Wireshark · Wireshark-dev: Re: [Wireshark-dev] Using Wireshark via sockets or pipes on Win32

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

James Gilsinn wrote:
> What I am looking for is a way to have a way to filter a capture file 
> for specific packets and then pull particular pieces of data out of 
> those packets.  The data that I need to pull out is not always what is 
> displayed in the "single-line" packet display that Wireshark and Tshark 
> display.  Most of the data we need is only displayed in the full packet 
> view.  I've tried to use Wireshark/TShark to convert these files to 
> PDML, but then they explode to multiple hundreds of Megabytes.  I have 
> not found a good way to process these large files.
> 
> My project involves doing performance analysis on industrial Ethernet 
> devices.  Right now, I am working on cyclic jitter analysis of the 
> EtherNet/IP protocol (CIP and ENIP).  I am using a commercial network 
> analyzer to collect the data, then I post-process the data in Tshark and 
> some custom software.  I would like to eliminate the Tshark step because 
> of the reasons I described above.  I would like to find a way under 
> Windows to connect to Wireshark via a socket interface (or Tshark if 
> absolutely necessary) that could maintain the binary nature of the data 
> and allow me access to the specific data I need.

You might want to take a look at rawshark. It reads from files and pipes instead
of sockets, but should do what you need otherwise:
http://www.wireshark.org/docs/man-pages/rawshark.html