ipgrab 

Mike Borella
Advanced Technologies Research Center
3Com
Mount Prospect IL 60056

mike_borella@SPAMLET3com.com

(remove SPAMLET to mail me)

------------------------------------------------------------------------------

COPYRIGHT

Copyright (C) 1997, 1998 Mike Borella

Redistribution and use in source and binary forms are permitted
provided that this paragraph is duplicated in all such forms and
in any documentation, advertising materials, and other materials
related to such distribution and use ackowledge that the software
was developed by Mike Borella at the Advanced Technologies Research 
Center at 3Com Corp.  The name of the Author and the Corporation may 
not be used to endorse or promote products derived from this software 
without specific prior written permission.

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Some of this code has been taken from tcpdump, which was developed
by the Network Research Group at Lawrence Berkeley National Lab,
and is copyrighted by the University of California Regents.

------------------------------------------------------------------------------

DESCRIPTION

This program reads and parses packets from the link layer through the
transport layer, dumping explicit header information along the way.
It is a lot like tcpdump from LBL except that I've made an effort to
dump every relevant header field possible.  The overall structure of
the code is loosely based on tcpdump and I've lifted a few modules
from the tcpdump distribution when necessary, rather than re-inventing
the wheel.  In particular, the address conversion hashing routines are
pretty much lifted verbatim, as well as the TCP options section.

I expect that this code can be used for detailed packet level
debugging of existing or new protocols.  Also, I imagine that it could
be a useful teaching and instruction tool for TCP/IP or security
courses.  I've made an effort to make the code readable, sometimes
even at the expense of efficiency, so that one can use it to learn
about the pcap library calls and the header field data structures.

I'm not maintaining this program in a formal sense.  I'll add new
functionality and features when I feel that it is appropriate.
Suggestions are encouraged and bug-fixes are always welcome. 

BTW, in general, good information on the format of IPX packets is
difficult to find.  Here's a list of places I found information:

IPX and SPX packet format: SCO's "Network Programmer's Guide and Reference"
                           http://www2.sco.com:1996/netguide/CONTENTS.html
                           tcpdump source code was also useful.

RIP packet format: Source code for ipxripd, a Linux IPX/RIP daemon.

BTW, I haven't tested SPX support yet.  Feedback is welcome.

-------------------------------------------------------------------------------

INSTALLATION

You must have the pcap library (libpcap) version 0.3 or greater
installed.  In particular, the pcap.h and net/bpf.h files must be 
in an appropriate include directory (just grabbing a pre-compiled 
libpcap.so won't cut it).  Download pcap from http://www-nrg.ee.lbl.gov.

Run the configure script to create a Makefile, then type 'make'.  If
you need to install any other libraries or headers, configure should
tell you.

Systems tested so far: Linux, FreeBSD.  Note that it should compile cleanly
on Linux with glibc2 but will generate quite a few warnings on FreeBSD.

-------------------------------------------------------------------------------

OPERATION

See man page for details.

-------------------------------------------------------------------------------

THANKS

Marty Roesch fixed some of the timestamping, and provided the code for
payload output.  Lots of other people suggested things that eventually
made their way into the code, in one form or another.

-------------------------------------------------------------------------------


PROTOCOLS KNOWN

Data-Link: Ethernet, Slip, Raw IP
Network: IP, ICMP, ARP, RARP, IPX
Transport: TCP, UDP, SPX, IPX/RIP
Other: DNS, DHCP, L2TP.

-------------------------------------------------------------------------------

CHANGE LOG

--------+---------------+-------
Date	| Version	| Status
--------+---------------+-------
12/1/97	| 0.3		| First working release, Linux only.
	|		|
2/5/98  | 0.4		| FreeBSD port.
	|		| Generic IP, TCP, UDP, ARP header overlay format.
	|		| IP header checksum checking.
	|		| Option to dump packet payload
	|		| Minor adjustment to makefile to correct versioning.
	|		| 
3/7/98	| 0.5		| Command line parsing now generated by genparse.
	|		| Options to turn off link-layer, network and 
	|		| transport headers.  Fixed -c option.
	|		|
5/19/98 | 0.5.1		| Added DNS support.  
	|		|
5/20/98 | 0.5.2		| Added basic ICMP and IPX support.  Fixed some 
	|		| compilation problems with Solaris.
	|		|
11/3/98 | 0.6		| New source directory layout.
	|		| Preliminary L2TP support.
	|		| Basic DHCP support.
	|		| New hex and ASCII payload output.
	|		| Man page.
	|		| Minor formatting fixes.
	|		| 
--------+---------------+------------------------------------------------------

TO DO

- Complete ICMP support.
- Complete IPX support.
- Complete DHCP support.
- SNMP support.
- RIP support.
- PPP support.
