcap library exported by 2008/288. -Seb From bart.smaalders@Sun.COM Tue Apr 29 13:32:02 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m3TKW2b4020294 for ; Tue, 29 Apr 2008 13:32:02 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m3TKW0RR026783; Tue, 29 Apr 2008 13:32:01 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K0300D01T1B5Z00@brm-avmta-1.central.sun.com>; Tue, 29 Apr 2008 14:31:59 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K0300B6OT1AVG10@brm-avmta-1.central.sun.com>; Tue, 29 Apr 2008 14:31:59 -0600 (MDT) Received: from [129.146.228.109] (cyber.SFBay.Sun.COM [129.146.228.109]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m3TKVwjH709824; Tue, 29 Apr 2008 13:31:58 -0700 (PDT) Date: Tue, 29 Apr 2008 13:31:58 -0700 From: Bart Smaalders Subject: Re: 2007/334 Add Wireshark 0.99.5 into Solaris (libpcap update) In-reply-to: <1209499941.3986.35.camel@strat> To: Sebastien Roy Cc: psarc-ext , barts@cyber.eng.Sun.COM, sagun shakya Message-id: <481785BE.3010609@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1209499941.3986.35.camel@strat> User-Agent: Thunderbird 2.0.0.12 (X11/20080310) Status: RO Content-Length: 507 Sebastien Roy wrote: > The following case: > > PSARC 2008/288 Intgrate libpcap > > ... updates this case. Since libpcap will be delivered by 2008/288 as a > shared object, this case does not need to do so. As such, this case can > simply import the libpcap library exported by 2008/288. > > -Seb > > Thanks; changes noted. -= Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts "You will contribute more with mercurial than with thunderbird." From bart.smaalders@sun.com Wed Apr 1 17:47:47 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n320lk9E026948 for ; Wed, 1 Apr 2009 17:47:46 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n320lit4022945; Thu, 2 Apr 2009 01:47:45 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHG002057JK5I00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 01 Apr 2009 17:47:44 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHG00LW97JJON50@nwk-avmta-1.sfbay.Sun.COM>; Wed, 01 Apr 2009 17:47:44 -0700 (PDT) Received: from [129.146.228.109] (cyber.SFBay.Sun.COM [129.146.228.109]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n320lhwH356283; Wed, 01 Apr 2009 17:47:43 -0700 (PDT) Date: Wed, 01 Apr 2009 17:47:43 -0700 From: Bart Smaalders Subject: re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris To: PSARC-EXT@sun.com Cc: Petr Sumbera , wireshark-team@sun.com Message-id: <49D40B2F.6040206@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_BYY+zWR8zqvoz5aKShwaBQ)" X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.18 (X11/20090224) Status: RO Content-Length: 25164 This is a multi-part message in MIME format. --Boundary_(ID_BYY+zWR8zqvoz5aKShwaBQ) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT I have some updates for this case; due to workload issues this project was delayed integrating into Solaris. The changes are: * Project will deliver current Wireshark version 1.0.6 rather than 0.99.5. * New binary: usr/sbin/rawshark (man page attached) Rawshark reads a stream of packets from a file or pipe, and prints a line describing its output, followed by a set of matching fields for each packet on stdout. * Project will deliver package SUNWwireshark and SUNWwiresharkr (root package) to deliver profiles in /etc/security/exec_attr (added dumpcap): Network Management:solaris:cmd:::/usr/sbin/tshark:privs=net_rawaccess Network Management:solaris:cmd:::/usr/sbin/wireshark:privs=net_rawaccess Network Management:solaris:cmd:::/usr/sbin/dumpcap:privs=net_rawaccess * Modified list of imported interfaces (based on elfdump -d output). It differs against the one from 2007/334/opinion.txt as followed: > |libX11.so.4 | | | > |libXext.so.0 | Committed | PSARC/2008/194 | > |libXcomposite.so.1 | Volatile | PSARC/2007/240 | > |libXcursor.so.1 | Uncommitted | LSARC/2007/491 | > |libXdamage.so.1 | Volatile | LSARC 2003/506 | 3a9 > |libXi.so.5 | | | 5a12 > |libtasn1.so.3 | Volatile | LSARC/2008/390 | 8d14 < |libexpat.so.0 | Volatile | LSARC 2007/378 | 13a20 > |libgio-2.0.so.0 | Volatile | LSARC/2007/520 | 16c23 < |libgnutls.so.11 | Volatile | LSARC 2006/202 | --- > |libgnutls.so.26 | Volatile | LSARC/2008/341 | 18a26 > |libgthread-2.0.so.0 | | | 19a28 > |libkrb5.so.1 | External | PSARC/2006/027 | 20a30 > |libmlib.so.2 | Evolving | LSARC/2005/137 | 24c34,35 < |libpng12.so.0 | Volatile | LSARC 2006/202 | --- > |libpcap.so | Uncommitted | PSARC/2008/288 | > |libpcre.so.0 | Uncommitted | PSARC/2007/164 | If anyone has any comments, please chime in. We can update the opinion text if desired, or if another mechanism is better please let me know. Attached please find new rawshark man page and list of imported interfaces. