Using Netdude

Table of Contents
Netdude's View of a Trace file
The Main Window
Getting a quick Overview of a Trace
Navigation in a Trace File
Using Packet Filtering
Editing Raw Packet Data
Using the Clipboard
Using Plugins
Setting Preferences
Closing Netdude
Command Line Options

This chapter gives an overview over Netdude's view of a trace file and explains how to use the Netdude GUI.


Netdude's View of a Trace file

tcpdump trace files often are huge; files that are Gigabytes in size are not uncommon. This makes it prohibitive to just blindly load a trace file into memory when the user opens a trace. Instead, Netdude always only keeps a small section of the trace in memory [1], allowing you to jump to arbitrary locations in the trace based on timestamps and percentage offsets (as explained later in more detail).

Since Netdude allows the user to add and delete packets, it is not enough to just memory-map the trace file. Rather, it keeps track of the manipulations the user performs and swaps out modified trace parts when the user jumps to a different part in the trace. When an operation is performed on all packets in the trace, a new copy of the trace is created in a configurable scratch space area, merging currently existing modified trace parts back into a new consolidated temporary trace. to the user.


The Main Window

Here's a screenshot of Netdude's main window with two trace files open.

Netdude's main window.

Most things should be obvious -- the GUI is a regular multi-document interface. The menus allow quick access to frequently-used features. Trace files are displayed in a notebook widget, each trace being displayed in its own tab, labeled with the trace's file name. The close button on the tab is green while the trace is unmodified and turns red when packets get modified. The other button sets the packet iteration mode for a trace. This mode defines active packet set, that is, the set of packets to which packet modifications are applied. There are three such modes:

In each trace tab, the upper part of the window is occupied by the tcpdump output of the current trace. Left-clicking in the list selects packets, right-clicking pops up the Edit menu as a shortcut. The protocol headers contained in a packet are listed as tabs in the lower part, in nesting order from left to right. You can look at and edit the protocols by clicking on the corresponding tab.

Packets can be filtered, either manually by selecting 'Edit→Filter' or 'Edit→Unfilter', or by applying a previously created filter to a set of packets. Filtered packets are still displayed, but in a brighter color. When a trace file is saved to disk, all filtered packets are dropped. For more details on filtering packets, see the Section on Filtering.

By clicking on the buttons in the lower part of the window you can edit header field values. Changes to fields are applied to packets depending on the packet iteration mode selected for the current trace as explained above.

Each field in a protocol header has a state, and protocol plugins can change these states to indicate certain circumstances. In the protocol plugins shipped with Netdude, incorrect checksums will appear red, while in situations where the correctness of a checksum cannot be determined (e.g., because not all data covered by the checksum is present), it will appear yellow.


Getting a quick Overview of a Trace

To get a quick overview of a trace, load and select it, then click on 'File→Info'. You will get a dialog with content similar to the following:

Netdude's trace information dialog.

The meaning of the various fields should be obvious.


Navigation in a Trace File

Netdude allows you to jump to other packets in a trace file in a number of different ways. Within the currently loaded part of the trace, you can jump to the

If the number of packets in the current trace exceeds the configured maximum number of packets to keep in memory, you can jump to other parts in the trace using 'Go→Go to other Trace Area' or by clicking inside the trace part indicator at the bottom left of the main window. The dialog for trace navigation looks as follows:

Netdude's trace navigation dialog.

The dialog allows you to jump to other parts in the trace in three ways:


Using Packet Filtering

The ability to filter packets is essential for performing reasonable packet modifications. Netdude has a generic filter API that allows plugins to register their own filters, while still allowing the user to easily manipulate these filters through the GUI.

There are two things to keep in mind about filtered packets:

To create a new filter, use 'Settings→Configure Filters'. Depending on the filter plugins installed, you then get a choice of filter types to create, and a list of already existant filters to modify/delete.

Netdude's filter creation dialog (back), ready to create a new BPF filter (front).

To apply filters to a trace, use 'Edit→Apply Filters' or the keyboard shortcut. The resulting dialog lists the currently defined filters, and you can now select the filters you want to apply to the trace, together with the boolean combination of the filters.

An instance of the filter application dialog.

When clicking 'Update', the filter combination is applied to the active set of packets and packets that did not pass the filtering are grayed out.

After applying the FTP data filter.


Editing Raw Packet Data

Whenever Netdude encounters data that is not specifically interpreted by some protocol plugin, the data is displayed using Netdude's payload editor, in a separate tab. Netdude tries to give the tab a meaningful label by looking at TCP or UDP port numbers when available. If this fails, the tab reads "(rest)".

This editor supports two modes of operation -- hex and ASCII. In hex mode, it works like usual hex editors. An image of an editing session is shown below:

Editing raw data using the hex editor.

By clicking into the editor field, the cursor is placed either over a hex digit or the corresponding ASCII display on the right. The actual cursor is blue, the corresponding indicator in the other display part in a bright gray [2].

But Netdude's payload editor is better than that. For normal text, editing using the hex editor is cumbersome. You can use ASCII mode in those situations -- here the editor behaves more like a normal text editor. You can literally type up packet content. However, be aware that when typing in more text than existed previously, some text is dropped at the end of the packet, as the size of the packet is not actually increased.

Editing raw data using the ASCII editor.

There's one point that needs to be addressed when editing arbitrary binary data using the ASCII characters: unprintable characters and the null character, which normally delimits character strings. These characters are displayed as follows:

When editing data in ASCII mode, the size of the data chunk you are modifying is not increased. This means that for every excess character you are adding, there is a character falling off the end and lost. You can see the affected characters displayed in a lighter hue, see the above screenshot for an example.

CautionModifications made to packets using the payload editor are always exclusively applied to the current packet, regardless of the trace's current packet iteration mode.
 


Using the Clipboard

Netdude provides a single clipboard area for temporary storing packets and moving them around between traces. Just cut or copy packets into the clipboard using the 'Edit→Copy', 'Edit→Cut' or the same entries in the context menu obtainable by using right-click in the packet list. The clipboard also serves an important other purpose: when you are placing packets in the clipboard, their tcpdump output is placed in the X cut buffer. Afterwards, pasting in other applications like editors or email composers will give you