I was wondering if it is possible to get the packet information in wireshark for tcp packets such as source ip, destination ip, and various other packet information and to be able to show this information in a new gui screen as I am making a TCP connection annalyser module. How would I go about showing these two pieces of information as i'm having trouble finding out from the code? Any help would be much appreciated. asked 01 Nov '16, 11:13  ModuleMan |
2 Answers:
The Statistics -> Conversations dialog shows a lot of info for TCP connections (and Ethernet, IP and UDP as well). The info for this dialog is produced from taps and code in epan\conversation_table.c answered 01 Nov '16, 12:29  grahamb ♦ |
You may want to look at the tshark manual page, where you'll find various filter and output options, which could be used as your data source. If you want to have a JSON stream, you may want to look at the development version. answered 01 Nov '16, 12:52  Jaap ♦ |
