[gentoo-user] X11 traffic analyzer

[gentoo-user] X11 traffic analyzer

[Alex Schuster]

Hi there!

Is there such a thing as a traffic/protocol analyzer for X11? I have a 
self-written application (using the old XView toolkit), and under certain 
circumstances some dialogs do not react. I had this 2 years ago under KDE 
3.5, and some people now experience the same when SSH'ing from an OS X 
machine into openSUSE or into my gentoo machine. I'd like to see what is 
going on there.

A web search only found Xmon, but with most download links being dead, 
even on sourceforge [1] there is nothing to download. But I finally found 
a working download link on ubuntu.com [2]. The package does not compile, 
but I only had to comment out one line. According to the man page, the 
command 'xmonui | xmond' would create another X server (localhost:1), and 
I would set the DISPLAY variable to this when starting my application. 
xmond will use localhost:0, that is, the real X server, to display my 
application, but it will output all X traffic. So it is sort of a proxy to 
the real server.

Alas, it does not work, I get a 'Can't open display' error, and xmond 
outputs 'Can't open connection to Server (ECONNREFUSED)'.

Any other ideas?

	Wonko

[1] http://sourceforge.net/projects/xmon/
[2] http://packages.ubuntu.com/hardy/xmon

[gentoo-user] Re: X11 traffic analyzer

[James]

Alex Schuster <wonko <at> wonkology.org> writes:


> Is there such a thing as a traffic/protocol analyzer for X11? 

Dunno, but, I'll look into using NMAP for it, as there are
thousands of protocols, even some very obscure ones, that
you can sniff/analyze with Nmap. I'd be surprised if X11
cannot be sniffed with Nmap.....

Or coarse, you might have to do something non standard, like
debug it across an interface (between different computers).


immv,
James

Re: [gentoo-user] Re: X11 traffic analyzer

[Alan McKinnon]

Apparently, though unproven, at 19:28 on Wednesday 08 September 2010, James 
did opine thusly:

> Alex Schuster <wonko <at> wonkology.org> writes:
> > Is there such a thing as a traffic/protocol analyzer for X11?
> 
> Dunno, but, I'll look into using NMAP for it, as there are
> thousands of protocols, even some very obscure ones, that
> you can sniff/analyze with Nmap. I'd be surprised if X11
> cannot be sniffed with Nmap.....
> 
> Or coarse, you might have to do something non standard, like
> debug it across an interface (between different computers).


You said nmap, did you not perhaps mean tcpdump?


-- 
alan dot mckinnon at gmail dot com

[gentoo-user] Re: X11 traffic analyzer

[James]

Alan McKinnon <alan.mckinnon <at> gmail.com> writes:


> You said nmap, did you not perhaps mean tcpdump?

Brain fart, actually I was think of wireshark....


James

Re: [gentoo-user] X11 traffic analyzer

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 272 bytes --]

Wireshark has an X11 decoder. For tcpdump you could try -vv or -vvv but i
would just go straight to wireshark it will almost certainly be more useful.
Of course if its inside an ssh tunnel you will only see ssh with a packet
sniffer. If you're on the local box sniff lo0.

[-- Attachment #2: Type: text/html, Size: 281 bytes --]

Re: [gentoo-user] X11 traffic analyzer

[Alex Schuster]

Adam Carter writes:

> Wireshark has an X11 decoder. For tcpdump you could try -vv or -vvv but
> i would just go straight to wireshark it will almost certainly be more
> useful. Of course if its inside an ssh tunnel you will only see ssh
> with a packet sniffer. If you're on the local box sniff lo0.

Thanks! I think this will help me with my problem.

I had to start a 2nd X server to test this, though. Nowadays, X starts 
with '-nolisten tcp' option, and so there is no communication over port 
6000. But when I started another X server manually, and changed the 
DISPLAY variable from ':1' to 'localhost:1', I saw the X traffic on port 
6001.

Thanks again,

	Wonko