This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

OK, wireshark is working perfectly, but is it possible to configure it to make a sound when a packet goes through pre defined filter?

asked 27 Oct '13, 06:45

myrddin's gravatar image

myrddin
117810
accept rate: 0%


No. Personally I would find this extremely annoying, but if you want this in Wireshark please create an item in the Wireshark Bugzilla and mark it as an enhancement.

permanent link

answered 27 Oct '13, 07:01

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Yes I know it would be annoying, but if you get a packet passssing through a filter once every few hours it would be useful. OK, I will message developers through bugzilla, thanks

(27 Oct '13, 07:29) myrddin

There was a actually a comical tweet from Gerald back in June that sparked a little casual discussion about this. Anyway, there did seem to be some interest in this. How serious was that interest? I'm not sure.

(27 Oct '13, 18:02) cmaynard ♦♦

This was filed as bug 9335 back on 2013-10-27.

(17 Jun '16, 12:57) cmaynard ♦♦

but is it possible to configure it to make a sound when a packet goes through pre defined filter?

This implies (for me) that you want to use Wireshark as a real time monitoring tool for your network traffic (as it would only make sense to use the alert sound in that way). However Wireshark and/or tshark are both analyzing tools that are not meant to work in real-time for a long time, although you can use it like that for a short period of time.

Now, if you can't use Wireshark as a long term and real time monitoring tool, how much sense does it make to let Wireshark play a sound if you click on a certain frame or if you apply a certain display filter? You know that you did that, so why let Wireshark bark at you?

That would be rather annoying, except for blind people. However I'm not sure if you can use Wireshark with a braille display ;-))

I believe you need/want a way to use Wireshark/tshark as a long term, real time monitoring tool, that uses pre-defined filters to trigger a definable action, as soon as that filter matches (like: if there is an arp request, beep twice). Unfortunately, there is no (long term, real time) monitoring only version of Wireshark/tshark right now and based on the architecture of Wiresharks dissection engine, it's rather hard to implement that, but it's not impossible.

Regards
Kurt

permanent link

answered 28 Oct '13, 08:45

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

This question is old, and my answer may not be quite what you were looking for, and perhaps not helpful to you at all if you're not running on the Windows platform, but ...

If you are using Windows and a new enough version of dumpcap (1.10.0 or later should suffice), then you should be able to have sound/music played when a capture event occurs through the hooks provided by the dumpcap.bat batch file I wrote and posted at http://wiki.wireshark.org/Tools. The sound would only be played after the capture event occurred, and not for every packet that matched a particular filter.

Of course, you could start dumpcap.exe independent of the dumpcap.bat file and then run the batch file in "Event Only" mode, wrapping the dumpcap.bat within another batch file that just restarts it over and over. In that case, you would hear the sound after each capture event occurred, except if the capture event happened to occur between running instances.

OK, so how would you do this? First, copy the script below, copied here for convenience from this "Play invisible music with batch file?" question, and then save it as playfile.bat or some other name of your choice.

@echo off set file=track12.mp3 ( echo Set Sound = CreateObject("WMPlayer.OCX.7"^) echo Sound.URL = "%file%" echo Sound.Controls.play echo do while Sound.currentmedia.duration = 0 echo wscript.sleep 100 echo loop echo wscript.sleep (int(Sound.currentmedia.duration^)+1^)*1000) >sound.vbs start /min sound.vbs

So that you can specify any arbitrary file as an argument to the playfile.bat file, replace the following line:

set file=track12.mp3

... with this one:

set file=%~1

Next, create a file called eventaction.bat whose contents are as follows:

@call C:\path\to\playfile.bat "C:\path\to\somesound.mp3"

Now when you run the dumpcap.bat file and a capture event occurs, the sound you've chosen will be played. For more information on using the batch file, refer to the contents of the batch file itself. You can also refer to some other questions where I suggested other possible uses for it, such as:

permanent link

answered 16 Apr '15, 12:06

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×11
×3

question asked: 27 Oct '13, 06:45

question was seen: 5,639 times

last updated: 17 Jun '16, 12:57

p​o​w​e​r​e​d by O​S​Q​A