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts "You will contribute more with mercurial than with thunderbird." --Boundary_(ID_BYY+zWR8zqvoz5aKShwaBQ) Content-type: text/plain; name=rawshark.1 Content-transfer-encoding: 7BIT Content-disposition: inline; filename=rawshark.1 '\" t .\" .\" Modified for Solaris to to add the Solaris stability classification, .\" and to add a note about source availability. .\" .\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14 .\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. | will give a .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to .\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C' .\" expand to `' in nroff, nothing in troff, for use with C<>. .tr \(*W-|\(bv\*(Tr .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "RAWSHARK 1" .TH RAWSHARK 1 "2009-02-06" "1.0.6" "The Wireshark Network Analyzer" .SH "NAME" rawshark \- Dump and analyze raw libpcap data .SH "SYNOPSYS" .IX Header "SYNOPSYS" \&\fBrawshark\fR [\ \fB\-d\fR\ |\ ] [\ \fB\-F\fR\ \ ] [\ \fB\-h\fR\ ] [\ \fB\-l\fR\ ] [\ \fB\-n\fR\ ] [\ \fB\-N\fR\ \ ] [\ \fB\-o\fR\ \ ]\ ... [\ \fB\-r\fR\ \ ] [\ \fB\-R\fR\ \ ] [\ \fB\-S\fR\ \ ] [\ \fB\-t\fR\ ad|a|r|d|e\ ] [\ \fB\-v\fR\ ] .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBRawshark\fR reads a stream of packets from a file or pipe, and prints a line describing its output, followed by a set of matching fields for each packet on stdout. .SH "INPUT" .IX Header "INPUT" Unlike \fBTShark\fR, \fBRawshark\fR makes no assumptions about encapsulation or input. The \fB\-d\fR and \fB\-r\fR flags must be specified in order for it to run. One or more \fB\-F\fR flags should be specified in order for the output to be useful. The other flags listed above follow the same conventions as \&\fBWireshark\fR and \fBTShark\fR. .PP \&\fBRawshark\fR expects input records with the following format. Note that this matches the pcap_pkthdr struct and packet data used in libpcap. .PP .Vb 6 \& struct rawshark_rec_s { \& struct timeval ts; /* Time stamp */ \& uint32_t caplen; /* Length of the packet buffer */ \& uint32_t len; /* "On the wire" length of the packet */ \& uint8_t *data; /* Packet data */ \& }; .Ve .SH "OUTPUT" .IX Header "OUTPUT" If one or more fields are specified via the \fB\-F\fR flag, \fBRawshark\fR prints the number, field type, and display format for each field on the first line as \*(L"packet number\*(R" 0. For each record, the packet number, matching fields, and a \*(L"1\*(R" or \*(L"0\*(R" are printed to indicate if the field matched any supplied display filter. A \*(L"\-\*(R" is used to signal the end of a field description and at the end of each packet line. For example, the flags \fB\-F ip.src \-F dns.qry.type\fR might generate the following output: .PP .Vb 5 \& 0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX - \& 1 1="1" 0="192.168.77.10" 1 - \& 2 1="1" 0="192.168.77.250" 1 - \& 3 0="192.168.77.10" 1 - \& 4 0="74.125.19.104" 1 - .Ve .PP Note that packets 1 and 2 are \s-1DNS\s0 queries, and 3 and 4 are not. Adding \fB\-R \*(L"not dns\*(R"\fR still prints each line, but there's an indication that packets 1 and 2 didn't pass the filter: .PP .Vb 5 \& 0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX - \& 1 1="1" 0="192.168.77.10" 0 - \& 2 1="1" 0="192.168.77.250" 0 - \& 3 0="192.168.77.10" 1 - \& 4 0="74.125.19.104" 1 - .Ve .PP Also note that the output may be in any order, and that multiple matching fields might be displayed. .SH "OPTIONS" .IX Header "OPTIONS" .IP "\-d " 4 .IX Item "-d " Specify how the packet data should be dissected. The encapsulation is of the form \fItype\fR\fB:\fR\fIvalue\fR, where \fItype\fR is one of: .Sp \&\fBencap\fR:\fIname\fR Packet data should be dissected using the libpcap data link type \fIname\fR, e.g. \fBencap:EN10MB\fR for Ethernet. .Sp \&\fBencap\fR:\fIname\fR Packet data should be dissected using the libpcap data link type (\s-1DLT\s0) \fIname\fR, e.g. \fBencap:EN10MB\fR for Ethernet. Names are converted using \fIpcap_datalink_name_to_val()\fR. .Sp \&\fBencap\fR:\fInumber\fR Packet data should be dissected using the libpcap \s-1DLT\s0 \&\fInumber\fR, e.g. \fBencap:105\fR for raw \s-1IEEE\s0 802.11. A complete list of DLTs can be found in pcap\-bpf.h in the libpcap sources. .Sp \&\fBproto\fR:\fIprotocol\fR Packet data should be passed to the specified Wireshark protocol dissector, e.g. \fBproto:http\fR for \s-1HTTP\s0 data. .IP "\-F " 4 .IX Item "-F " Add the matching field to the output. Fields are any valid display filter field. More than one \fB\-F\fR flag may be specified, and each field can match multiple times in a given packet. A single field may be specified per \fB\-F\fR flag. If you want to apply a display filter, use the \fB\-R\fR flag. .IP "\-h" 4 .IX Item "-h" Print the version and options and exits. .IP "\-l" 4 .IX Item "-l" Flush the standard output after the information for each packet is printed. (This is not, strictly speaking, line-buffered if \fB\-V\fR was specified; however, it is the same as line-buffered if \fB\-V\fR wasn't specified, as only one line is printed for each packet, and, as \fB\-l\fR is normally used when piping a live capture to a program or script, so that output for a packet shows up as soon as the packet is seen and dissected, it should work just as well as true line\-buffering. We do this as a workaround for a deficiency in the Microsoft Visual \*(C+ C library.) .Sp This may be useful when piping the output of \fBTShark\fR to another program, as it means that the program to which the output is piped will see the dissected data for a packet as soon as \fBTShark\fR sees the packet and generates that output, rather than seeing it only when the standard output buffer containing that data fills up. .IP "\-n" 4 .IX Item "-n" Disable network object name resolution (such as hostname, \s-1TCP\s0 and \s-1UDP\s0 port names), the \fB\-N\fR flag might override this one. .IP "\-N " 4 .IX Item "-N " Turn on name resolving only for particular types of addresses and port numbers, with name resolving for other types of addresses and port numbers turned off. This flag overrides \fB\-n\fR if both \fB\-N\fR and \fB\-n\fR are present. If both \fB\-N\fR and \fB\-n\fR flags are not present, all name resolutions are turned on. .Sp The argument is a string that may contain the letters: .Sp \&\fBm\fR to enable \s-1MAC\s0 address resolution .Sp \&\fBn\fR to enable network address resolution .Sp \&\fBt\fR to enable transport-layer port number resolution .Sp \&\fBC\fR to enable concurrent (asynchronous) \s-1DNS\s0 lookups .IP "\-o :" 4 .IX Item "-o :" Set a preference value, overriding the default value and any value read from a preference file. The argument to the option is a string of the form \fIprefname\fR\fB:\fR\fIvalue\fR, where \fIprefname\fR is the name of the preference (which is the same name that would appear in the preference file), and \fIvalue\fR is the value to which it should be set. .IP "\-r " 4 .IX Item "-r " Read packet data from \fIinput source\fR. It can be a regular file or pipe, and must be have the record format specified above. .IP "\-R " 4 .IX Item "-R " Cause the specified filter (which uses the syntax of read/display filters, rather than that of capture filters) to be applied before printing the output. Packets not matching the filter are discarded rather than being printed or written. .IP "\-s " 4 .IX Item "-s " Set the default snapshot length to use when capturing live data. No more than \fIsnaplen\fR bytes of each network packet will be read into memory, or saved to disk. .IP "\-S" 4 .IX Item "-S" Use the specified format string to print each field. The following formats are supported: .RS 4 .Sp .RS 4 \&\fB%D\fR Field name or description, e.g. \*(L"Type\*(R" for dns.qry.type \&\fB%N\fR Base 10 numeric value of the field. \&\fB%S\fR String value of the field. .RE .RE .RS 4 .Sp For something similar to Wireshark's standard display (\*(L"Type: A (1)\*(R") you could use \fB%D: \f(CB%S\fB (%N)\fR. .RE .IP "\-t ad|a|r|d|e" 4 .IX Item "-t ad|a|r|d|e" Set the