CRAWDAD tools/analyze/pcap/WScout (v. 2007-11-13)

WScout, lightweight PCAP file visualizer.WScout provides a PCAP traces visualizer that is able to work with huge traces (>10 GiB). Its goals are speed and low memory requirements. Despite its design being protocol-agnostic, it currently handles only Prism and IEEE 802.11 headers, hence its name.Lastmodified :2007-11-16Dataname :tools/analyze/pcap/WScoutFile :wscout-1.2.tar.gzReleasedate :2007-11-13Equiversion :v1.2Change :* WScout 1.2 is released! - WScout now handles the previously missing 802.11e frame types. - WScout now displays correctly Prism headers from traces with swapped integer representation. Some traces have inconsistencies so it is sometimes needed to manually override endianness settings. This is now possible using the "swap endianness" check box inside the tool bar.References :The WScout websiteWebsite :http://wscout.lip6.frKeyword :802.11 802.11 frames packet trace tcpdumpLicense :Copyright© 2007 Université Pierre et Marie Curie - Paris 6 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose. See the GNU General Public License for more details.Support :1. We are not aware of any bug in WScout. That is why reporting unknown bugs to the package's maintainers ([e-mail]) is so important! :-D 2. If you have found a bug, please Report it to the package's maintainers ([e-mail]). 3. If you would really love having feature X implemented, then, implement it! ;-) More seriously, unless this is a ridiculously simple feature to implement, this is unlikely we will do it for you. But giving feedback to the package's maintainers ([e-mail]) about the features you want is important. So we know if important features are missing. 3. If you want to contribute to WScout and implement some features, have a look at doc/HACKING. Again, contact the package's maintainers ([e-mail]) so they can help you implement new features. 4. If you have any question, please email the package's maintainers ([e-mail]).Build :1. What are WScout's requirements? WScout needs: - A standard compliant C++ compiler. WScout's developers use GCC. - GNU make. Or any other make that supports pattern rules using '%'. - The Boost C++ libraries (http://www.boost.org/). More specifically: date_time, foreach, format, conversion/lexical_cast, optional, smart_ptr, tokenizer. - Trolltech's Qt library (http://trolltech.com/products/qt/), at least version 4.3. You will also need some tools provided with this library: the Meta-Object Compiler (moc) and the Resource Compiler (rcc). On some systems (e.g. Debian GNU/Linux) they are provided in separate packages. 2. How do I install WScout? WScout's packaging follows the GNU conventions. An installation documentation is provided in the INSTALL file in the package's root directory. However, with a standard system, the following commands should do the trick: --- mkdir _build cd _build ../configure make make install make check --- On some systems, you might have to customize the configure script's invocation. E.g. --- mkdir _build cd _build ../configure CPPFLAGS=-I/usr/include/qt4 make make install make check --- 3. Why does WScout's configure check for the libpcap and GMP? Actually WScout's configure does not check that. But WScout might embed a package called trace-tools, which configure script check for libpcap and GMP. However, these are optionals, and the build should be fine despite you might be missing these packages. 