Subject: Re: TCPDUMP for NT
From: [email-masked] (Tim Newsham)

18 Feb 1998 06:12:22 -0800
Message-ID: <[email-masked]>
References: <5060200011297952000002L022*@MHS>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
To: [email-masked] (Christian Mathieu)
Cc: [email-masked]

> Hello
> Has someone already ported tcpdump to NT ?

We (Secure Networks, Inc.) have ported tcpdump as part of testing.
NT does not provide a driver for accessing the raw network.  So before
you can port tcpdump, you have to write a device driver for accessing
the network.  The Device Developers Kit comes with an example driver
that does this, but it is very poor.  After you have a device driver,
you have to port libpcap to access it.  This is fairly straight forward
as most of the code will compile fine, and you only have to write 1
file from scratch.  Once you have libpcap, tcpdump is fairly easy to
port.

We currently give out tcpdump binaries with our Ballista product
(see http://www.secnet.com/ for more information).  We will probably
be offering just the device driver, libpcap, and the tcpdump diffs
as a package for free non-commercial use soon.  Unfortunately, I
don't have a date on this.  We will be posting an announcement to
this list if/when it happens.

If you have any specific questions on porting tcpdump, I'd be
glad to answer them.

> Christian Mathieu
> [email-masked]     [email-masked]

                                             Tim N.

-
For help on using this list (especially unsubscribing), send a message to
"[email-masked]" with one line of text: "help".