Wireshark · Ethereal-dev: Re: [Ethereal-dev] Feeding packets from Ethereal

[Thomas Steffen <steffen.list.account@xxxxxxxxx>]

It is not very prominent in the documentation, but Ethereal can real
libpcap format data from a named pipe. You specify the name of the pipe
instead of the device to capture from. Note that the name may not
contain spaces. (And I assume you already figured out the format, which
seems to be an undocumented de facto standard :-) ). 

I wrote a patch a few weeks ago that can spawn a child process from
which the data is read. However, I do not know enought about Windows to
make it work there. If someone gives me a hand, I would be prepared to
work on that issue. 

Thomas

On 9/10/05, Sergey Rathon <rath1@xxxxxxxxxxxxx> wrote:

Hello,

Not sure if this is a right mailing list for the question, but here goes:

My company makes hardware that transmits and captures test traffic. The user
wants to run Ethereal and watch captured traffic 'live', at 10 to 100
packets per second. I need to open Ethereal, run our software in parallel,
and push incremental updates to Ethereal through a file or memory. Another
option is to make Ethereal pull updates periodically from some source.

Is there a 'standard' way to do it? If not, what approach would you
recommend?

thanks,
Sergey


_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev