Wireshark · Ethereal-users: Re: [Ethereal-users] Utilities for analyzing Ethereal capture fil es

[Guy Harris <guy@xxxxxxxxxx>]

> Perl calls tethereal, parses output from tethereal,

Or just swallows Ethereal's/Tethereal's capture files directly; they're
just libpcap-format files, just like tcpdump uses, so anything that can
read a tcpdump capture file can read an Ethereal capture file.

See, for example:

	http://search.cpan.org/doc/TIMPOTTER/Net-Pcap-0.04/Pcap.pm

which is Perl's package to use libpcap to do both live capturing and
reading of existing capture files.

Of course, if you do that, you have to parse the contents of the packet
yourself; parsing the output from Tethereal saves you that trouble.

However, there may well already be some utility out there that reads
tcpdump files and produces graphs of bandwidth utilization vs. time; as
per the above, such a utility could read an Ethereal capture, too.