DOI: 10.21227/7fzr-3763
title: CRAWDAD tools/analyze/pcap/WScout (v. 2007-09-25)

description: WScout, lightweight PCAP file visualizer.WScout provides a PCAP traces visualizer that is able to work with huge traces (&gt;10 GiB). Its goals are speed and low memory requirements. Despite its design being protocol-agnostic, it currently handles only Prism and IEEE 802.11 headers, hence its name.File :wscout-1.1.tar.gzBuild :1. What are WScout's requirements?

WScout needs:
- A standard compliant C++ compiler. WScout's developers use GCC.
- GNU make. Or any other make that supports pattern rules using '%'.
- The Boost C++ libraries (http://www.boost.org/). More specifically:
	date_time,
	foreach,
	format,
	conversion/lexical_cast,
	optional,
	smart_ptr,
	tokenizer.
- Trolltech's Qt library (http://trolltech.com/products/qt/), at least version 4.3.
	You will also need some tools provided with this library: 
	the Meta-Object Compiler (moc) and the Resource Compiler (rcc). 
	On some systems (e.g. Debian GNU/Linux) they are provided 
	in separate packages.

2. How do I install WScout?

WScout's packaging follows the GNU conventions. An installation 
documentation is provided in the INSTALL file in the package's root 
directory. However, with a standard system, the following commands 
should do the trick:

---
mkdir _build
cd _build
../configure
make
make install
make check
---

On some systems, you might have to customize the configure script's 
invocation. E.g.

---
mkdir _build
cd _build
../configure CPPFLAGS=-I/usr/include/qt4
make
make install
make check
---


3. Why does WScout's configure check for the libpcap and GMP?

Actually WScout's configure does not check that. But WScout might 
embed a package called trace-tools, which configure script check 
for libpcap and GMP. However, these are optionals, and the build should be 
fine despite you might be missing these packages.

4. configure complains it did not find library X?

Either library X is not installed on your system, either your system is 
not properly configured, so the library cannot be found.

You may use the CPPFLAGS and LDFLAGS variables to correct this 
behavior.

E.g., run

---
./configure CPPFLAGS=-I/custom/path/include/qt4 LDFLAGS=-L/custom/path/lib
---

As an example, on my system (Debian GNU/Linux), I invoke

---
./configure CPPFLAGS=-I/usr/include/qt4
---

5. configure complains it found library X's headers, but is unable to link?

Most probably library X is installed but its binaries are in a non-standard 
place. Use the LDFLAGS variable as described previously.

6. configure complains library X's headers are unusable, despite successful 
linking?

Most probably library X is installed but its headers are in a non-standard 
place. Use the CPPFLAGS variable as described previously.Usage :Basically, WScout provides a multiple tabbed window to visualize PCAP traces.
WScout is able to open very large files. These might take a few dozen seconds 
to load, but WScout will not demand much CPU and memory resources.
WScout is also able to handle PCAP traces with no Prism header. 
You may process your traces with external programs in order to filter them.
Finally, WScout also enables browsing using multiple windows.Lastmodified :2007-11-16Dataname :tools/analyze/pcap/WScoutChange :* WScout 1.1 is released!

  - Middle clicking  when the window system's  clipboard has numerical
    content now go to the  corresponding frame (e.g. Copying "42" into
    the clipboard  then middle clicking  inside WScout goes  to packet
    #42).

    As a side  effect, only left clicks select  packets (middle clicks
    used to select packets before).

  - Duplicating windows does not  re-build file indexes anymore.  This
    allows significant performance improvements on window duplication.

  - Bugfix:  opening  an empty  trace  does  not  result in  a  failed
    assertion.

  - The default filtering command becomes

      sh -c "tshark -q -i- &lt; '%1' -w '%2' -R '%3'"

    So  tshark will not  complain when  asked to  filter big  (&gt; 2GiB)
    files.  But of course, this implies your system must provide `sh'.
    Although no big deal with  UNIX systems (GNU/Linux, BSD, Mac OS X)
    I do not know what this will give with MS Windows...

  - The filter dialog is no more a modal window.Releasedate :2007-09-25References :The WScout websiteWebsite :http://wscout.lip6.frKeyword :802.11
                802.11 frames
                packet trace
                tcpdumpLicense :Copyright© 2007 Université Pierre et Marie Curi- Paris 6

This program is free software; you can redistribute it and/or modify it under 
the terms of the GNU General Public License as published by the Free 
Software Foundation; either version 2 of the License, or (at your option) 
any later version.

This program is distributed in the hope that it will be useful, but without any 
warranty; without even the implied warranty of merchantability or fitness 
for a particular purpose. See the GNU General Public License for more details.Support :1. We are not aware of any bug in WScout. That is why reporting unknown bugs 
to the package's maintainers (thomas.claveirole@lip6.fr) is so important! :-D

2. If you have found a bug, please Report it to the package's maintainers 
(thomas.claveirole@lip6.fr).

3. If you would really love having feature X implemented, then, implement it! ;-) 
More seriously, unless this is a ridiculously simple feature to implement, 
this is unlikely we will do it for you. But giving feedback to the package's maintainers 
(thomas.claveirole@lip6.fr) about the features you want is important. 
So we know if important features are missing.

3. If you want to contribute to WScout and implement some features, 
have a look at doc/HACKING. Again, contact the package's maintainers 
(thomas.claveirole@lip6.fr) so they can help you implement new features.

4. If you have any question, please email the package's maintainers (thomas.claveirole@lip6.fr).Output :Please see sample screenshots at http://wscout.lip6.fr/overview.htmlExample :Please see sample screenshots at http://wscout.lip6.fr/overview.htmlEquiversion :v1.1