Do we need a pcap header format to display captured packets via named pipes on Wireshark?

namedpipes

asked 2019-05-12 12:27:10 +0000

stanumes
1 ●2 ●2 ●3

I have a C code that creates a socket to receive packets from the COM port on Windows. I have created a named pipe in a similar manner. Now, do I need to add a pcap header to the read bytes to display them on Wireshark or is there any other possibility?

I'm a beginner and any insight on this is much appreciated. Thank you.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-05-12 17:04:38 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

Wireshark supports external capture programs via the extcap interface. Wireshark does support capturing from any source over a pipe (sending pcap data over the pipe), extcap allows the Wireshark GUI to control the external capture program.

edit flag offensive delete link

Comments

Which means I have to add the named pipe under extcap folder?

stanumes ( 2019-05-13 13:25:21 +0000 )edit

See the Wiki page on capture pipes here. The extcap directory is for extcap interfaces, for other pipes the binary can be anywhere. The pipe doesn't live on the filesystem.