Hi there!

Is there such a thing as a traffic/protocol analyzer for X11? I have a
self-written application (using the old XView toolkit), and under certain
circumstances some dialogs do not react. I had this 2 years ago under KDE
3.5, and some people now experience the same when SSH'ing from an OS X
machine into openSUSE or into my gentoo machine. I'd like to see what is
going on there.

A web search only found Xmon, but with most download links being dead,
even on sourceforge [1] there is nothing to download. But I finally found
a working download link on ubuntu.com [2]. The package does not compile,
but I only had to comment out one line. According to the man page, the
command 'xmonui | xmond' would create another X server (localhost:1), and
I would set the DISPLAY variable to this when starting my application.
xmond will use localhost:0, that is, the real X server, to display my
application, but it will output all X traffic. So it is sort of a proxy to
the real server.

Alas, it does not work, I get a 'Can't open display' error, and xmond
outputs 'Can't open connection to Server (ECONNREFUSED)'.

Any other ideas?

Wonko

[1] http://sourceforge.net/projects/xmon/
[2] http://packages.ubuntu.com/hardy/xmon

Alex Schuster <wonko <at> wonkology.org> writes:


> Is there such a thing as a traffic/protocol analyzer for X11?

Dunno, but, I'll look into using NMAP for it, as there are
thousands of protocols, even some very obscure ones, that
you can sniff/analyze with Nmap. I'd be surprised if X11
cannot be sniffed with Nmap.....

Or coarse, you might have to do something non standard, like
debug it across an interface (between different computers).


immv,
James

Apparently, though unproven, at 19:28 on Wednesday 08 September 2010, James
did opine thusly:

> Alex Schuster <wonko <at> wonkology.org> writes:
> > Is there such a thing as a traffic/protocol analyzer for X11?
>
> Dunno, but, I'll look into using NMAP for it, as there are
> thousands of protocols, even some very obscure ones, that
> you can sniff/analyze with Nmap. I'd be surprised if X11
> cannot be sniffed with Nmap.....
>
> Or coarse, you might have to do something non standard, like
> debug it across an interface (between different computers).


You said nmap, did you not perhaps mean tcpdump?


--
alan dot mckinnon at gmail dot com

Wireshark has an X11 decoder. For tcpdump you could try -vv or -vvv but i would just go straight to wireshark it will almost certainly be more useful. Of course if its inside an ssh tunnel you will only see ssh with a packet sniffer. If you're on the local box sniff lo0.

Adam Carter writes:

> Wireshark has an X11 decoder. For tcpdump you could try -vv or -vvv but
> i would just go straight to wireshark it will almost certainly be more
> useful. Of course if its inside an ssh tunnel you will only see ssh
> with a packet sniffer. If you're on the local box sniff lo0.

Thanks! I think this will help me with my problem.

I had to start a 2nd X server to test this, though. Nowadays, X starts
with '-nolisten tcp' option, and so there is no communication over port
6000. But when I started another X server manually, and changed the
DISPLAY variable from ':1' to 'localhost:1', I saw the X traffic on port
6001.

Thanks again,

Wonko

Alan McKinnon <alan.mckinnon <at> gmail.com> writes:


> You said nmap, did you not perhaps mean tcpdump?

Brain fart, actually I was think of wireshark....


James