WIRETAP Reading file?

Thanks Anders,in text2pcap.c we are preparing the libpcap format(Global header,Record header,data,Record header,data ...) right? In that line 1854 we are opening a file in read mode,from where we are getting this file to read and from where this argc & argv are coming(who is running this .c file with command line arguments).Actually i want to see that file by opening it.

Similarly in capinfos.c we are opening that file and preparing wtap structure by reading that file in function wtap_open_offline() in which first argument is file.I want to know where its taking that file

Actually i want to create packet to display on wireshark,so my plan is that i want to mimic my packet as it is like libpcap format and want to give to wiretap so that wiretap will display the packet in wireshark.So i want to see the packet that libpcap is preparing for wiretap.

Exactly i want to know where we are feeding this packet to wiretap.

    Correct me if am wrong.

Thanks, Karun.

This might be better to discuss on the dev mailing list rather tha on a Q&A site...

I think we need to understand what you are trying to do on a higer level to be able to asnswer your questions better.

Actually i want to create packet to display on wireshark

What do you mean by this? Fire up wireshark from within your application and feed it the data? Create a pcap(ng) file and read that into wireshark afterwards? Perhaps you could feed the data to wireshak trough a pipe or have tshark deissect it and present the text output? Create a packet from what? If you are processing a log file with mixed text and packet hexdata you could perhaps write code to have Wireshark read the file directly.

Exactly i want to create packet from my application and feed the data inorder to display in wireshark.I had taken development release 1.99.5 for windows 7. My intension is to prepare my packet and keep it in winpcap format and feed it to wiretap(rest will take care by wiretap right?).

You should maybe look into extcap. That allows applications that aren't a "network interface" to send data to Wireshark.

Unfortunately extcap is very poorly documented at the moment. There should be a man page (extcap.html) for it in an installed copy of the dev release and an example application in source doc\extcap_example.py. There is als an older SharkFest presentation here.

If you need more info about extcap the best place to ask would be on the Wireshark developers mailing list.

Thanks grahamb, can you share me the developers mailing list.Actually is it possible as i discussed in my previous mail,will it works? other than extcap.

Thanks Harris,you kept me in write path.Dumpcap then writes the packets to a pcap or pcap-ng file?. Where is this file? whats the name?

Network interface --->dumpcap--->pcapio.c--->{the capture file}--->wiretap--->Wireshark

In above scenario where i can find the capture file.

Once capture file is created capinfos.c reads it and print some summary data for it right? then its followed by wireshark reading that file using wiretap and make it display to end user right?

Once every thing is ready How & where wiretap is using that file meaning that
capture file--->(?)--->wiretap--->(?)--->wireshark. Where we are feeding the packet to wiretap and how wireshark is using the file(or something) to display that packet from wiretap.

Can you give me the clear idea(file names will be more appreciated with functionalities) about capture file to wiretap & to wireshark(end user display).

Thanks for your patience answering.

Actually i want to create one packet(By some application) inorder to display in wireshark with out having any n/w device.can you suggest me best method to do that?.

My plan is like to prepare my packet in specified(winpcap) format by using functions of pcapio.c and prepare one capture file then wireshark reads that packet using wiretap to display is it ok?

***I am working on windows platform**

As I mentioned earlier, I think extcap is the solution for you. It allows non-network devices to pass data into Wireshark for dissection and display.

Actually i want to create one packet(By some application) inorder to display in wireshark with out having any n/w device.can you suggest me best method to do that?

Use WinPcap. Have your application call pcap_open_dead() with whatever link-layer header format you want (for example, Ethernet, or "raw IP" with no link-layer headers), and then use the resulting pcap_t to open an output file with pcap_dump_open(). Then have it construct the packet, with all the protocol layers - including the link-layer header you want, if there is one - and write it out with pcap_dump(), and then call pcap_dump_close(). When your application finishes, it will have written out the file. Open that file in Wireshark.

My plan is like to prepare my packet in specified(winpcap) format by using functions of pcapio.c and prepare one capture file then wireshark reads that packet using wiretap to display is it ok?

"WinPcap format" is pcap format; WinPcap will write out files in that format. libpcap/WinPcap was designed to be used as a library by applications; the pcapio.c code was written solely for use within Wireshark and really isn't designed for somebody else to use in their own program.

Thanks Harris,I will try to follow your suggestion.I want to conform one thing,I had taken winpcap latest source code by going through the code from pcap_open_live i encountered probe function where i found PktReceive function(as mentioned below), in that copying actual data into buf from &head->destin,Where we are filling this destin?. PUBLIC int PktReceive (BYTE buf, int max) { WORD inOfs = rxInOfsFp; WORD outOfs = *rxOutOfsFp;

if (outOfs != inOfs)
{
  RX_ELEMENT _far *head = (RX_ELEMENT _far*)(protBase+outOfs);
  int size, len = max;
if (CheckElement(head))
{
size = min (head->firstCount, sizeof(RX_ELEMENT));
len  = min (size, max);
_fmemcpy (buf, &head->destin, len);
}
else
size = -1;
outOfs += sizeof (RX_ELEMENT);
if (outOfs > LAST_RX_BUF)
outOfs = FIRST_RX_BUF;
*rxOutOfsFp = outOfs;
return (size);
}
return (0);

}