extcap capture filter input check

asked 2021-04-12 08:17:04 +0000

thediveo
28 ●1 ●3 ●7

As an author of a extcap plugin I often get asked how to set a capture filter. Of course, there's Wireshark's own interface capture filter configuration dialog hidden in the main UI.

Unfortunately, when user go on capture, they have already opened my extcap plugin's configuration dialog because they need to select some things before an external capture can be started at all; that's due to the nature of the capture targets supported by my plugin.

therefore, I would like to add a capture filter input to the configuration of my extcap plugin to help users. Is there any support beyond a plain "text" input when it comes to capture filters that does the syntax check like Wireshark's integrated UI does?
the capture service to which my extcap plugin connects also features a browser-based UI and a one-click method to transfer the necessary capture parameters into Wireshark and the extcap plugin. Is there a capture filter syntax checker available for Javascript?

Comments

You might also post to the dev mailing list, see here.

grahamb ( 2021-04-12 08:29:51 +0000 )edit

add a comment

answered 2021-04-12 15:32:06 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

Is there any support beyond a plain "text" input when it comes to capture filters that does the syntax check like Wireshark's integrated UI does?

You can use dumpcap with the -d option to, "Dump the code generated for the capture filter in a human-readable form, and exit."

For example, on Windows:

A valid capture filter:

    dumpcap.exe -f "icmp" -d 2>&1 | find "Invalid" > nul
    echo %errorlevel%
    1

An invalid capture filter:

    dumpcap.exe -f "foo" -d 2>&1 | find "Invalid" > nul
    echo %errorlevel%
    0

On Linux:

A valid capture filter:

    dumpcap -f "icmp" -d 2>&1 | grep "Invalid" > /dev/null
    echo $?
    1

An invalid capture filter:

    dumpcap -f "foo" -d 2>&1 | grep "Invalid" > /dev/null
    echo $?
    0

I don't know how well that solution could be integrated with your extcap though.

edit flag offensive delete link

Comments

The catch here is that extcap UI dialogs are handled and processed by Wireshark, not by any extcap plugin ... except for after the fact, when the user presses Start or Save. And then this is almost the same as sending the filter string to the capture server with its own dumpcap and then wait and see what's happening.

thediveo ( 2021-04-12 15:39:31 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

extcap capture filter input check

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

extcap capture filter input check edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

extcap capture filter input check