Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Can Tshark pass arguments to an extcap script ?

From: Piotr Winiarczyk <wino45@xxxxxxxxx>
Date: Mon, 27 Sep 2021 09:40:54 +0200
Hi

I am using an extcap interface to capture Bluetooth Low Energy packets. It works well from Wireshark. Since Tshark can be used for remote capture I have tried it and it works (the tshark does not kill all child processes started by extcap script on Linux, but this can be mitigated by killing it from bash script's "trap" function).

The extcap is called three times before the call with --capture is done. Can I pass an extcap parameter to this final call ?

The "--only-advertising" is the only possible parameter for the extcap:

nrf_sniffer_ble.bat --extcap-config --extcap-interface COM10

arg {number=0}{call=--only-advertising}{display=Only advertising packets}{tooltip=The sniffer will only capture advertising packets from the selected device}{type=boolflag}{save=false}

Piotr