Chapter 10. Wiretap

Table of Contents

10.1. Background
10.2. Creating a new wiretap module
10.3. Additional notes on adding support for reading new capture formats
10.4. Adding support for writing capture formats
10.5. Adding support for a new encapsulation type

Wiretap is a library used for reading and writing capture files in various formats.

10.1. Background

Wiretap was initially developed as a library to replace libpcap, the current standard Unix library for packet capturing. Libpcap is great in that it is very platform independent and has a wonderful BPF optimizing engine. But it has some shortcomings as well. These shortcomings came to a head during Wireshark’s development. Wiretap was developed so that:

  1. The library can easily be amended with new packet filtering objects. Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects, etc. I also want any decent programmer to be able to add new filters to the library.
  2. The library can read file formats from many packet-capturing utilities. Libpcap only reads Libpcap files.
  3. The library can capture on more than one network interface at a time, and save this trace in one file.
  4. Network names can be resolved immediately after a trace and saved in the trace file. That way, I can ship a trace of my firewall-protected network to a colleague, and he’ll see the proper hostnames for the IP addresses in the packet capture, even though he doesn’t have access to the DNS server behind my LAN’s firewall.
  5. I want to look into the possibility of compressing packet data when saved to a file, like Sniffer.
  6. The packet-filter can be optimized for the host OS. Not all OSes have BPF; SunOS has NIT and Solaris has DLPI, which both use the CMU/Stanford packet-filter pseudomachine. RMON has another type of packet-filter syntax which we could support.

Wiretap is very good at reading many file formats, as per #2 above. Wiretap has no filter capability at present; it currently doesn’t support packet capture, so it wouldn’t be useful there, and filtering when reading a capture file is done by Wireshark, using a more powerful filtering mechanism than that provided by BPF.