Wireshark mailing list archives
Re: PCAP-over-IP in Wireshark?
From: Jaap Keuter <jaap.keuter () xs4all nl>
Date: Tue, 1 Feb 2022 13:14:59 +0100
Hi, Cool that this works as intended / expected. All that is left now, as Guy indicated, is to document this properly. Chuck, feeling up to it? ;) Thanks, Jaap
On 1 Feb 2022, at 12:18, Erik Hjelmvik <erik.hjelmvik () gmail com> wrote: Thank you Guy and Chuck! Adding a Pipe interface with the path "TCP@127.0.0.1:57012 <http://TCP@127.0.0.1:57012/>" worked, and so did running "wireshark -k -i TCP@127.0.0.1:57012 <http://TCP@127.0.0.1:57012/>"! I've now verified that this feature can be used to read PCAP from a TCP socket in both Windows and Linux. This is exactly what I was hoping for! Replacing 127.0.0.1 with localhost didn't work for some reason though. I just get an error message saying that "TCP@localhost:57012" is not a valid socket specification. I was delighted to see that tshark also reads the pcap stream nicely when I run it like this: tshark -i TCP@127.0.0.1:57012 <http://TCP@127.0.0.1:57012/> I've also verified that I can read the PCAP stream from a remote IP instead of just 127.0.0.1. Thank you for your great work! Den tis 1 feb. 2022 kl 04:28 skrev chuck c <bubbasnmp () gmail com <mailto:bubbasnmp () gmail com>>: https://wiki.wireshark.org/CaptureSetup/Pipes.md#tcp-socket <https://wiki.wireshark.org/CaptureSetup/Pipes.md#tcp-socket> "A TCP stream is treated as like data from other pipes and the same restrictions apply. On each new connection the TCP server must send the header blocks as specified by libpcap or pcapng before any packet captures. TCP@ pipes may also be added in the GUI's Menu Capture/Options…, Manage Interfaces…, Pipes Tab, but pipe settings are not saved by Wireshark." On Mon, Jan 31, 2022 at 6:19 PM Guy Harris <gharris () sonic net <mailto:gharris () sonic net>> wrote: On Jan 31, 2022, at 4:56 AM, Erik Hjelmvik <erik.hjelmvik () gmail com <mailto:erik.hjelmvik () gmail com>> wrote:Is there some way to read PCAP-over-IP in Wireshark? I.e. read a PCAP stream over a TCP socket. Currently, the best solution to read PCAP-over-IP in Wireshark is by using netcat to read the PCAP stream and forward it to Wireshark's STDIN like this: nc localhost | wireshark -k -i -So this means "stream a pcap file to Wireshark and have it read it as a live capture". Wireshark - well, dumpcap, which does the capturing - has supported capturing from a pipe for a while. Support for capturing from a TCP socket was added at some point; the man page doesn't document it all that well: −i|−−interface <capture interface>|rpcap://<host>:<port>/<capture interface>|TCP@<host>:<port>|− Set the name of the network interface or pipe to use for live packet capture. Network interface names should match one of the names listed in "dumpcap −D" (described above); a number, as reported by "dumpcap −D", can also be used. If you’re using UNIX, "netstat −i", ied, "ifconfig −a" or "ip link" might also work to list interface names, although not all versions of UNIX support the −a option to ifconfig. If no interface is specified, Dumpcap searches the list of interfaces, choosing the first non−loopback interface if there are any non−loopback interfaces, and choosing the first loopback interface if there are no non−loopback interfaces. If there are no interfaces at all, Dumpcap reports an error and doesn’t start theg capture. Pipe names should be either the name of a FIFO (named pipe) or "−" to read data from the standard input. On Windows systems, pipe names must be of the form "\\pipe\.*pipename*". Data read from pipes must be in standard pcapng or pcap format. Pcapng data must have the same endianness as the capturing host. It mentions "TCP@<host>:<port>" in the line describing the interface, but doesn't say what it means. So try wireshark -k -i TCP@localhost:57012 ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org <mailto:wireshark-dev () wireshark org>> Archives: https://www.wireshark.org/lists/wireshark-dev <https://www.wireshark.org/lists/wireshark-dev> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev <https://www.wireshark.org/mailman/options/wireshark-dev> mailto:wireshark-dev-request () wireshark org <mailto:wireshark-dev-request () wireshark org>?subject=unsubscribe ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org <mailto:wireshark-dev () wireshark org>> Archives: https://www.wireshark.org/lists/wireshark-dev <https://www.wireshark.org/lists/wireshark-dev> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev <https://www.wireshark.org/mailman/options/wireshark-dev> mailto:wireshark-dev-request () wireshark org <mailto:wireshark-dev-request () wireshark org>?subject=unsubscribe ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Re: PCAP-over-IP in Wireshark? Erik Hjelmvik (Feb 01)
- Re: PCAP-over-IP in Wireshark? Jaap Keuter (Feb 01)
- Re: PCAP-over-IP in Wireshark? Roland Knall (Feb 01)
- Re: PCAP-over-IP in Wireshark? chuck c (Feb 01)
- Re: PCAP-over-IP in Wireshark? Joerg Mayer (Feb 01)
- <Possible follow-ups>
- Re: PCAP-over-IP in Wireshark? Harald Welte (Feb 01)
- Re: PCAP-over-IP in Wireshark? Jaap Keuter (Feb 01)