Probably time to get started.
I'm Gerald Cummins, the creator and lead developer of Wireshark.
Also, we're a bunch of other hats including working in System and part of the Wireshark
Foundation.
Early on in my career, I worked in an ISP where I accidentally deleted the candidacy
website.
I thought I'd mention that since they're going to be in the Super Bowl soon.
But that also goes into what I did at that ISP.
At that ISP, we had a bunch of big-name clients like the Chiefs in AT&T and Apple
and a few other big companies.
And I needed to support them as best I could and make sure that network was reliable.
And at a previous job I worked at a university where we had a sniffer,
which was this thing made by network general.
It was this huge piece of gear that was about as cost about as much as a luxury car.
And I would lug it around the campus and plug it in and troubleshoot the network.
And I didn't have this at that ISP.
And every time I asked for a sniffer, they said, no.
Because it just wasn't in the budget.
Plus, I think the executives probably wondered why I wanted this thing that cost as much of their car.
But I finally broke down and said, fine, I'll see if I can write my own protocol
analyzer and just seem like the thing to do.
And at that point I'd used open source quite a bit in my career and thought,
well, that would be a good way to give back to the open source community
because I had benefited from all this software that other people had written.
And so that kind of crystallized into the original goal and writing what was back then a
thrill, which we remember later renamed to Wireshark.
And as you can see, that was the original goal of the project.
Now to get going on the project, you had to remember this was in 1998.
This was before GitHub.
This was before GitLab.
This was before source forge, which was, I don't know if it would be remembered that even.
But you can, okay, you're giving away the fact that you're old.
So I went on this brand new, I guarantee it was brand new website called eBay.
And I bought a server and installed a bunch of software to be able to host this project.
And as you saw the title, the talk was Wireshark Eology and it wouldn't be a good
archeology presentation without a relic.
Is it not adorable that you just want to give it a hug?
But in order to host the project, like I said, you kind of had to do everything yourself.
And so I would go around to different ISPs around town because I knew had a lot of friends that worked at these different ISPs.
And I would trade consulting time for hosting.
And that works, I don't know, for about three or six months.
And veryably, I get a call from whoever was hosting the box at the time and they'd say, look, we're being acquired.
And right now we're doing inventory and your box cannot be on inventory.
You had to come and get it.
So on at least two occasions I transported this under the cover of darkness from an ISP to another to make sure that we had continuous coverage for the box.
So at the same time, and I'm going to point to some people here and say it's their fault.
But at the same time, the project was growing.
I kept getting contributions from people around the world.
And so my job was to kind of keep up with them.
And so the original goal expanded.
It went from supporting just Linux and Solaris, which were, you know, the OSIS that I ran at work to supporting
other un-exoperating systems.
And then there were these two grad students in Italy.
I mean, there's Dijonian Jean-Luc of Brittany, who developed this thing called Win Peacap.
And that let you do pack a capture on Windows.
And so suddenly we had a whole bunch of Windows users.
And the project really grew at that point.
I mean, that was instrumental in making sure that everybody could use the three of them.
And later on, we added support for Mac OS.
And so as you can see, the goal keeps growing and growing and growing.
And due to the nature of the application, you know, you have to know about protocols and how they work.
And in order to use a protocol analyzer effectively.
And so our community grew to include educators.
And a whole bunch of other people and students in security researchers on and on and on and on.
And so it kind of crystallized that down again.
The goal evolved into helping as many people as possible.
And you know, that's kind of been the goal for the project for a very long time.
To get to that goal, you have to do a lot of things.
You have to ensure that the developers have the tools they need to develop and contribute to the project.
You need to make sure that the application is easy to obtain and install.
You know, something that I've always tried to pay attention to throughout the life of the project is.
You know, how easy or difficult is it if starting from zero and going to the website and getting you know,
how easy or difficult is it to go from there to having packets in front of your face.
And so that includes things like code signing certificates.
You know, you don't want to download this thing and have your operating system complain that it's not secure and you can install it.
So that's a lot of stuff that I have to pay attention to.
And again, you have to make sure the community has access to educational resources just due to the nature of being a protocol analyzer.
So to get to that goal, you ultimately need a business model.
And you know, the previous presentation talked about the business model that used for Sir Codden and ours is kind of similar.
