WinDump is the porting to the Windows platform of TCPDump. TCPDump is one of the most used UNIX network capture and analysis programs. WinDump is fully compatible with TCPDump and can be used to watch and diagnose network traffic according to various complex rules. The WinDump.exe executable file can run both under Windows 95/98 and under Windows NT. To run WinDump the correct version of the NDIS packet capture driver and of the packet.dll library must be installed in the system.
FULVIO Stesse osservazioni fatte nel capitolo precedente con libpcap.
Since the differences from WinDump and TcpDump are very few, we provide the HTML version of the manpage of TcpDump, modified to include our additions.
Our WinDump project tries to make a clean and complete porting of TcpDump, therefore the use of the two programs is nearly identical. All the functions offered by TcpDump are implemented in WinDump, so every operation that TcpDump can do in UNIX can be done in Windows with WinDump. In addition, WinDump offers some characteristics that are not present in TcpDump:
FULVIO: queste info (che sono utilissime) mi sembrano piu' da manuale di utlizzatore che non "manutentore" di windump.
The problems encountered during the porting of WinDump are more or less the same that we had during the porting of the pcap library (see the section on libpcap). We had to import some include files from Linux, and we put them in the Win32-Include directory. We imported from Linux also some code that implements functions needed by the program and missing in Windows. This code is in the Win32-Src directory. Moreover, we wrote some Windows specific code to handle things like UNICODE and the interaction with Analizer. (FULVIO: che codice per l'interazione con analyzer? Non hai detto che hai raspato via tutto? E Unicocde c'entra qualcosa con windump? Non e' completamente trasparente ad esso?) This code is in the file Win32-Src\w32_fzs.c. Finally we had to modify Tcpdump.c, the file containing the main() function, to add the new switches to the command line.
However, the porting of TCPDump was easier than the porting of the pcap library. In fact TCPDump, using the functions exported by libpcap, doesnt interact directly with the system. This makes it quite easy to port.
We isolated all our changes to the original sources through the use of #ifdef and #ifndef like in the following example
#ifdef WIN32 /* source code for Windows */ #endif |
Therefore, the code of WinDump is compatible with the code of TcpDump, and can be compiled under UNIX, generating a normal TcpDump executable.
FULVIO. A me pareva di ricordare che nel web originale, quello fatto da Piero (che e' ancora in linea nel sito di Analyzer) ci fosse parecchia roba relativa ai problemi di porting. Mi pareva di ricordare problemi di little-endian big-endian, di word e byte e in generale lungheza dei vari campi, ... tutte cose che qui sono sparite.