Re: DOS Sniffer source code now available

[Denis Ovsienko <denis () ovsienko info>]

On Tue, 13 Oct 2026 09:24:20 -0700
Gerald Combs via tcpdump-workers <tcpdump-workers () lists tcpdump org>
wrote:

> Hi all,
>
> For those of us who remember the original, DOS-based Network General
> Sniffer™️ or are otherwise curious about computing history, its
> source code is now available at
>
> https://dpiconsortium.org/sniffer-protocol-analyzer/

Thank you for posting this Gerald.  That's Token Ring Sniffer, which
subsequently added support for Ethernet.  I might have seen an Ethernet
software-only version in action once, but it could be a false memory.

Anyway, I had a brief look at the published archives and the packet
filtering language syntax looks not entirely dissimilar from "link[]"
in libpcap filters:

ri = 001-110b at hdr offset 27
ri = ---1----b at 16 and 1-------b at 17
dlc = 10------b at 16 or 01------b at 16

Version 2.00 (1998) in one of the documents discusses a capture adapter
with its own Intel CPU and means to compile a filter into x86 machine
code to offload packet filtering to the adapter.  Likewise, Sniffer
1.20 (1987) documentation discusses using a capture buffer, setting
capture parameters, packet meta-data and accounting of dropped packets
when the buffer is full.  Moreover, Sniffer is probably not the first
solution to these classic problems because pre-Berkeley packet filters
seem to date at least as back as 1980, but I know very little about
those.

> In case you aren't familiar with the Sniffer, it pretty much defined
> and dominated the network protocol analysis industry at the time.

It is worth noting that Sniffer emerged a bit before the 1986 release
of Sniffer 1.00 by the freshly incorporated Network General.  As [1]
explains on page 9, Sniffer 1.00 was a rewrite of the original TART
(nicknamed Sniffer), which Nestar Systems acquired in 1982 as an
internal lab tool.  TART was an ARCnet appliance and its key element
was a modified RIM (resource interface module, or a network adapter in
modern parlance).

Likewise, Sniffer 1.20 (1987) documentation discusses custom hardware
modifications required in a certain Ethernet adapter to turn it into a
promiscuous packet capture device.  My first local computer network
experience was in 1995 with a 10Base-2 Ethernet segment, which used
no-name NE2000 clones.  Due to hardware shortcuts these worked in
permanent promiscuous mode: when any PC accessed large files on the
network disk, all PCs became notably slower because the NIC driver was
receiving a lot of interrupts for irrelevant frames.  Some years
earlier it would have been a nice fit for the Ethernet Sniffer.

As it turns out, there is a hyperlink to the source code [2] of the
"TART" Sniffer in Wikipedia.  That's BASIC on scanned paper rather than
C in files, but if a better version was available, then Len Shustek (a
founder of both Nestar Systems and Network General) would likely publish
that instead.  Worth having a look as well.

1: https://arcnet.cc/resources/HistoryATA.pdf
2: https://github.com/LenShustek/NestarSystems

-- 
    Denis Ovsienko
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s