Software-update: Ethereal 0.99.0

Gisteren is versie 0.99.0 van de protocol analyser Ethereal uitgebracht. Dit zeer uitgebreide programma kan als een zogenaamde packet-sniffer worden gebruikt en is in staat om maar liefst 759 verschillende netwerkprotocollen en data die over het netwerk wordt verstuurd te ontleden en te analyseren. Tevens kan het ook reeds opgeslagen dataverkeer gebruiken als invoer. In deze release zijn een groot aantal veranderingen aangebracht, waaronder een aantal die met een subsidie van het Amerikaanse Homeland Security door het beveiligingsbedrijf Coverity naar boven zijn gehaald. Het changelog ziet er als volgt uit:

Bug Fixes

• The H.248 dissector could crash.
• The UMA dissector could go into an infinite loop.
• The X.509if dissector could crash.
• The SRVLOC dissector could crash.
• The H.245 dissector could crash.
• Ethereal's OID printing routine was susceptible to an off-by-one error.
• The COPS dissector could overflow a buffer.
• The ALCAP dissector could overflow a buffer.
• The statistics counter could crash Ethereal.
• Ethereal could crash while reading a malformed Sniffer capture.
• An invalid display filter could crash Ethereal.
• The general packet dissector could crash Ethereal.
• The AIM dissector could crash Ethereal.
• The RPC dissector could crash Ethereal.
• The DCERPC dissector could crash Ethereal.
• The ASN.1 dissector could crash Ethereal.
• The SMB PIPE dissector could crash Ethereal.
• The BER dissector could loop excessively.
• The SNDCP dissector could abort.
• The Network Instruments file code could overrun a buffer.
• The NetXray/Windows Sniffer file code could overrun a buffer.
• The GSM SMS dissector could crash Ethereal.
• The ALCAP dissector could overrun a buffer.
• The telnet dissector could overrun a buffer.
• ASN.1-based dissectors could crash Ethereal.
• The H.248 dissector could crash Ethereal.
• The DCERPC NT dissector could crash Ethereal.
• The PER dissector could crash Ethereal.

New and Updated Features

• The new command line tool dumpcap makes it possible to capture network data without the drawbacks of (t)ethereal (memory usage, security problems, ...) while keeping the benefit of advanced techniques like multiple (ringbuffer) files and alike.
• The man page of dumpcap in HTML format is available at http://www.ethereal.com/docs/man-pages/dumpcap.1.html.
• The source distribution of Ethereal now supports SSL, IPsec ESP, and ISAKMP decryption. (This feature has not yet been enabled in the Windows installer.)
• Win32: Catch hardware exceptions caused by buggy dissectors. If e.g. a NULL pointer exceptions occurs, Ethereal won't crash now but displays the exception and tries to continue decoding packets.
• The Windows version of Ethereal now uses native open and save file dialogs.
• In related news, Ethereal now runs as a full-fledged Unicode application under Windows.
• Recent versions of Ethereal were flagging packets with an incorrect TCP checksum as malformed. False positives were being triggered on systems that use TCP checksum offloading. We now check to see if the checksum is not 0x0000 before flagging the packet as malformed.
• The expert analysis feature has been enhanced.

New Protocol Support

• ACP133, E.212, Nortel LGE Monitor, OICQ

Updated Protocol Support

• 3G A11, 802.11, 802.1Q, 802.3 Slow Protocols, AIM, ALCAP, ANSI MAP, ASF, ASN.1 BER, ASN.1 PER, BACapp, BACnet, BFD, BGP, BPDU, BSSAP, BSSGP, Camel, CDP, CLNP, CMP, COPS, DCERPC (DCERPC, LSA, NT, PNP), DCOM (CBA, DCOM, Dispatch), DHCP, DIAMETER, DNS, DOCSIS DCC, eDonkey, Ethernet, FC, FCP, FIX, G.723, GIOP, GRE, GSM A, GSM MAP, GSSAPI, GTP, H.245, H.248, H.450, HTTP, IAPP, ICMPv6, iFCP, IP, IPMI, IPP, IPsec, IPv6, ISAKMP, iSCSI, ISUP, IuUP, Juniper GGSN, JXTA, K12, Kerberos, LAPD, LDAP, LLDP, LOOP, M3UA, MEGACO, MPLS, MS MMS, MS NLB, MS Proxy, MTP3, NBNS, NCP 2222, NDPS, Netflow, NFS, NJACK, NLM, NSIP, NTLMSSP, PN-DCP, POP, PPP, Q.931, Radiotap, RADIUS, RANAP, RNSAP, RPC, RSYNC, RTCP, RTP, SCCP, SCCP MG, SCSI, SDP, Sebek, SES, SIGCOMP, SIGCOMP UDVM, SIP, SKINNY, SMB2, SMB (Mailslot, PIPE, SMB), SMPP, SNDCP, SNMP, SOCKS, SPNEGO, SRVLOC, SSL, STUN, Syslog, T.38, TACACS, TCAP, TCP, TDS, Telnet, TIPC, UDP, UMA, WSP, X11, X.411, X.509, XML

New and Updated Capture File Support

• iSeries, Snoop, Windows Sniffer

[break]