This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

At work, I currently have an application which uses the libpcap API to do packet sniffing of our internal TCP messages (and to do various things with the data that's sniffed). I am considering converting this application into an application that uses wireshark instead (since the visualization of the data that wireshark provides is great, and since I'd like to take advantage of all of the other capabilities that wireshark provides).

My question is: what is the best method to go about this? I see that I can either modify the C code itself or use the lua API. (I know C, and I don't know anything about lua.)

I guess I would want to add dissectors, but I would also want to add the capability to trigger an event that would receive packet data and do specific things with that data. (Listener?)

I guess the main question is whether to modify the C or use lua...and if you have any other specific advice that would be great. Let me know if you have any other questions about what I'm trying to accomplish. Thanks!

asked 11 Aug '11, 16:06

JVo's gravatar image

JVo
16558
accept rate: 0%

possible duplicate

(17 Aug '11, 22:09) helloworld

Sounds like a dissector and tap listener, although 'trigger an event that would receive packet data' is not all to clear to me.

permanent link

answered 12 Aug '11, 01:42

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks. Any thoughts on whether to use lua or modify the C++ for dissectors and listeners?

(12 Aug '11, 10:31) JVo

Lua or C (no C++ (!)), or even python are possible. Think about the most appropriate language for your work, organization and maintainability. I've little experience with Lua of Python in this context; using C, Wiresharks native programming language gives most power.

(12 Aug '11, 11:26) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×431
×158

question asked: 11 Aug '11, 16:06

question was seen: 3,130 times

last updated: 17 Aug '11, 22:09

p​o​w​e​r​e​d by O​S​Q​A