This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I work with a TCP/IP monitoring tool that runs on IBM z/OS mainframes. My product can capture packets created by a TCP/IP stack that also runs under z/OS. IPCS can convert such a file to a format compatible with Wireshark. We would like to avoids using IPCS and do the conversion within our product. Is there code available that we can imbed into our monitor that will do the file conversion?

asked 23 Oct '17, 11:39

daverme's gravatar image

daverme
0112
accept rate: 0%


Is this sufficient information to allow you to directly store the captured data in Wireshark-compatible format, rather than doing a conversion?

Any code you ask for would only cover the "store as pcapng" part but you would have to provide the "receive data from the capturing engine" part, which to me is roughly the same amount of work as to generate the file format directly.

Just to tell the full story, in addition to the advantages of pcap-ng over pcap, there is also a certain drawback of use of pcap-ng format - as of now, Wireshark still cannot read it from a pipe, but I guess this should not be of any importance for your use case (and I also hope it is not going to last forever).

permanent link

answered 23 Oct '17, 12:25

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Great answer. Thanks for the feedback.

(24 Oct '17, 04:43) daverme

You could also contribute code to Wireshark that allows it to read files in your format - assuming "your format" can be represented as a stream of bytes.

That means that if it's a bunch of count+data records in some z/OS access method, you'd have to represent it, to make it readable by UN*X and Windows systems, whose file systems store files as seekable byte dreams, as a sequence of records with N bytes of count followed by the bytes of data in the record.

permanent link

answered 24 Oct '17, 11:32

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×3
×1

question asked: 23 Oct '17, 11:39

question was seen: 583 times

last updated: 24 Oct '17, 11:32

p​o​w​e​r​e​d by O​S​Q​A