0
votes

In the wireshark, it's able to display packet's details like ip.src, ip.port, info etc. When on click the packet, the packet's details are shown in the (middle) bottom part. packet's details

Is there anyway to show the details (known as pdml in tshark), i.e. the Frame, Ethernet, as shown in Wireshark by using libpcap? I understood that we are able to get source, destination address by using struct pcap_pkthdr, but I plan to build an application that resembles Wireshark and hence need to get details as displayed by Wireshark. Any expert here would like to share any websites or any source that I'm able to relate to? Thanks.

1

1 Answers

1
votes

but I plan to build an application that resembles Wireshark and hence need to get details as displayed by Wireshark.

Then you will need to duplicate some or all of the work done by the Wireshark developers.

Ohloh's page on Wireshark says that Wireshark "has had 52,184 commits made by 119 contributors representing 2,849,177 lines of code" and that it "took an estimated 840 years of effort (COCOMO model) starting with its first commit in September, 1998 ending with its most recent commit about 13 hours ago". (That's more like "840 developer-years of effort"; it's not as if Gerald started working on it 840 years ago and did it all himself. :-))

Most of those lines of code are in the dissector core and the dissectors that use it.

If you don't care about using Wireshark's code (which means you are willing to have to give away the source code to your program to anybody who gets the program, and willing to let them give the source code away to anybody they want to), then you could try building your own program using the same Wireshark library that Wireshark and TShark use (that library is the one whose source is in the epan directory of the Wireshark source, and its subdirectories).

You wouldn't need all of them if you only have a small subset of protocols that you care about.

Libpcap will not help you; it is a library for capturing packets, writing them to capture files, and reading those capture files, and includes no code for analyzing the raw file data.