Wireshark-dev: Re: [Wireshark-dev] Wireshark API/packet "trace"
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 5 Mar 2010 11:04:52 -0800
On Mar 4, 2010, at 1:05 PM, Shawn Mayer wrote:

> Where is the Wireshark API/code documentation located?

Some of it is in the "doc" directory in the source code, in a bunch of README.* files.

The rest of it is scattered in the source tree, in a bunch of .c and .h files. :-)

> Also is it described anywhere of what happens to a packet as it is captured 
> (basically how it traverses the code?)

As it is captured, or as it is dissected?

"As it is captured" is, at least in part, OS-dependent.  Packets are initially processed by a mechanism running in kernel mode; it's built into the OS in UN*Xes (BPF, PF_PACKET sockets, DLPI, etc.), and provided as a driver with WinPcap on Windows.  Then it's received by libpcap/WinPcap, which hands them to the application - dumpcap, in this case - and then written to a file, which Wireshark/TShark read.