Ask Your Question

How to creat a pipe?

asked 2017-12-08 03:28:38 +0000

ehehe gravatar image

Question: Wireshark supports a lots of protocols, it is very nice! Howere, any data is exchanged using USB, such as COM3. I can use wireshark to capture the data, but wireshark analysis data in USB, I can just watch the data hex code, I want to wireshark analysis the data in select protocol.

I used a tool which can creat a pipe(\.\pipe\pipe1) and capture data from COMx, when I chose this pipe in wireshark, wireshark only analysis the data exchanging in USB, rigth protocol instead of USB protocol.

Is there any guide for how to write this kind tool, or any other ways to solve question?


edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2017-12-08 13:01:53 +0000

sindy gravatar image

This is several questions in one.

The best way to feed Wireshark with data using a pipe is to use the extcap API, which allows Wireshark to learn the properties of the capturing interface, packet format etc. and indicate to the capturing process which pipe to use. You can do that manually as well but it is not convenient for repeated use.

Regardless how you start feeding Wireshark through a pipe, the data fed to the pipe have to follow the pcap or, which is a recent improvement, pcapng format.

And regardless whether you encapsulate your application data into a pcap(ng) record directly or whether they are encapsulated in e.g. USB URBs, you need a piece of software called dissector to convert the binary data of a given protocol into a human-readable form. The dissector needs to be pointed to the portion of data it is responsible for, which is usually accomplished by means of so dissector tables.

The instruction how to write a dissector and hook it to the right place of the dissector tree can be found here. You can also use the Lua API for Wireshark for rapid prototyping of dissectors - look here.

Specially for generic analysis of serial connections, it makes sense to make the transport layer PDU (Protocol Data Unit) a single byte, because it is the only way how to provide each byte with its own timestamp. If you do that, you'll likely have to use reassembly to complete the application layer PDUs (like e.g. modem AT commands).

Also, if serial connections are what you are really interested in, you may use virtual serial ports linked to Serial over LAN adaptors and capture the IP communication between your machine and the adaptor.

edit flag offensive delete link more


Thanks for your so much detailed answer firstly!

You write a lot, and I basically understand how to do, it means I have to learn and do a lot. I will ask you much (after have searched in internet), hope you do not be impatient, thanks again!!

ehehe gravatar imageehehe ( 2017-12-12 06:28:38 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-12-08 03:28:38 +0000

Seen: 39 times

Last updated: Dec 08