format of the packet timestamp printed in summary lines, the default is relative. The format can be one of: .Sp \&\fBad\fR absolute with date: The absolute date and time is the actual time and date the packet was captured .Sp \&\fBa\fR absolute: The absolute time is the actual time the packet was captured, with no date displayed .Sp \&\fBr\fR relative: The relative time is the time elapsed between the first packet and the current packet .Sp \&\fBd\fR delta: The delta time is the time since the previous packet was captured .Sp \&\fBe\fR epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00) .IP "\-v" 4 .IX Item "-v" Print the version and exit. .SH "READ FILTER SYNTAX" .IX Header "READ FILTER SYNTAX" For a complete table of protocol and protocol fields that are filterable in \fBTShark\fR see the \fIwireshark\-filter\fR\|(4) manual page. .SH "FILES" .IX Header "FILES" These files contains various \fBWireshark\fR configuration values. .IP "Preferences" 4 .IX Item "Preferences" The \fIpreferences\fR files contain global (system\-wide) and personal preference settings. If the system-wide preference file exists, it is read first, overriding the default settings. If the personal preferences file exists, it is read next, overriding any previous values. Note: If the command line option \fB\-o\fR is used (possibly more than once), it will in turn override values from the preferences files. .Sp The preferences settings are in the form \fIprefname\fR\fB:\fR\fIvalue\fR, one per line, where \fIprefname\fR is the name of the preference and \fIvalue\fR is the value to which it should be set; white space is allowed between \fB:\fR and \&\fIvalue\fR. A preference setting can be continued on subsequent lines by indenting the continuation lines with white space. A \fB#\fR character starts a comment that runs to the end of the line: .Sp .Vb 3 \& # Capture in promiscuous mode? \& # TRUE or FALSE (case-insensitive). \& capture.prom_mode: TRUE .Ve .Sp The global preferences file is looked for in the \fIwireshark\fR directory under the \fIshare\fR subdirectory of the main installation directory (for example, \fI/usr/local/share/wireshark/preferences\fR) on UNIX-compatible systems, and in the main installation directory (for example, \&\fIC:\eProgram Files\eWireshark\epreferences\fR) on Windows systems. .Sp The personal preferences file is looked for in \&\fI$HOME/.wireshark/preferences\fR on UNIX-compatible systems and \fI%APPDATA%\eWireshark\epreferences\fR (or, if \&\f(CW%APPDATA\fR% isn't defined, \fI%USERPROFILE%\eApplication Data\eWireshark\epreferences\fR) on Windows systems. .IP "Disabled (Enabled) Protocols" 4 .IX Item "Disabled (Enabled) Protocols" The \fIdisabled_protos\fR files contain system-wide and personal lists of protocols that have been disabled, so that their dissectors are never called. The files contain protocol names, one per line, where the protocol name is the same name that would be used in a display filter for the protocol: .Sp .Vb 2 \& http \& tcp # a comment .Ve .Sp The global \fIdisabled_protos\fR file uses the same directory as the global preferences file. .Sp The personal \fIdisabled_protos\fR file uses the same directory as the personal preferences file. .IP "Name Resolution (hosts)" 4 .IX Item "Name Resolution (hosts)" If the personal \fIhosts\fR file exists, it is used to resolve IPv4 and IPv6 addresses before any other attempts are made to resolve them. The file has the standard \fIhosts\fR file syntax; each line contains one \s-1IP\s0 address and name, separated by whitespace. The same directory as for the personal preferences file is used. .IP "Name Resolution (ethers)" 4 .IX Item "Name Resolution (ethers)" The \fIethers\fR files are consulted to correlate 6\-byte hardware addresses to names. First the personal \fIethers\fR file is tried and if an address is not found there the global \fIethers\fR file is tried next. .Sp Each line contains one hardware address and name, separated by whitespace. The digits of the hardware address are separated by colons (:), dashes (\-) or periods (.). The same separator character must be used consistently in an address. The following three lines are valid lines of an \fIethers\fR file: .Sp .Vb 3 \& ff:ff:ff:ff:ff:ff Broadcast \& c0-00-ff-ff-ff-ff