Ask Your Question
0

Do we need a pcap header format to display captured packets via named pipes on Wireshark?

asked 2019-05-12 12:27:10 +0000

stanumes gravatar image

I have a C code that creates a socket to receive packets from the COM port on Windows. I have created a named pipe in a similar manner. Now, do I need to add a pcap header to the read bytes to display them on Wireshark or is there any other possibility?

I'm a beginner and any insight on this is much appreciated. Thank you.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2019-05-12 17:04:38 +0000

grahamb gravatar image

Wireshark supports external capture programs via the extcap interface. Wireshark does support capturing from any source over a pipe (sending pcap data over the pipe), extcap allows the Wireshark GUI to control the external capture program.

edit flag offensive delete link more

Comments

Which means I have to add the named pipe under extcap folder?

stanumes gravatar imagestanumes ( 2019-05-13 13:25:21 +0000 )edit

See the Wiki page on capture pipes here. The extcap directory is for extcap interfaces, for other pipes the binary can be anywhere. The pipe doesn't live on the filesystem.

grahamb gravatar imagegrahamb ( 2019-05-13 14:53:02 +0000 )edit
0

answered 2019-05-12 14:16:41 +0000

Jaap gravatar image
edit flag offensive delete link more

Comments

Could you please explain/provide a reference regarding how I can add the header to my named pipe C code?

Thanks!

stanumes gravatar imagestanumes ( 2019-05-12 15:20:35 +0000 )edit

I kinda did, have you seen the linked Wiki page? It shows the structures which go in front of the stream and in front of each packet.

Jaap gravatar imageJaap ( 2019-05-13 05:53:33 +0000 )edit

Too sneaky ;-)

Jasper gravatar imageJasper ( 2019-05-13 10:00:43 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-05-12 12:27:10 +0000

Seen: 51 times

Last updated: May 12