Using libwireshark to get Wireshark functionality programmatically

Question

If I want to write a script that uses Wireshark\'s functionality, I use tshark. I hear there is also a libwireshark that can be used when writing a program in C but, for the lif

Answer 1

It's certainly possible to use libwireshark outside of Wireshark itself, as I know netexpect does just that. You might try looking on that project's website for information or you could try contacting Eloy Paris, the author of netexpect, for further help/pointers.

Answer 2

Yes! you can get that functionality by using libwireshark. i have written whole code to do the same. it just works great.

Answer 3

Even I have written scripts for wireshark functionality as a part of my project for automation of some things.

The best this to do is use wireshark addons like follows:

1. tshark to add pcap file, applying filter,but if you find any feature missing there just edit tshark.c in wireshark source code.
2. capinfos to give details such as no of packets or file size etc. (there is a script called capinfos in wireshark source code edit it if you want more features)

Please note add-ons work only in Linux and capinfos is written in shell script. So you can use the same shell scripts and create new scripts for better functionality.

Even I had faced a lot of problem initially as there is no proper documentation. But once you start it goes smoothly.

Answer 4

No.

libwireshark is not intended to be used outside of Wireshark itself, and trying to do so will leave you on your own for trying to figure out what is going wrong. libwireshark actually part of the packet analyzing portion of Wireshark (called epan for Ethereal packet analyzer), which you can see in the Developer's Guide is not all of Wireshark. What libwireshark actually provides is the main interface for all of the built-in protocol dissectors, hooks for the plugin dissectors, and the complete packet dissection API. It relies on the machinery set up by the rest of Wireshark for things that are not directly packet dissection tools, but enable the dissectors to do their work (e.g. allocate a deallocate memory chunks, handle compressed or encrypted data, etc).

Write a dissector in stead.
If your project is to strictly analyze network traffic in some way, you might want to consider writing a dissector for Wireshark rather than reinventing the many wheels that Wireshark could provide for you. If you need to do something more complex, like monitor network traffic and then kick off other tasks or send data yourself, you are probably better off using tshark and shell scripting as you already are (keep in mind that you shouldn't let tshark run for extremely long periods of time in any case).

If you really, really want to use libwireshark directly, you will need to resolve all of its dependencies somehow (preferably by making it an actual stand-alone library) and provide for the assumptions it makes about Wireshark (or tshark) actually being running. The code for libwireshark is all well organized, it's just that it consists of the entire epan directory under the Wireshark source tree and is laid out according to the conventions established back when Wireshark was still Ethereal. The documentation for each function is provided in the header files when it is publicly visible, and more deeply in the source files in every case. Also bear in mind that the README.developer distributed with the version of the source code you have is a good place to get a few hints (and you may as well read all of the README.* files if you want to undertake this task).