1. Introduction
This is release 2.1 of KSnuffle. KSnuffle is a network
traffic monitor for the KDE desktop. It basically works; it does not,
so far as I know, crash, but:
-
Network packet decoding is rather restricted at present. It only
really handles TCP/IP and UDP/IP, but even this is not
complete and may contain errors. I have used the code in
tcpdump as a base, but it is not very clear (at least, to
me!). My book on IP protocols may be more forthcoming!
-
Currently, a limited number of datalink layers are understood,
including EtherNet, PPP and loopback; basically, these are the ones
that I have access to. Others may or may not work.
1.1 Features
Some of KSnuffle's features include:
- Basic filtering and packet selection via the GUI
- Advanced filtering and packet selection via filterprograms
- Multiple concurrent monitors
- Remote sniffing via a remote server process
- Protocol structure display to application level
- TCP data stream display
- Text and binary logging, plus replay of binary log files
- Textual display of network traffic
- Network load histograms and time-averaged load display
- Parallel display of multiple load histograms
- Start and stop triggers
- Command execution on specific events
- Save and restored filter and packet selection configurations
- Support for use by selected non-root users
KSnuffle uses packet filter descriptions exactly as for
tcpdump(8). Please see the manual pages
for this utility for further details.
1.2 Caveats
Please see the caveats page.
1.3 Changes
- Changes from 0.2 to 0.3
- Window is resizable
- General configuration and filters on separate pages
- Remote sniffing
- Event Commands
- Changes from 0.3 to 0.4
- TCP/IP information is decoded
- Font selection for packet display
- Packet display column widths saved
- Filter programs saved
- Whopping security hole fixed
- Changes from 0.4 to 0.5
- Ksnuffle no longer forks for each sniffers
- Multiple sniffers share same libpcap object for same interface
- Dynamically loaded plugin modules
- Changes from 0.5 to 0.6
- Packet protocol structure display
- TCP data stream display
- Changes from 0.6 to 0.7
- Build with gcc 2.95 on Mandrake 7.0
- Changes from 0.7 to 0.8
- Minor bug fixes
- TCP/IP monitor plugin
- Changes from 0.8 to 2.0
- Changes from 2.0 to 2.1
- Show MAC addresses
- Fix for starting/stopping sniffers on the same port