Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Adding pcap-ng pipe support to dumpcap

From: Ed Beroset <beroset@xxxxxxxxxxxxxx>
Date: Tue, 29 Aug 2017 13:50:42 -0400
On 06/16/2017 01:27 PM, Richard Sharpe wrote:
On Fri, Jun 16, 2017 at 9:36 AM, Kvidera, Evan D <EKvidera15@xxxxxxxxxx> wrote:
Hello Wireshark Devs,

My name is Evan Kvidera and I am a senior undergraduate student studying
Computer Science. I have a decent amount of programming experience, but only
a little in C. My employer has asked me to try to add support for piping
pcap-ng captures to Wireshark.
I have read over the bug report requesting the feature,
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11370.

After reading the mailing list archives here,
https://www.mail-archive.com/wireshark-dev@xxxxxxxxxxxxx/msg33336.html, it
looks like this addition will be nontrivial, but doable, and that the
changes necessary are all going to be in dumpcap.

I have at least a month or two of full-time work I can dedicate to this if
necessary, although I am hoping it will not take that long.

I have read through the Wireshark Developer's Guide and looked over the
style guide for Wireshark. Is there anything else I should know before
starting development? I will try to develop this as independently as
possible, but I may have a few questions along the way.

Hi Evan,

I looked at this back in 2012 and even proposed a patch that might be
useful to you:

       http://seclists.org/wireshark/2012/May/25

No doubt it was a little too simplistic but if I find some time next
week while I am in Seattle I might try to resurrect it and see if it
works.

I've just encountered a need for this as well. Have you made progress, Evan? Do you want some help?

Ed