Wireshark 1.2.x

[Shatter]

Any chance Wireshark gets updated to a newer version that can capture and display USB traffic? I know I could probably install it from source, but that eliminates support from repos.

[gunrunr]

i'm pretty sure its there if you have all of the software sources enabled.
If you scroll down below the backtrack sources im pretty sure its under the networking tab, slap me if its not.

[bofh28]

i'm pretty sure its there if you have all of the software sources enabled.
If you scroll down below the backtrack sources im pretty sure its under the networking tab, slap me if its not.

Sorry wireshark 1.2 isn't there.

[Archangel-Amael]

i'm pretty sure its there if you have all of the software sources enabled.
If you scroll down below the backtrack sources im pretty sure its under the networking tab, slap me if its not.

Not a slap but how to actually find out.
apt-get update
apt-cache show wireshark

[lordplagueis]

[QUOTE=bofh28;2839]Sorry wireshark 1.2 isn't there.[/QUOT]
you'll know you did something wrong if apt-get update && apt-get dist-upgrade is broken http://media-2.cacetech.com/wireshar...-1.2.6.tar.bz2

[bofh28]

my apt-get isn't broken like I thought it might be. I just received an update to set so apt-get works, but wireshark 1.2 isn't available yet.

apt-cache show wireshark says wireshark 1.0.3 is installed.

[skinnypuppy]

Since there was no definitive request for wireshark 1.2.6 stable (January 27, 2010) I will ask for it to please be added to the repos.

I have 1.3.2 development installed with the following options:

Version 1.3.2

Copyright 1998-2009 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.14.4, with GLib 2.18.2, with libpcap 0.9.8, with libz
1.2.3.3, with POSIX capabilities (Linux), with libpcre 7.6, with SMI 0.4.7, with
c-ares 1.5.2, with Lua 5.1, with Python, with GnuTLS 2.4.1, with Gcrypt
1.4.1, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Mar 12
2008), without AirPcap, with new_packet_list.

Running on Linux 2.6.30.9, with libpcap version 0.9.8, GnuTLS 2.4.1, Gcrypt
1.4.1.

Built using gcc 4.3.2.

And was going to write a tut on how to get this monstrosity of 1.3.2 built (not a simple task) but decided against it as it's still a dev. version (I personally can't get voip capture to work properly, that may be my error though)/compiling tools yourself will void your warranty and if you are willing to use it, you'll know how to get it all installed by yourself.

[S3M73X]

<note>
do NOT try this at home.
playing with source-code is not official supported!
</note>

I myself also needed this tool for a demonstration of the DECT-phone-protocol analysis.

Just downloaded the Source of v1.2.9 and compiled it with the following options

The Wireshark package has been configured with the following options.
Build wireshark : yes
Build tshark : yes
Build capinfos : yes
Build editcap : yes
Build dumpcap : yes
Build mergecap : yes
Build text2pcap : yes
Build idl2wrs : yes
Build randpkt : yes
Build dftest : yes
Build rawshark : yes

Install dumpcap setuid : no
Use plugins : yes
Use lua library : no
Build rtp_player : yes
Use threads : no
Build profile binaries : no
Use pcap library : yes
Use zlib library : yes
Use pcre library : no
Use kerberos library : yes (MIT)
Use c-ares library : no
Use GNU ADNS library : no
Use SMI MIB library : no
Use GNU crypto library : yes
Use SSL crypto library : no
Use IPv6 name resolution : yes
Use gnutls library : no
Use POSIX capabilities library : no
Use GeoIP library : no

I am not too sure which features work since i didnt to experiments with it.
Would be really cool if it would be added.

Here are the Options of the current version that comes with the repos which is v1.0.3

root@bt:~# dpkg -s wireshark | grep Depends | tr ',' '\n'
Depends: libadns1 (>= 1.4)
libasound2 (>> 1.0.17)
libatk1.0-0 (>= 1.20.0)
libc6 (>= 2.7)
libcairo2 (>= 1.2.4)
libcomerr2 (>= 1.01)
libfontconfig1 (>= 2.4.0)
libfreetype6 (>= 2.3.5)
libgcrypt11 (>= 1.4.0)
libglib2.0-0 (>= 2.16.0)
libgnutls26 (>= 2.4.0-0)
libgtk2.0-0 (>= 2.14.1)
libjack0 (>= 0.109.2)
libkrb53 (>= 1.6.dfsg.2)
liblua5.1-0
libpango1.0-0 (>= 1.21.6)
libpcap0.8 (>= 0.9.3-1)
libpcre3 (>= 7.4)
libpixman-1-0
libpng12-0 (>= 1.2.13-4)
libportaudio2
libtasn1-3 (>= 0.3.4)
libx11-6
libxcb-render-util0
libxcb-render0
libxcb1
libxrender1
wireshark-common (= 1.0.3-1ubuntu2.2)
zlib1g (>= 1:1.1.4)

edit:
well DECT-protocoll support seems to be buggy ... at least with my dumps.
allready informed the wireshark-devs

[Snayler]

Here are the Options of the current version that comes with the repos which is v1.0.3

Actually, the current version is 1.2.6.

[Archangel-Amael]

Actually, the current version is 1.2.6.

Your right but in a way so is s3m73x because he was stating the version that comes with a vanilla version of BT4 final.
Since he mentioned making a another vmware image for testing today in irc.

As a side note:
Please be aware that if anyone is to compile there own packages that are not maintained in the repo's you are on your own for support for it and BT.
Thanks.