Extcap - how to use Messages Control Protocol
Hello Wireshark folks,
I have created an ExtCap that capture 802.15.4 (ZigBee) packets and pipe them to DLT Link Type 283. The capture works great and packets are well displayed in Wireshark GUI.
I wish to display some extra information to the user (the channel being monitored) in the status bar. That way when multiple instances of Wireshark are capturing, it will be possible to identify what channel is being monitored by a particular instance. I have tried to use Messages via the Control Protocols but I just can't make it work.
So the questions are: - How to display status bar messages using extcap? - The documentation refers to a control pipe (8.2.3.2.1), is a control pipe needed?
Any clue would appreciated.
My extcap is written in C and compiled for Windows.
Thanks
Have you looked at extcap_example.py?
(more)There are steps to test in middle comments of 14532: extcap: InterfaceToolbar control pipe broken:
I took a deeper look at the python example.
From trial and error using the python example, I was able to figure out that Wireshark will provide control pipes for control operation. The control pipes are provided with command line parameter "--extcap-control-out" and "--extcap-control-in".
These pipes are only provided if the extcap listed a "control" interface during Query For Available Interfaces ("--extcap-interfaces").
For example, responding to --extcap-interfaces with the following: interface {value=COM9}{display=Capture using COM9} control {number=0}{type=selector}{display=Channel}{tooltip=ZigBee Channel}
The presence of "control" interface indicate to "The Extcap Capture Process" to provide --extcap-control-out and --extcap-control-in at capture invocation. So the above example will result in capture started with the following arguments --capture --extcap-interface COM9 --fifo \.\pipe\wireshark_extcap_COM9_20221107203022 --extcap-control-out \.\pipe\wireshark_control_ext_to_ws_COM9_20221107203022 --extcap-control-in \.\pipe\wireshark_control_ws_to_ext_COM9_20221107203022
The named control pipes can then be used by the extcap.
Thanks
Please report back if/when you get this working. :-)
The toolbar and status bar were added in Qt: Add interface toolbar support to support nRF Sniffers extcap interfaces which are written in Python.
None of the Wireshark extcap interface code written in C uses
controlso if you get a working example that would be great to close the loop that it is doable in C.An extra paragraph in the WSDG with more info might save someone else heartburn down the road.
Yes it works. I am able to display text in the status bar sent from the extcap.
Both control pipes are opened the same way as the data pipe. That is using CreateFile and ConnectNamedPipe. I spun a thread using _beginthread to handle the control input pipe, similar to the python example mentioned above.
I agree with your comments about an extra paragraph in Wireshark doc would have helped. Thanks for pointing me to the python example.
Cheers!