morteza ali ahmadi's profile - activity

I want to run Tshark dissector from the source file (i.e. tshark.c which is writen in C language) instead of using terminal and the following command:

tshark -r my.pcap ...

So I changed tshark.c main funtion from:

int
main(int argc, char *argv[])
{
  return real_main(argc, argv);
}

to:

int
tshark_main(char arg0[],char arg1[],char arg2[],char arg3[],char arg4[],char arg5[],char arg6[],char arg7[])
{
    int argc=8;
    char* const  argv[] = {arg0,arg1,arg2,arg3,arg4,arg5,arg6,arg7,NULL};
    return (real_main(argc, argv));
}

in order to call the main function from another functions. After that I created a lib consist of tshark.c and other dependecies and made the required include file as follows:

#ifndef __TSHARK_H__
#define __TSHARK_H__

#ifdef __cplusplus
extern "C" {
#endif /* __cplusplus */

#ifdef _WIN32
int
wmain(int argc, wchar_t *wc_argv[]);
#else
int
tshark_main(char arg0[], char arg1[], char arg2[], char arg3[], char arg4[], char arg5[], char arg6[], char arg7[]);
#endif


#ifdef __cplusplus
}
#endif /* __cplusplus */

#endif /* tshark.h */

In the next step, I added the mentioned lib and *.h file to my C++ project and call the tshark_main function as follows:

char arg0[]="";
char arg1[]="-o";
char arg2[]="uat:user_dlts:\"User 0 (DLT=147)\",\"RRC.SI.SIB1\",\"0\",\"\",\"0\",\"\"";
char arg3[]="-r";
char arg4[]="my1.pcap";
char arg5[]="-V";
char arg6[]="";
char arg7[]="";
tshark_main(arg0,arg1,arg2,arg3,arg4,arg5,arg6,arg7);
char arg4[]="my2.pcap";
tshark_main(arg0,arg1,arg2,arg3,arg4,arg5,arg6,arg7);

But, in tshark_main(...) second call (last line) a fatal error appears like this:

** (process:8445): ERROR **: 18:05:33.070: file type short name already exists

I think this error is because of the static variables that is defined in the source file(s) and when I call the tshark_main(...) for the first time every thing is OK and when I call that in second or more times, the variables have changed. As Wireshark can dissect the packets and files over and over, So I need an initialization method or some thing like that which wireshark uses to reset the static variables but I don't know where it is. Also, There may be a second way to reset every thing before calling tshark_main(...) for the second time which I don't know how to do it. Can every one tell me the solution?

@Harris Thanks again for your help. I have to create a pcap file in feed to tshark because I don't know how can I dissec

@jeep Thanks for your reply. OK, I got it. I want to use Wireshark or Tshark API in my C++ projects in which that the us

Thanks, but how Wireshark calls Tshark (i.e main function) for every packet?

thanks, so how Wireshark calls Tshark (i.e main function) for every packet?

The fatal error after running the tshark.c source file on the second time I want to run Tshark dissector from the source

The fatal error after running the tshark.c source file on the second time I want to run Tshark dissector from the source