14

If I want to write a script that uses Wireshark's functionality, I use tshark. I hear there is also a libwireshark that can be used when writing a program in C but, for the life of me, I can't find any documentation for it! I tried isolating the library code in the wireshark source tree, but it seems the code is not very well organized and such isolation does not exist (either that, or I have failed to find it).

I have two questions:

  1. Am I right in thinking that libwireshark can indeed be used to programatically get any functionality I can get from wireshark/tshark?
  2. Can you point me to any documentation/tutorials/examples on the subject? Even a few simple examples can go a long way. Failing that, can you point me to an explanation of how I can find my way around in the wireshark source tree?
Cœur
  • 37,241
  • 25
  • 195
  • 267
Elektito
  • 3,863
  • 8
  • 42
  • 72
  • 1
    Just because something has "lib" in front of it doesn't necessarily mean it's fit for mass consumption. – Chris Eberle Apr 25 '12 at 01:18
  • True. So your point is, "don't even think about it"? – Elektito Apr 25 '12 at 01:26
  • 1
    No, my point is it may not be well documented... because it's not well documented. You may be headed into uncharted territory. If it's worth it to you, then dive in. Hopefully I'm wrong, I'm just saying I wouldn't hold my breath for a nice tutorial or something. – Chris Eberle Apr 25 '12 at 01:29
  • I didn't really expected an extensive documentation hiding somewhere. I'm pretty good at finding things on the Internet! What I hoped by posting this question was that perhaps there is a teensy bit of information somewhere that can ease my pain a little bit! – Elektito Apr 25 '12 at 01:33
  • Well I hope that someone here has that for you, god knows I don't :) – Chris Eberle Apr 25 '12 at 01:34
  • What are you trying to solve? If C is not a hard constraint, have a look at [Bro](http://www.bro-ids.org), "the Python/Ruby for the network." – mavam Apr 28 '12 at 01:23
  • C is not a hard constraint, but performance is (or at least might be in the future). I myself prefer Python whenever I can use it, but it might be less than attractive in this project. Still I'd like to check it out. The main thing I want to achieve is extracting RTP voice flows. Wireshark itself can do it (Telephony/RTP/Stream Analysis...), but tshark doesn't seem to be able to do that. Do you think Bro can achieve this? I can't seem to find much Python related stuff on their website. – Elektito Apr 28 '12 at 01:50

4 Answers4

13

No.

libwireshark is not intended to be used outside of Wireshark itself, and trying to do so will leave you on your own for trying to figure out what is going wrong. libwireshark actually part of the packet analyzing portion of Wireshark (called epan for Ethereal packet analyzer), which you can see in the Developer's Guide is not all of Wireshark. What libwireshark actually provides is the main interface for all of the built-in protocol dissectors, hooks for the plugin dissectors, and the complete packet dissection API. It relies on the machinery set up by the rest of Wireshark for things that are not directly packet dissection tools, but enable the dissectors to do their work (e.g. allocate a deallocate memory chunks, handle compressed or encrypted data, etc).

Write a dissector in stead.
If your project is to strictly analyze network traffic in some way, you might want to consider writing a dissector for Wireshark rather than reinventing the many wheels that Wireshark could provide for you. If you need to do something more complex, like monitor network traffic and then kick off other tasks or send data yourself, you are probably better off using tshark and shell scripting as you already are (keep in mind that you shouldn't let tshark run for extremely long periods of time in any case).

If you really, really want to use libwireshark directly, you will need to resolve all of its dependencies somehow (preferably by making it an actual stand-alone library) and provide for the assumptions it makes about Wireshark (or tshark) actually being running. The code for libwireshark is all well organized, it's just that it consists of the entire epan directory under the Wireshark source tree and is laid out according to the conventions established back when Wireshark was still Ethereal. The documentation for each function is provided in the header files when it is publicly visible, and more deeply in the source files in every case. Also bear in mind that the README.developer distributed with the version of the source code you have is a good place to get a few hints (and you may as well read all of the README.* files if you want to undertake this task).

Gerald Combs
  • 1,374
  • 10
  • 12
multipleinterfaces
  • 8,913
  • 4
  • 30
  • 34
  • Thanks. This explains a lot and gives me some food for thought. I don't think I can write a dissector for this job, though. I need to extract rtp streams (among other things) and I've seen that wireshark can list the streams and even extract audio data from them. Not only writing a dissector doesn't help for this, even running tshark alone is not enough. The best I can do is run tshark and get some hints about the streams, then do the packet dissection and audio extraction myself. Can you think of a better approach? And, why shouldn't I run tshark for extremely long periods? – Elektito Apr 27 '12 at 18:52
  • Wireshark (and tshark) will [run out of memory](http://wiki.wireshark.org/KnownBugs/OutOfMemory "It's a known issue") after a while. Using [dumpcap](http://www.wireshark.org/docs/man-pages/dumpcap.html) directly is better for long running captures, although you are right: you will still need to do some post-processing. I haven't done much with rtp myself, but if you ask at the [Wireshark Q&A site](http://ask.wireshark.org) directly, someone who knows more about it is more likely to see it and possibly be able to help. – multipleinterfaces Apr 27 '12 at 18:56
  • But dumpcap is only for capturing packets, isn't it? I'm only interested in wireshark for its dissecting capabilities. libpcap (and hence wireshark/tshark) is not capable of withstanding the loads I work on. Anyway, I think I will try a more specific example on the Wireshark Q&A site and hope someone can help. Thanks again. – Elektito Apr 27 '12 at 19:24
3

Yes! you can get that functionality by using libwireshark. i have written whole code to do the same. it just works great.

sanny.d
  • 39
  • 1
3

It's certainly possible to use libwireshark outside of Wireshark itself, as I know netexpect does just that. You might try looking on that project's website for information or you could try contacting Eloy Paris, the author of netexpect, for further help/pointers.

Christopher Maynard
  • 5,702
  • 2
  • 17
  • 23
1

Even I have written scripts for wireshark functionality as a part of my project for automation of some things.

The best this to do is use wireshark addons like follows:

  1. tshark to add pcap file, applying filter,but if you find any feature missing there just edit tshark.c in wireshark source code.
  2. capinfos to give details such as no of packets or file size etc. (there is a script called capinfos in wireshark source code edit it if you want more features)

Please note add-ons work only in Linux and capinfos is written in shell script. So you can use the same shell scripts and create new scripts for better functionality.

Even I had faced a lot of problem initially as there is no proper documentation. But once you start it goes smoothly.

BenMorel
  • 34,448
  • 50
  • 182
  • 322
sanchann
  • 11
  • 1
  • I don't know what you mean by "add-ons", but plugins, and even changes to the Wireshark source, work fine on other UN\*Xes and on Windows, as do, for example, Lua add-ons. Also, capinfos is written in C; it's not a shell script. –  Jan 18 '13 at 19:33
  • hi can you share your experience? – Arijit Mukherjee Sep 26 '14 at 07:35