Ok, so first, I don’t know if Ethereal is still called Ethereal or not… I heard there was a lawsuit and they call themselves WireShark now or something. I can tell you that the version I run on my SLED 10 box is still called Ethereal…
So I have been monkeying around with Ethereal lately, and found a couple really cool tools, especially cool for me, because I do a lot of documentation. A couple years ago, I had to do a matching bounce diagram for some docs I was doing on EAPOL and I hand-created a spreadsheet with matching Ethereal and Cisco router debug showing flow direction, protocol and source/destination… it took me almost 40 hours to complete, but it was worth it because I still have some people asking for it so they can understand how the switch functions in an 802.1X environment.
Anyways, so here’s a quick way to do a bounce diagram:
First, (and I am not going to go into the operation of Ethereal) I performed a capture of my browser hitting its homepage at news.google.com. I started Ethereal, launched the capture session, and then popped the browser open. Once this was done, the fun started…
Since my browser has a bunch of live bookmarks and web-extensions, I ended up capturing a bunch of stuff… but I only want to see my conversation with Google News… so I used a display filter.
Then I selected the Statistics Menu, and chose the Flow Graph item. The following dialog appeared:
I hit the OK button and received the following output:
Now, that is pretty cool… but it gets better… and this is the part I got excited about… I hit the Save As button, and it dropped the whole thing out as a text file, ready to put into my document. I am hoping they will be able to drop it out as a PNG or something later on, but just being able to drop it out as a text file is going to save me hours.