Wiretap is a library used for reading and writing capture files in various formats.
Wiretap was initially developed as a library to replace
libpcap, the current standard Unix library for packet capturing. Libpcap
is great in that it is very platform independent and has a wonderful
BPF optimizing engine. But it has some shortcomings as well. These
shortcomings came to a head during Wireshark’s development.
Wiretap was developed so that:
-
The library can easily be amended with new packet filtering objects.
Libpcap is very TCP/IP-oriented. I want to filter on IPX objects, SNA objects,
etc. I also want any decent programmer to be able to add new filters to the
library.
-
The library can read file formats from many packet-capturing utilities.
Libpcap only reads Libpcap files.
-
The library can capture on more than one network interface at a time, and
save this trace in one file.
-
Network names can be resolved immediately after a trace and saved in the
trace file. That way, I can ship a trace of my firewall-protected network to a
colleague, and he’ll see the proper hostnames for the IP addresses in the
packet capture, even though he doesn’t have access to the DNS server behind my
LAN’s firewall.
-
I want to look into the possibility of compressing packet data when saved
to a file, like Sniffer.
-
The packet-filter can be optimized for the host OS. Not all OSes have BPF;
SunOS has NIT and Solaris has DLPI, which both use the CMU/Stanford
packet-filter pseudomachine. RMON has another type of packet-filter syntax
which we could support.
Wiretap is very good at reading many file formats, as per #2
above. Wiretap has no filter capability at present; it currently doesn’t
support packet capture, so it wouldn’t be useful there, and filtering
when reading a capture file is done by Wireshark, using a more powerful
filtering mechanism than that provided by BPF.