Wireshark · Ethereal-dev: [Ethereal-dev] Re: Etheral reads from socket

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

This functionality should go into libpcap/winpcap and not ethereal.

I think it would be very difficult to get the pcap maintainers to
accept something along these lines unless you add security (at a bare
minimum proper authentication) to it.


You should contact libpcap and winpcap folks and discuss the minimum
requirements for getting a network/socket based capture mechanism
implemented.


An emperical observation is that 
while a lot of people request this functionality from time to time but
no one yet has wanted it badly enough to put in some work to define
the capture protocol and how security should be handled.