I originally started out as you can see with this box having no business model, which if you can get away with that, that's the best thing to do.
Nowadays, it's really easy. You just go to get how we get lab and throw your project on the server and and you're done.
The thing to keep in mind about getting up and get lab though is the services they offer are services they can automate.
Services that can throw compute that.
Get up and get lab have, you know, buttons that let you open a polar quest or a merger quest or open up an issue.
They don't have buttons that connect you to a lawyer or an accountant and that's very important at least in our case.
So, you know, that's something they had to take care of.
And so the model that we ultimately, initially went with was something I call corporate overlord or just asked my boss to back in host the box where I work and that's what I went with initially.
And that's probably the second easiest model.
And it's one that we stuck with for a very long time.
Originally, we had a corporate sponsor named network integration services and that's when we were still ethereal.
A little while later on.
I don't want to give Windows XP a lot of credit here, but but they do deserve some credit.
Windows XP was instrumental in a serial becoming wire shark because Windows XP had such terrible wireless drivers.
In the middle of the 2000s.
In the middle of the 2011 was getting very, very popular and very, you know, it was everywhere but it wasn't very reliable and we have a bunch of users because of one pcap.
On Windows who are saying, you know, I want to capture on Windows, but I can't.
What would happen is you fire up the serial.
Try to pick your wireless driver into monitor mode and it would shut down.
Which, you know, that's not useful behavior.
So, I send an email to the developers of one pcap and at that time they started a company called case technologies.
And, you know, we went back and forth a few times and it ultimately developed something called, well, I say, we, but it was lorys.
He developed something called air pcap, which was this little dedicated USB wireless adapter that let you capture packets at the same time.
After I went and joined case technologies, I had to leave the name, a serial behind because network integration services on that trademark.
And so that's how we became more a shark.
A lot of other stuff happened to case we started up shark fest, which is our developer and user conference and we're able to expand our educational initiatives and teach people how to analyze protocols.
We did so well at case that a company called a riverbed acquired us and then maybe came our corporate overlord and a few years later, Lori founded another company called system and I joined system in 2021.
So, as convenient as your employer funding your project is, you have to keep in mind, you're probably going to run into a couple of single points of failure.
One big single point of failure was me on the Linux side, I remember they used the term bus factor, but the problem there was that I was typically the only person employed at that company who was also working on the project.
So I was the only one legalized, authorized to go purchase services, I was the only person who was able to do a lot of stuff like that.
And that was a concern that built up over time. Another concern is that if you have only one entity funding your project, you kind of run into financial risks.
The worry I've always had and I don't want, I mean, well fine. The worry I always had was okay, what if we get bot bot Oracle? What happens then?
So, I mean, I'm in a room full of networking people, what do you do with single points of failure? You get rid of them.
And so that's what we worked on. We looked at a couple of options. The first one we looked at was joining an umbrella organization and there are a lot of great umbrellas out there.
But they, early I mentioned that having labed don't connect to lawyers and that's what umbrellas do. They provide services that involve that require humans.
They can do accounting for you. They can provide IP, bot legal services. And they can be a great choice.
And if your project is of a certain size that needs the sort of thing, I do recommend that you look into an umbrella.
Our problem was we already had our own organization. We had a team of people that did our conferences.
And so, you know, once we had that in place, we kind of didn't fit well with all the umbrellas that we've talked to. So, we finally came to our last option for a business model.
And I'll throw up this quote here.
I love this quote, but it's not real.
Winston Churchill never said this, but he gets credit for it.
But after exhausting all of our possibilities, we said fine. We're going to start up our own nonprofit.
And that's what we did. We, with the help of cystig, set up the Wireshark Foundation.
And this is the, you know, the first part of the letter just to explain what's going on here.
Especially since I'm in Europe, I should explain that the letters and numbers at the top 501c3, that's a section of the US tax code.
That's the section that says, all right, if your organization operates under these rules, then we can designate you as a nonprofit.
And that means that people can donate money to you and get tax benefits from that and things like that.
But just, this is just to say that the Wireshark Foundation is set up as a public benefit corporation as a nonprofit.
And that's what we used to support the Wireshark project now.
But in my work at cystig, since we're kind of expanding into system calls and logs and stuff,
that original goal has expanded just a little bit to, you know, from helping people, as many people as possible,
understand their networks as much as possible to throwing end systems in there.
And so, one of the things I'm really excited about is what I'm working on right now, a strider shark.
So, as the future direction of the project, we've kind of expanded out into looking beyond network packets and doing deep analysis of systems.
You know, at the system call level and at the log level.
So, you know, since you're all networkers, maybe you don't care about system calls, but I'm sure you have a gear that generates logs.
And so, you can pull those logs into strider shark.
We also have some other stuff that I can announce yet, sorry.
But, you know, keep an eye out for some announcements in the next few minutes.
So, as a bit of thanks, and I always try to do this at every talk, I have to say that, you know, Wireshark is a great and wonderful thing,
but it's not because of me.
It's especially because of this group, because of all the networks out there that contribute to the project,
either, you know, it's a writing code or through education, or just being a user of this project that's really useful.
So, I can't thank you enough.
Thanks.
Any questions?
No, the spark station has no power supply at the moment, so.
Any other questions?
My presentation wasn't that complete.
I mean, come on.
Just for sake of interest, now that you're pivoting into looking deeper into systems and logs,
or you worry that the original mission of Wireshark will change and what implications it has for you.
Because of my position, I worry about everything all the time.
But that was kind of a concern.
In a way, I'm not, you know, Wireshark is still Wireshark, and we still have this wonderful community.
It's just that we're kind of growing that community.
At least that's the way I look at it.
But that's a very good question.
How did you navigate any friction that happened by transferring, like, from one company to another, moving from a company to another,
just moving the Wireshark team around, how was that for you?
Was there any friction in that for difficulties?
Probably, well, the big friction was when I moved to case technologies and changed the name.
You know, everybody, the news at the time was that, you know, there was a new fork of the material, and I'm thinking it's not a fork.
We just changed the name.
I mean, seriously, when I said that I was moving to case, the, I was freaking out internally.
I had a newborn daughter at the time, and I was figuring out the parking go, okay, what am I doing here?
But to their credit, the development community, especially the court development team, their response was, okay, where's the new repository?
Let's go.
And, you know, I got a lot of support from the community, which I'm grateful for.
Thank you very much.
How did you make sure that another company said you worked for claimed ownership of the project, and basically stole it underneath you?
I'm sorry.
How did you make sure that all of the companies that you worked for with Wireshark?
How to make sure that I didn't own, sorry, claim ownership of the project?
I, again, that goes to the development team.
They, you know, were very great at supporting me as an individual leading the project.
And so, you know, that plus the fact that it's, you know, released under the GPL, you know, you can't really steal the GPL.
At least not, you know, effectively or legally or easily.
So, it, I mean, if the company really wanted to have taken control of the project at various points, I'm sure they probably could have that, fortunately for us that didn't work out the way.
Thank you.
Thank you for a wonderful presentation.
Regarding the system call tracing, are you right now targeting more unique like operating systems or windows side of things too?
Right now, we only support this call tracing on Linux.
Just due to the fact that you can write a kernel model and bring an EPS, EBPF.
And we, you know, having windows system call tracing and macOS system call tracing would be very useful, but I don't know when that might happen.
Thank you.
I've been using wire shark for many years when it's still at the old name.
All is amazed by the amount of protocols you support, but DIA still have protocols that need a lot of help and love because we're here with a lot of developers.
Someone might be able to contribute.
I, you're right.
I mean, we're always need, we always need support for new and different protocols.
So, if you would like to contribute, we have some of the core developers here if you want to talk to them.
First of all, thank you for the great talk.
Since you mentioned you needed this kind of access to lawyers and accountants, but was there ever a need to press that hypothetical lawyer button?
There's kind of a continued need.
You know, people want to use the trademark for, say, a book or, you know, some other publication.
You know, we need to enter a agreement with them to do that if they want to use the logo and things like that.
So, you know, it's not like we've had to run to the lawyer for some sort of emergency where we need to, you know, enter litigation.
But there's all, there are content, you know, there's a continuous need for just business agreements and that's where the legal help comes in.
All right.
Cool.
Thank you very much.
Thanks.
Thank you very much.