TR_broadcast \& 00.00.00.00.00.00 Zero_broadcast .Ve .Sp The global \fIethers\fR file is looked for in the \fI/etc\fR directory on UNIX-compatible systems, and in the main installation directory (for example, \fIC:\eProgram Files\eWireshark\fR) on Windows systems. .Sp The personal \fIethers\fR file is looked for in the same directory as the personal preferences file. .IP "Name Resolution (manuf)" 4 .IX Item "Name Resolution (manuf)" The \fImanuf\fR file is used to match the 3\-byte vendor portion of a 6\-byte hardware address with the manufacturer's name; it can also contain well-known \&\s-1MAC\s0 addresses and address ranges specified with a netmask. The format of the file is the same as the \fIethers\fR files, except that entries of the form: .Sp .Vb 1 \& 00:00:0C Cisco .Ve .Sp can be provided, with the 3\-byte \s-1OUI\s0 and the name for a vendor, and entries such as: .Sp .Vb 1 \& 00-00-0C-07-AC/40 All-HSRP-routers .Ve .Sp can be specified, with a \s-1MAC\s0 address and a mask indicating how many bits of the address must match. The above entry, for example, has 40 significant bits, or 5 bytes, and would match addresses from 00\-00\-0C\-07\-AC\-00 through 00\-00\-0C\-07\-AC\-FF. The mask need not be a multiple of 8. .Sp The \fImanuf\fR file is looked for in the same directory as the global preferences file. .IP "Name Resolution (ipxnets)" 4 .IX Item "Name Resolution (ipxnets)" The \fIipxnets\fR files are used to correlate 4\-byte \s-1IPX\s0 network numbers to names. First the global \fIipxnets\fR file is tried and if that address is not found there the personal one is tried next. .Sp The format is the same as the \fIethers\fR file, except that each address is four bytes instead of six. Additionally, the address can be represented as a single hexadecimal number, as is more common in the \s-1IPX\s0 world, rather than four hex octets. For example, these four lines are valid lines of an \fIipxnets\fR file: .Sp .Vb 4 \& C0.A8.2C.00 HR \& c0-a8-1c-00 CEO \& 00:00:BE:EF IT_Server1 \& 110f FileServer3 .Ve .Sp The global \fIipxnets\fR file is looked for in the \fI/etc\fR directory on UNIX-compatible systems, and in the main installation directory (for example, \fIC:\eProgram Files\eWireshark\fR) on Windows systems. .Sp The personal \fIipxnets\fR file is looked for in the same directory as the personal preferences file. .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fIwireshark\-filter\fR\|(4), \fIwireshark\fR\|(1), \fItshark\fR\|(1), \fIeditcap\fR\|(1), \fItcpdump\fR\|(8), \&\fIpcap\fR\|(3), \fIdumpcap\fR\|(1), \fItext2pcap\fR\|(1) .SH "NOTES" .IX Header "NOTES" \&\fBRawshark\fR is part of the \fBWireshark\fR distribution. The latest version of \&\fBWireshark\fR can be found at . .PP \&\s-1HTML\s0 versions of the Wireshark project man pages are available at: . .SH "AUTHORS" .IX Header "AUTHORS" \&\fBRawshark\fR uses the same packet dissection code that \fBWireshark\fR does, as well as using many other modules from \fBWireshark\fR; see the list of authors in the \fBWireshark\fR man page for a list of authors of that code. .\" Begin Sun update .SH ATTRIBUTES See .BR attributes (5) for descriptions of the following attributes: .sp .TS box; cbp-1 | cbp-1 l | l . ATTRIBUTE TYPE ATTRIBUTE VALUE = Availability SUNWwireshark = Interface Stability Uncommitted .TE .PP .SH NOTES Source for Wireshark is available on http://opensolaris.org. .\" End Sun update --Boundary_(ID_BYY+zWR8zqvoz5aKShwaBQ) Content-type: text/plain; name=imported.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=imported.txt |/usr/share/applications/| Committed | LSARC 2006/462 | |/usr/share/pixmaps/ | Committed | | |libX11.so.4 | | | |libXext.so.0 | Committed | PSARC/2008/194 | |libXcomposite.so.1 | Volatile | PSARC/2007/240 | |libXcursor.so.1 | Uncommitted | LSARC/2007/491 | |libXdamage.so.1 | Volatile | LSARC 2003/506 | |libXfixes.so.1 | Volatile | PSARC 2004/318, 2006/702| |libXi.so.5 | | | |libXrandr.so.2 | Volatile | PSARC 2004/187 | |libXrender.so.1 | Volatile | LSARC 2001/125 | |libtasn1.so.3 | Volatile | LSARC/2008/390 | |libatk-1.0.so.0 | Stable | LSARC 2006/202 | |libcairo.so.2 | Volatile | LSARC 2006/202 | |libfontconfig.so.1 | Volatile | | |libfreetype.so.6 | Volatile | LSARC 2002/291 | |libgcrypt.so.11 | Volatile | LSARC 2006/202 | |libgdk-x11-2.0.so.0 | Stable | LSARC 2006/202 | |libgdk_pixbuf-2.0.so.0 | Stable | LSARC 2006/202 | |libgio-2.0.so.0 | Volatile | LSARC/2007/520 | |libglib-2.0.so.0 | Stable | LSARC 2006/202 | |libgmodule-2.0.so.0 | Stable | LSARC 2006/202 | |libgnutls.so.26 | Volatile | LSARC/2008/341 | |libgobject-2.0.so.0 | Stable | LSARC 2006/202 | |libgpg-error.so.0 | Volatile | LSARC 2006/202 | |libgthread-2.0.so.0 | | | |libgtk-x11-2.0.so.0 | Stable | LSARC 2006/202 | |libkrb5.so.1 | External | PSARC/2006/027 | |libnetsnmp.so.5 | Stable | LSARC 2003/103 | |libmlib.so.2 | Evolving | LSARC/2005/137 | |libpango-1.0.so.0 | Stable | LSARC 2006/202 | |libpangocairo-1.0.so.0 | Stable | LSARC 2006/202 | |libpangoft2-1.0.so.0 | Stable | LSARC 2006/202 | |libpcap.so | Uncommitted | PSARC/2008/288 | |libpcre.so.0 | Uncommitted | PSARC/2007/164 | |libz.so.1 | Committed | PSARC 2006/537 | --Boundary_(ID_BYY+zWR8zqvoz5aKShwaBQ)-- From gdamore@sun.com Wed Apr 1 18:00:09 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n32108WW028007 for ; Wed, 1 Apr 2009 18:00:08 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n32103W9018487; Thu, 2 Apr 2009 09:00:07 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHG0030V845SS00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 01 Apr 2009 18:00:05 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHG00L8O845ON80@nwk-avmta-1.sfbay.Sun.COM>; Wed, 01 Apr 2009 18:00:05 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n32105Jo020883; Wed, 01 Apr 2009 18:00:05 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KHG000007Z01V00@fe-sfbay-10.sun.com>; Wed, 01 Apr 2009 18:00:05 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KHG00C56844O640@fe-sfbay-10.sun.com>; Wed, 01 Apr 2009 18:00:05 -0700 (PDT) Date: Wed, 01 Apr 2009 18:00:04 -0700 From: "Garrett D'Amore" Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <49D40B2F.6040206@Sun.COM> Sender: Garrett.Damore@sun.com To: Bart Smaalders Cc: PSARC-EXT@sun.com, Petr Sumbera , wireshark-team@sun.com Message-id: <49D40E14.8000008@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 2662 Seems obvious enough not to need a new case, at least to me. --Garrett Bart Smaalders wrote: > I have some updates for this case; due to workload issues > this project was delayed integrating into Solaris. > > The changes are: > > * Project will deliver current Wireshark version 1.0.6 rather > than 0.99.5. > > * New binary: usr/sbin/rawshark (man page attached) > > Rawshark reads a stream of packets from a file or pipe, and > prints a line describing its output, followed by a set of > matching fields for each packet on stdout. > > > * Project will deliver package SUNWwireshark and > SUNWwiresharkr (root package) to deliver profiles in > /etc/security/exec_attr (added dumpcap): > > Network Management:solaris:cmd:::/usr/sbin/tshark:privs=net_rawaccess > Network Management:solaris:cmd:::/usr/sbin/wireshark:privs=net_rawaccess > Network Management:solaris:cmd:::/usr/sbin/dumpcap:privs=net_rawaccess > > * Modified list of imported interfaces (based on elfdump -d output). > It differs against the one from 2007/334/opinion.txt as followed: > > > |libX11.so.4 | | | > > |libXext.so.0 | Committed | PSARC/2008/194 | > > |libXcomposite.so.1 | Volatile | PSARC/2007/240 | > > |libXcursor.so.1 | Uncommitted | LSARC/2007/491 | > > |libXdamage.so.1 | Volatile | LSARC 2003/506 | > 3a9 > > |libXi.so.5 | | | > 5a12 > > |libtasn1.so.3 | Volatile | LSARC/2008/390 | > 8d14 > < |libexpat.so.0 | Volatile | LSARC 2007/378 | > 13a20 > > |libgio-2.0.so.0 | Volatile | LSARC/2007/520 | > 16c23 > < |libgnutls.so.11 | Volatile | LSARC 2006/202 | > --- > > |libgnutls.so.26 | Volatile | LSARC/2008/341 | > 18a26 > > |libgthread-2.0.so.0 | | | > 19a28 > > |libkrb5.so.1 | External | PSARC/2006/027 | > 20a30 > > |libmlib.so.2 | Evolving | LSARC/2005/137 | > 24c34,35 > < |libpng12.so.0 | Volatile | LSARC 2006/202 | > --- > > |libpcap.so | Uncommitted | PSARC/2008/288 | > > |libpcre.so.0 | Uncommitted | PSARC/2007/164 | > > > If anyone has any comments, please chime in. We can update the opinion > text if desired, or if another mechanism is better please let me know. > > Attached please find new rawshark man page and list of imported > interfaces. > > - Bart From Sebastien.Roy@sun.com