Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script to do some other stuff.

My question is for the sniffing part which must be provided by my application. I can see two ways to do this:

  1. Fork the wireshark process in background (of course using the command line version)

  2. Using wireshark as library: no forking but include stuff like "wireshark.h" and link against, thus using function calls to do the sniffing.

So far I haven't found any documentation about #2 and it seems that #1 is the "right way" to embed sniffing capabilities in my code.

Do you think I'm doing he right thing? Does wireshark allow embedding as a library?

share|improve this question

closed as off topic by KronoS, Ivo Flipse Jun 26 '12 at 19:50

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

Why don't you use libpcap? It's the C/C++ sniffing library Wireshark iteself uses.

share|improve this answer
..and then process all the captured packets however you want. Lua can be easily integrated into your tool as well. – Andrejs Cainikovs Jan 14 '11 at 15:20
Because I can't write another application to parse data and I already have a lua script which works fine on wireshark. But my application must be able to write the output file so that wireshark is able to read it. – Emiliano Jan 14 '11 at 15:28
I checked and realized that the file format is a non-issue. This could be the solution I was looking for. +1 – Emiliano Jan 14 '11 at 15:54

Not the answer you're looking for? Browse other questions tagged .