5.2. Overview

The following will give you a simplified overview of Ethereals function blocks:

Figure 5.1.  Ethereal function blocks.

Ethereal function blocks.

The function blocks in more detail:

GTK 1/2

Handling of all user input/output (all windows, dialogs and such). Source code can be found in the gtk directory.

Core

Main "glue code" that holds the other blocks together, source code can be found in the root directory.

Epan

Ethereal Package ANalyzing (XXX - is this correct?) the packet analyzing engine, source code can be found in the epan directory.

  • Protocol-Tree - Keep data of the capture file protocol information.

  • Dissectors - The various protocol dissectors in epan/dissectors.

  • Plugins - Some of the protocol dissectors are implemented as plugins, source code at plugins.

  • Display-Filters - the display filter engine at epan/dfilter.

Capture

Capture engine.

Wiretap

The wiretap library is used to read/write capture files in libpcap and a lot of other file formats, the source code is in the wiretap directory.

Win-/libpcap (not part of the Ethereal package)

The platform dependant packet capture library, including the capture filter engine. That's the reason why we still have different display and capture filter syntax, as two different filtering engines used.