Wed Apr 1 18:08:28 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n3218Sho028245 for ; Wed, 1 Apr 2009 18:08:28 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n3218RIC009242; Wed, 1 Apr 2009 19:08:28 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHG001078I3HS00@nwk-avmta-2.sfbay.sun.com>; Wed, 01 Apr 2009 18:08:27 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHG00LNF8I39C30@nwk-avmta-2.sfbay.sun.com>; Wed, 01 Apr 2009 18:08:27 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n3218RbA000768; Thu, 02 Apr 2009 01:08:27 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KHG003008BC8200@mail-amer.sun.com>; Wed, 01 Apr 2009 19:08:27 -0600 (MDT) Received: from [192.168.1.5] ([unknown] [173.76.18.185]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KHG00B5N8I1BYE0@mail-amer.sun.com>; Wed, 01 Apr 2009 19:08:26 -0600 (MDT) Date: Wed, 01 Apr 2009 21:08:24 -0400 From: Sebastien Roy Subject: re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <49D40B2F.6040206@Sun.COM> Sender: Sebastien.Roy@sun.com To: Bart Smaalders Cc: PSARC-EXT@sun.com, Petr Sumbera , wireshark-team@sun.com Message-id: <1238634504.4272.2.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.24.2 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> Status: RO Content-Length: 237 On Wed, 2009-04-01 at 17:47 -0700, Bart Smaalders wrote: > * Project will deliver current Wireshark version 1.0.6 rather > than 0.99.5. AFAIK, Wireshark 1.0.6 requires libpcap >= 1.0.0 (we currently have 0.9.8). Am I mistaken? -Seb From bart.smaalders@Sun.COM Wed Apr 1 18:10:43 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n321Ag3x028410 for ; Wed, 1 Apr 2009 18:10:43 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n321AYoc007341; Thu, 2 Apr 2009 02:10:41 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHG005018LRQB00@brm-avmta-1.central.sun.com>; Wed, 01 Apr 2009 19:10:40 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHG00ICT8LRM150@brm-avmta-1.central.sun.com>; Wed, 01 Apr 2009 19:10:39 -0600 (MDT) Received: from [129.146.228.109] (cyber.SFBay.Sun.COM [129.146.228.109]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n321AcMi360216; Wed, 01 Apr 2009 18:10:39 -0700 (PDT) Date: Wed, 01 Apr 2009 18:10:38 -0700 From: Bart Smaalders Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1238634504.4272.2.camel@seb> To: Sebastien Roy Cc: PSARC-EXT@Sun.COM, Petr Sumbera , wireshark-team@Sun.COM Message-id: <49D4108E.6050108@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> <1238634504.4272.2.camel@seb> User-Agent: Thunderbird 2.0.0.18 (X11/20090224) Status: RO Content-Length: 546 Sebastien Roy wrote: > On Wed, 2009-04-01 at 17:47 -0700, Bart Smaalders wrote: >> * Project will deliver current Wireshark version 1.0.6 rather >> than 0.99.5. > > AFAIK, Wireshark 1.0.6 requires libpcap >= 1.0.0 (we currently have > 0.9.8). Am I mistaken? > > -Seb > > Project team (people actually doing the work; I'm pushing paper on this one) is on cc list... - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts "You will contribute more with mercurial than with thunderbird." From Sebastien.Roy@sun.com Thu Apr 2 07:12:51 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n32ECoSF017574 for ; Thu, 2 Apr 2009 07:12:50 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n32ECnJG026958; Thu, 2 Apr 2009 07:12:50 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHH002298TDOA00@nwk-avmta-2.sfbay.sun.com>; Thu, 02 Apr 2009 07:12:49 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHH00FCS8TCFHB0@nwk-avmta-2.sfbay.sun.com>; Thu, 02 Apr 2009 07:12:49 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n32ECm3R012758; Thu, 02 Apr 2009 14:12:48 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KHH00C007UDVH00@mail-amer.sun.com>; Thu, 02 Apr 2009 08:12:48 -0600 (MDT) Received: from [192.168.1.5] ([unknown] [173.76.18.185]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KHH00LPQ8T8JWE0@mail-amer.sun.com>; Thu, 02 Apr 2009 08:12:45 -0600 (MDT) Date: Thu, 02 Apr 2009 10:12:44 -0400 From: Sebastien Roy Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <49D4108E.6050108@Sun.COM> Sender: Sebastien.Roy@sun.com To: Bart Smaalders Cc: PSARC-EXT@sun.com, Petr Sumbera , wireshark-team@sun.com Message-id: <1238681564.4272.23.