4. configure complains it did not find library X? Either library X is not installed on your system, either your system is not properly configured, so the library cannot be found. You may use the CPPFLAGS and LDFLAGS variables to correct this behavior. E.g., run --- ./configure CPPFLAGS=-I/custom/path/include/qt4 LDFLAGS=-L/custom/path/lib --- As an example, on my system (Debian GNU/Linux), I invoke --- ./configure CPPFLAGS=-I/usr/include/qt4 --- 5. configure complains it found library X's headers, but is unable to link? Most probably library X is installed but its binaries are in a non-standard place. Use the LDFLAGS variable as described previously. 6. configure complains library X's headers are unusable, despite successful linking? Most probably library X is installed but its headers are in a non-standard place. Use the CPPFLAGS variable as described previously.Output :Please see sample screenshots at http://wscout.lip6.fr/overview.htmlUsage :Basically, WScout provides a multiple tabbed window to visualize PCAP traces. WScout is able to open very large files. These might take a few dozen seconds to load, but WScout will not demand much CPU and memory resources. WScout is also able to handle PCAP traces with no Prism header. You may process your traces with external programs in order to filter them. Finally, WScout also enables browsing using multiple windows.Example :Please see sample screenshots at http://wscout.lip6.fr/overview.html

WScout，一款轻量级的PCAP文件可视化工具。WScout具备处理大型跟踪数据（>10 GiB）的能力。其设计宗旨在于追求速度与低内存需求。尽管其架构具有协议无关性，目前仅支持Prism和IEEE 802.11头部信息，因此得名。最后修改日期：2007-11-16，数据集名称：tools/analyze/pcap/WScout，文件：wscout-1.2.tar.gz，发布日期：2007-11-13，等效版本：v1.2，变更记录：* WScout 1.2版本现已发布！WScout现已支持先前未涵盖的802.11e帧类型。WScout现在能够正确显示来自具有交换整数表示法的跟踪文件的Prism头部信息。由于某些跟踪文件存在不一致性，有时需要手动覆盖端序设置。现在，您可以通过工具栏中的“交换端序”复选框实现此功能。参考文献：WScout官方网站，网址：http://wscout.lip6.fr/，关键词：802.11，802.11帧，数据包跟踪，tcpdump，许可证：版权© 2007 皮埃尔和玛丽·居里大学 - 巴黎6校。本程序为免费软件；您可以根据自由软件基金会发布的GNU通用公共许可证的条款重新分发和/或修改它；许可证的版本可以是2版，也可以是您选择的任何较新版本。本程序以希望对您有用的目的进行分发，但不提供任何保证；甚至不提供适销性或适用于特定目的的隐含保证。有关详细信息，请参阅GNU通用公共许可证。支持：1. 我们未发现WScout中的任何bug。因此，向软件包维护者（[e-mail]）报告未知bug至关重要！:-D 2. 如果您发现了一个bug，请向软件包维护者（[e-mail]）报告。3. 如果您真的非常希望实现功能X，那么，就自己动手吧！；-) 但更严肃地说，除非这是一个极其简单的功能，否则我们可能不会为您实现它。但是，向软件包维护者（[e-mail]）提供您希望的功能反馈非常重要。这样我们才能知道是否缺少重要功能。4. 如果您想为WScout做出贡献并实现一些功能，请查看doc/HACKING文件。再次，请与软件包维护者（[e-mail]）联系，以便他们帮助您实现新功能。5. 如果您有任何疑问，请通过电子邮件联系软件包维护者（[e-mail]）。构建：1. WScout的要求是什么？WScout需要：- 一个符合标准的C++编译器。WScout的开发者使用GCC。2. GNU make。或者任何支持使用'%'模式规则的make。3. Boost C++库（http://www.boost.org/）。具体而言：date_time，foreach，format，conversion/lexical_cast，optional，smart_ptr，tokenizer。4. Trolltech的Qt库（http://trolltech.com/products/qt/），至少版本4.3。您还需要一些由该库提供的工具：元对象编译器（moc）和资源编译器（rcc）。在某些系统（例如Debian GNU/Linux）中，它们包含在单独的软件包中。2. 如何安装WScout？WScout的打包遵循GNU约定。安装文档包含在软件包根目录中的INSTALL文件中。然而，使用标准系统，以下命令应该可以解决问题：--- mkdir _build cd _build ../configure make make install make check --- 在某些系统上，您可能需要自定义configure脚本的调用。例如：--- mkdir _build cd _build ../configure CPPFLAGS=-I/usr/include/qt4 make make install make check --- 3. 为什么WScout的configure会检查libpcap和GMP？实际上，WScout的configure并没有进行这样的检查。但WScout可能会嵌入一个名为trace-tools的软件包，其configure脚本会检查libpcap和GMP。然而，这些是可选的，即使缺少这些软件包，构建过程也可以顺利进行。4. configure抱怨找不到库X？要么是因为库X未安装到您的系统上，要么是因为您的系统配置不当，导致库无法找到。您可以使用CPPFLAGS和LDFLAGS变量来纠正这种行为。例如，运行--- ./configure CPPFLAGS=-I/custom/path/include/qt4 LDFLAGS=-L/custom/path/lib --- 例如，在我的系统（Debian GNU/Linux）上，我调用--- ./configure CPPFLAGS=-I/usr/include/qt4 --- 5. configure抱怨找到了库X的头文件，但无法链接？很可能是库X已安装，但其二进制文件位于非标准位置。使用前面描述的LDFLAGS变量。6. configure抱怨库X的头文件不可用，尽管链接成功？很可能是库X已安装，但其头文件位于非标准位置。使用前面描述的CPPFLAGS变量。输出：请参阅示例截图，网址：http://wscout.lip6.fr/overview.html使用方法：基本上，WScout提供了一个多标签窗口，用于可视化PCAP跟踪。WScout能够打开非常大的文件。这些文件可能需要数十秒才能加载，但WScout不会对CPU和内存资源提出过高要求。WScout还能够处理没有Prism头部的PCAP跟踪。您可以使用外部程序处理您的跟踪文件，以便过滤它们。最后，WScout还允许通过多个窗口进行浏览。示例：请参阅示例截图，网址：http://wscout.lip6.fr/overview.html