Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Redirecting Wireshark output through a socket

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 15 Oct 2009 14:30:54 -0400
Gustavo wrote:
Hello everybody.

I was asked to study a way for communicating between Wireshark and a
commercial tool in Windows. Wireshark should analyze network traffic,
dissect it and pass (part of) it to the commercial tool for further
analysis and statistics.

What exactly do you want to feed into the other tool? The ASCII decode like:

Ethernet II, Src: 00:14:4f:94:bb:0d (00:14:4f:94:bb:0d), Dst: 00:0e:0c:b5:22:3b (00:0e:0c:b5:22:3b)
    Destination: 00:0e:0c:b5:22:3b (00:0e:0c:b5:22:3b)
        Address: 00:0e:0c:b5:22:3b (00:0e:0c:b5:22:3b)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: 00:14:4f:94:bb:0d (00:14:4f:94:bb:0d)
        Address: 00:14:4f:94:bb:0d (00:14:4f:94:bb:0d)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)

?

In that case you should probably use 'tshark' and you could (I suppose this would work on Windows) do something like:

tshark -V -r /some/cap/file | the_other_analyzer

though I doubt that the commercial tool will really understand this output...