up vote 1 down vote favorite
share [g+] share [fb]

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script to do some other stuff.

My question is for the sniffing part which must be provided by my application. I can see two ways to do this:

1) Fork the wireshark process in background (of course using the command line version)

2) Using wireshark as library: no forking but include stuff like "wireshark.h" and link against libwireshark.so, thus using function calls to do the sniffing.

So far I haven't found any documentation about #2 and it seems that #1 is the "right way" to embed sniffing capabilities in my code.

Do you think I'm doing he right thing? Does wireshark allow embedding as a library?

link|improve this question
100% accept rate
feedback

1 Answer

up vote 4 down vote accepted

Why don't you use libpcap? It's the C/C++ sniffing library Wireshark iteself uses.

link|improve this answer
..and then process all the captured packets however you want. Lua can be easily integrated into your tool as well. – Andrejs Cainikovs Jan 14 '11 at 15:20
Because I can't write another application to parse data and I already have a lua script which works fine on wireshark. But my application must be able to write the output file so that wireshark is able to read it. – happy_emi Jan 14 '11 at 15:28
I checked and realized that the file format is a non-issue. This could be the solution I was looking for. +1 – happy_emi Jan 14 '11 at 15:54
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.