Ask Your Question
0

How to send tshark output to named pipe in Windows?

asked 2023-10-23 18:09:57 +0000

and08 gravatar image

I am attempting to use tshark to read pcap(ng) files while redirecting the raw packets to a named pipe. From there my C++ application is intended to read data from the named pipe and do custom processing.

Here is the problem. Whenever I attempt to configure tshark to write to a named pipe, it throws me the following error:

tshark: The file "//./pipe/test_pipe" could not be created because an invalid filename was specified.

This is an example command used to run tshark (read 2 packets from PCAP file, send to named-pipe as raw packets):

tshark.exe -r C:\git\example.pcapng -c 2 -w //./pipe/test_pipe

I am creating the named pipe from my application before calling Wireshark, using the code below:

HANDLE pipe_h = CreateNamedPipe(TEXT("//./pipe/test_pipe"),PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT, 1, 1024 * 16, 1024 * 16, NMPWAIT_USE_DEFAULT_WAIT, NULL);

Furthermore, I can see that tshark throws a different error if I do not create the pipe before calling tshark.

tshark: The path to the file "//./pipe/test_pipe" doesn't exist

So this tells me that tshark is finding the named pipe, but not liking it for some reason. I also know that tshark is doing something with the named pipe before throwing the error, because the ConnectNamedPipe from my custom app succeeds once I run the tshark command.

The workflow described above works perfectly fine in Ubuntu.

What am I missing? Is this for some reason not supported in Windows?

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2023-10-28 23:04:40 +0000

André gravatar image

updated 2023-10-30 00:01:17 +0000

Why bother using a named pipe?

Just call tshark from your C/C++ application, either by using FILE* pipe = _popen("tshark ... -w -", "rb"); or by using the functions pipe, fork and execvp.

edit flag offensive delete link more
0

answered 2023-10-24 11:45:12 +0000

Chuckc gravatar image

updated 2023-10-24 11:46:03 +0000

tshark man page:

On Windows systems, pipe names must be of the form "\\.\pipe\pipename".

edit flag offensive delete link more

Comments

Windows also accepts pipe names with the syntaxes "//./pipe/pipename". I like it better because the escape characters can be avoided.

In either case I have also tried using "\.\pipe\pipename" and "\\.\pipe\pipename" and the result is the same.

Thanks!

and08 gravatar imageand08 ( 2023-10-25 01:42:29 +0000 )edit

I don't see a way to make a pipe without firing up the compiler. Found an example using Powershell but not sure it would give same results you are seeing. Sorry.

Chuckc gravatar imageChuckc ( 2023-10-25 23:07:11 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-10-23 18:09:57 +0000

Seen: 321 times

Last updated: Oct 30 '23