Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread Harald Welte
Hi Erik, not sure if it fits your use case, but https://git.osmocom.org/osmo-pcap/ might be another option to look at. It's a combination of client and server for aggregating packet captures from various probes (clients) around a network. The protocol between client and server can be a custom, T

Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread Joerg Mayer
On Tue, Feb 01, 2022 at 09:24:28AM -0600, chuck c wrote: > "Replacing 127.0.0.1 with localhost didn't work for some reason though." > > dumpcap ( > https://gitlab.com/wireshark/wireshark/-/blob/master/dumpcap.c#L1366) calls > ws_socket_ptoa ( > https://gitlab.com/wireshark/wireshark/-/blob/master/

Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread chuck c
"Replacing 127.0.0.1 with localhost didn't work for some reason though." dumpcap ( https://gitlab.com/wireshark/wireshark/-/blob/master/dumpcap.c#L1366) calls ws_socket_ptoa ( https://gitlab.com/wireshark/wireshark/-/blob/master/wsutil/socket.h#L72) which expects an IP address. * Convert the str

Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread Roland Knall
Guy already has updated the documentation yesterday and today a bit on the commandline. But the online manuals could be updated Am Di., 1. Feb. 2022 um 13:15 Uhr schrieb Jaap Keuter : > Hi, > > Cool that this works as intended / expected. > All that is left now, as Guy indicated, is to document t

Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread Jaap Keuter
Hi, Cool that this works as intended / expected. All that is left now, as Guy indicated, is to document this properly. Chuck, feeling up to it? ;) Thanks, Jaap > On 1 Feb 2022, at 12:18, Erik Hjelmvik wrote: > > Thank you Guy and Chuck! > > Adding a Pipe interface with the path "TCP@127.0.0.

Re: [Wireshark-dev] PCAP-over-IP in Wireshark?

2022-02-01 Thread Erik Hjelmvik
Thank you Guy and Chuck! Adding a Pipe interface with the path "TCP@127.0.0.1:57012" worked, and so did running "wireshark -k -i TCP@127.0.0.1:57012"! I've now verified that this feature can be used to read PCAP from a TCP socket in both Windows and Linux. This is exactly what I was hoping for! Re