On Sun, 4 May 2003 10:00 am, Jon Baer wrote: > hi, > > i noticed that winpcap now has remote capture abilities (via > http://winpcap.polito.it/docs/man/html/group__remote__help.html) but what > im really wondering is if it is currently possible or possible in the > future to view via ethereal (for say if you had a wifi dmz setup w/snort to > monitor traffic) ... I've thought about remote capture a little, and the easiest way would seem to be to use libpcap over some kind of RPC mechanism. There is actually a sourceforge project to do this (http://sf.net/projects/rpcap) although it appears to need a lot more work - I couldn't even get the CVS version to build. I had some discussions with the maintainer, and it looked like he did intend to do some more work on it, but probably real world concerns intruded.
I thought that it would be fairly easy to get Ethereal to build using such a mechanism, since the calls are essentially the same. To allow easy access to the various machines offering captures, I thought that something like Service Location Protocol might be useful. It should be possible to make Ethereal build without those, if not available, based on some pretty trivial autoconf magic. The issues would then be whether there is enough throughput, and how to avoid runaway capturing problems (presumably some kind of automatic capture filter would be required). Brad
