Wireshark · Wireshark-dev: Re: [Wireshark-dev] Adding pcap-ng pipe support to dumpcap

[Guy Harris <guy@xxxxxxxxxxxx>]

On Aug 31, 2017, at 11:09 AM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:

> A counter argument to this would be that there are some advantages to not using a (temporary) file as the buffer packets.

For Wireshark, you have no alternative, as packets aren't processed only once.

For TShark with -2, the same applies.

TShark with one pass is the one place where you wouldn't want a temporary file.

And the current scheme we have for extcap involves a temporary file, as the extcap programs talk to dumpcap, which always writes temporary files.

So, if we want to get rid of the temporary file for one-pass TShark (which would probably be a good idea), what we'd want to do is have extcap piping packets directly to TShark.  If we can also have TShark directly capturing (with a libpcap that does its own privilege separation), completely removing dumpcap:

	one-pass TShark would read packets from a pcap_t or a pipe, writing to a file *if* asked to do so, and dissecting packets *if* asked to do so;

	two-pass TShark would read packets from a pcap_t or a pipe, writing to a file unconditionally, dissecting the packets but not printing anything and, when the capture is complete, going back and re-dissecting the packets in the file and printing the results.

Wireshark would, in this world, read packets from a pcap_t or a pipe, writing to a file unconditionally, and adding them to its packet list, but not displaying the results of that dissection (not generating columns or a protocol tree); the packet list and packet details panes would display stuff based on a subsequent dissection (so it shows the result of dissections *after* the first pass).