Utilizing Wireshark Dissection Engine over IPC

asked 2020-01-01 11:25:18 +0000

Itayg gravatar image

updated 2020-01-01 11:28:20 +0000


I was wondering if there's an existing open-source project that exposes Wireshark's dissection engine over IPC. I'm aware that it's possible to retrieve the dissection results from tshark via XML, but that might prove too slow for projects that have to deal with large amounts of traffic.

Ideally, on one end this wrapper would receive a stream of raw packets (libpcap format) and on the other end it'll send the resulting parsed data meta-struct.

I'm tempted to try to develop such a solution myself, but I wanted to verify that there isn't such an existing solution before I do so.

Thanks! Itay

edit retag flag offensive close merge delete