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.24.2 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> <1238634504.4272.2.camel@seb> <49D4108E.6050108@Sun.COM> Status: RO Content-Length: 694 On Wed, 2009-04-01 at 18:10 -0700, Bart Smaalders wrote: > Sebastien Roy wrote: > > AFAIK, Wireshark 1.0.6 requires libpcap >= 1.0.0 (we currently have > > 0.9.8). Am I mistaken? > > > > Project team (people actually doing the work; I'm pushing paper on > this one) is on cc list... That's fine, I'd think that the project team can answer the question... Is it dependent on a newer version of libpcap than what we have? If so, is there a case dependency on a "update libpcap" case to be filed later? If not, then there's no problem. FWIW, 2009/147 (tcpdump) also requires a newer libpcap. Perhaps the two project teams (if they're not the same team) can work this out together. -Seb From Petr.Sumbera@sun.com Thu Apr 2 07:54:15 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n32EsFsl020160 for ; Thu, 2 Apr 2009 07:54:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n32EsECf003200; Thu, 2 Apr 2009 08:54:15 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHH00I01AQEGE00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Apr 2009 07:54:14 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHH009HRAQDC260@nwk-avmta-1.sfbay.Sun.COM>; Thu, 02 Apr 2009 07:54:14 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n32EsDi7016934; Thu, 02 Apr 2009 14:54:13 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KHH00A00AIS0C00@fe-emea-09.sun.com>; Thu, 02 Apr 2009 15:54:13 +0100 (BST) Received: from [129.157.71.67] ([unknown] [129.157.71.67]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KHH007FDAQ3H8E0@fe-emea-09.sun.com>; Thu, 02 Apr 2009 15:54:03 +0100 (BST) Date: Thu, 02 Apr 2009 16:56:34 +0200 From: Petr Sumbera Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <1238634504.4272.2.camel@seb> Sender: Petr.Sumbera@sun.com To: Sebastien Roy Cc: Bart Smaalders , PSARC-EXT@sun.com, wireshark-team@sun.com Message-id: <49D4D222.5000109@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> <1238634504.4272.2.camel@seb> User-Agent: Thunderbird 2.0.0.19 (X11/20090311) Status: RO Content-Length: 410 I'm not aware of any issue regarding libpcap. We are building and running with current Solaris version of libpcap just fine. Petr Sebastien Roy wrote: > On Wed, 2009-04-01 at 17:47 -0700, Bart Smaalders wrote: >> * Project will deliver current Wireshark version 1.0.6 rather >> than 0.99.5. > > AFAIK, Wireshark 1.0.6 requires libpcap >= 1.0.0 (we currently have > 0.9.8). Am I mistaken? > > -Seb > > From Sebastien.Roy@sun.com Thu Apr 2 10:19:06 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n32HJ6Go000842 for ; Thu, 2 Apr 2009 10:19:06 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n32HIxgl014165; Thu, 2 Apr 2009 10:19:05 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KHH00B0NHFT3800@brm-avmta-1.central.sun.com>; Thu, 02 Apr 2009 11:19:05 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KHH0025YHFSMY80@brm-avmta-1.central.sun.com>; Thu, 02 Apr 2009 11:19:04 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n32HJ46t020489; Thu, 02 Apr 2009 17:19:04 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KHH00800F5SBI00@mail-amer.sun.com>; Thu, 02 Apr 2009 11:19:04 -0600 (MDT) Received: from [192.168.1.5] ([unknown] [173.76.18.185]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KHH002HCHFAR1C0@mail-amer.sun.com>; Thu, 02 Apr 2009 11:18:47 -0600 (MDT) Date: Thu, 02 Apr 2009 13:18:45 -0400 From: Sebastien Roy Subject: Re: PSARC/2007/334 Add Wireshark 0.99.5 into Solaris In-reply-to: <49D4D222.5000109@sun.com> Sender: Sebastien.Roy@sun.com To: Petr Sumbera Cc: Bart Smaalders , PSARC-EXT@sun.com, wireshark-team@sun.com Message-id: <1238692726.4272.24.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.24.2 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <49D40B2F.6040206@Sun.COM> <1238634504.4272.2.camel@seb> <49D4D222.5000109@sun.com> Status: RO Content-Length: 236 On Thu, 2009-04-02 at 16:56 +0200, Petr Sumbera wrote: > I'm not aware of any issue regarding libpcap. We are building and > running with current Solaris version of libpcap just fine. Okay, great. Thanks for confirming that. -Seb