NetPeek version 0.0.4
---------------------

NetPeek is a GUI-based network monitoring and diagnosis tool.  It captures
packets from the local network and displays them to the user in two forms:

   - A short one-line form, similar to that produced by "tcpdump".
   - A long form, detailing all fields in a packet, with explainatory
     comments where necessary.  The display is similar to that produced
     by the commercial EtherPeek program.

NetPeek is based around the "libpcap" packet capture library from the
Lawrence Berkeley National Laboratory's Network Resource Group, which
is also used by "tcpdump".  A version of the library is included with
this distribution in the "libpcap-0.4" directory.  The latest version
can be obtained from the FTP site "ftp.ee.lbl.gov".  If you wish to use
a different version of "libpcap", then you will need to make the
modifications listed in the section "New versions of libpcap" below.

NetPeek is covered by the terms of a BSD-style Copyright license.  See
the file LICENSE for details.

Building NetPeek
----------------

You will need a fairly complete set of GTK and GNOME libraries to build
NetPeek.  I use Red Hat Linux 6.0, which pre-installs all of the necessary
libraries.  If you don't have these libraries, then you will need to
download them from "http://www.gtk.org" and "http://www.gnome.org" before
building NetPeek.

Once you have all of the necessary libraries, type the following to build
and install it:

	./configure
	make
	make install

By default, the "netpeek" binary will be installed into the directory
"/usr/local/bin".  This can be changed using the "--prefix" option on
"configure".  For example, to install into "/opt/local/bin", use the
following commands instead:

	./configure --prefix /opt/local
	make
	make install

Running NetPeek
---------------

Because NetPeek needs to capture packets off the network, you will need
to be root when you run the program.  If you save packet traces from NetPeek,
then you can view them with NetPeek as a regular non-root user.

NetPeek and tcpdump
-------------------

The packet trace file format used by NetPeek is identical to that produced
by "tcpdump".  To display a NetPeek-saved packet trace with "tcpdump",
use a command such as the following:

	tcpdump -r filename

You can also view packet traces saved by "tcpdump" within NetPeek.
To save a packet trace from "tcpdump", use a command such as the
following:

	tcpdump -w filename

Note: by default, "tcpdump" will only capture the first 68 bytes of IP
packets.  This is usually not enough to display the full packet details
when you view the packet trace with NetPeek.  You may get messages such
as "Truncated Packet" if you attempt to view such trace files.  To make
"tcpdump" capture more data, then use the "-s" option as follows:

	tcpdump -s 2048 -w filename

New versions of libpcap
-----------------------

If you download a new version of "libpcap", then you will need to make
some modifications to the code to make it work with NetPeek.

First, change "scanner.l" by modifying the "lex_init" function
to read as follows:

	void
	lex_init(buf)
		char *buf;
	{
		in_buffer = buf;
		yyrestart(NULL);
	}

The call to "yyrestart" is missing from the original, and is required
to allow parsing more than one filter string in NetPeek.  You may get
"parse error" messages if you don't make this modification.

Next, if you are using a Linux system and intend to watch for packets
on the loopback device, then you will need to modify the "gen_linktype"
function in "gencode.c".  Change the "DLT_NULL" case to read as follows:

	case DLT_NULL:
		/* XXX */
		if (proto == ETHERTYPE_IP)
#ifdef linux
			return gen_true();
#else
			return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET)));
#endif
		else
			return gen_false();

Without this change, packet filtering won't work at all on the loopback
device.

The version of "libpcap" that is distributed with NetPeek already has
these changes.

To Do
-----

The set of packet formatting rules is fairly sparse at the moment.

Contacting the Author
---------------------

You can contact Rhys Weatherley at the e-mail address "rhys@nyerk.com".
The latest version of NetPeek can be downloaded from "http://www.nyerk.com".
