Wireshark-users: Re: [Wireshark-users] [HELP] How to send bytes to wireshark on runtime

From: Sam Roberts <vieuxtech@xxxxxxxxx>
Date: Thu, 6 Aug 2009 18:17:50 -0700

On Fri, Jun 5, 2009 at 2:21 AM, Guy Harris<guy@xxxxxxxxxxxx> wrote:
> On Jun 4, 2009, at 8:28 PM, Satish Chandra wrote:
>> Thanks for the information. Well, I have run wireshark many times
>> and as far as I know...we can only set the interface from where to
>> capture the packet. How to set it to capture the packet from the
>> Pipe ?
>
> Use the full pathname of the named pipe as the name of the capture
> interface.

Are you sure this works? From within the gui there is no way to enter
paths to capture interfaces that I can see, and the other options:

  wireshark /full/path/to/fifo.pcap
  wireshark -i /full/path/to/fifo.pcap

Also don't work.

I'm on linux, I've written a utility (in lua, for what it's worth)
that captures ZigBee traffic from a UZBee USB device, and writes it in
pcap format. If I write it to a file, I can read the file, but I would
very much like to write it to a FIFO and see live traffic capture.
Hitting the refresh button continually sucks.

Is there a way to do this?

Sam