Wireshark-dev: Re: [Wireshark-dev] Using Wireshark packet parsers and pretty printers
From: Richard Sharpe <[email protected]>
Date: Mon, 9 Mar 2009 12:54:32 -0800
On Mon, Mar 9, 2009 at 12:14 PM, Ulisses Araújo Costa
<[email protected]> wrote:
> Hello,
> I'm doing a project where I need to parse some packets (HTTP and some
> protocols for databases).
> I start doing this using the tcpdump library, and after that start to
> parse all the nested packets like that:
> Ethernet -> TCP/UDP -> IPv4/IPv6 -> Application packet
> I've done part of this job using the Haskell programming language, the
> problem is to start obtain information about the relation of the
> packets (like temporal relation, or others). I see that wireshark
> already does that job. And in fact parse all the data from one packet,
> and have a great pretty printer.
> I start to read manuals for developers, and unfortunately did not find
> anything that really help me.
> My question is: Could you show to me a simple program that take a
> input tcpdump file (Coud also be in Online mode), and just return the
> structure of the parsed packets?

I don't believe that this is possible today.

I am working on a new library that might make it possible and will
have SWIG interfaces for a number of scripting languages (whatever
SWIG supports) but it is in the early stages at the moment. It
supports the concept of parse tables that you can install at runtime.

Richard Sharpe