We're developing a simulation environment where we can simulate PLC controllers. The controllers can communicate with each other via (virtualized) communication ports. We'd like to use Wireshark to monitor traffic on these virtual ports. How can we do this?
As Wireshark uses the npcap library to capture the packets, it is more of a question for the npcap team. Since the virtual ports are not visible to the OS, I suspect they are not visible to npcap either. You could work with the npcap team to make the interfaces seen.
Another option would be to use an extcap interface. But then you would somehow need to have access to the packets on the virtual ports. If you can somehow export the packet data on the virtual ports, you could write an extcap module to make those packets available in WIreshark.
Asked: 2026-03-10 07:38:39 +0000
Seen: 107 times
Last updated: Mar 11
Maybe you can start to help us help you by giving more information. What kind of OS is the simulation environment using? How are the virtual ports created? Are they visible to the OS? Are they visible to libpcap/npcap? Are all the PLC controllers simulated on the same host?
Simulation environment run on Windows OS. The virtual ports are not visible to the OS. They are created inside the simulation environment. All the controllers are simulated on the same host.