C: Hook into tshark to get access to analyzed layers of packets

Question

I want to get access to analyzed packet layer information (that tshark does very well) in a C program.

Is there a library interface for tshark that can be used to gather analysis information from packets of a pcap file?

PS: Higher layer languages is not an option for me. I have it working with pyshark (Python) but is too slow for my need(pyshark invokes tshark command line and processes the response json). I need a way to directly get tshark output to my C program.

score 2 · Answer 1 · answered Jan 11 '18 at 12:01

2

You probably will want libpcap for this, if I understand the question correctly.

answered Jan 11 '18 at 12:01

schaiba

362
3
11

AFAIK, libpcap does not analyze the packet for you, tshark/wireshark does analysis. – Bhakta Raghavan Jan 11 '18 at 13:21
Here is a list you might find useful : https://github.com/caesar0301/awesome-pcaptools#analysis – schaiba Jan 11 '18 at 13:29
For me a question: Can libpcap analyze all packet as wireshark or tshark? – langiac Jul 19 '18 at 02:35

C: Hook into tshark to get access to analyzed layers of packets

1 Answers1