Wireshark-dev: Re: [Wireshark-dev] Wireshark GUI filter control from external applications.
Hi,
Thank you for replying.
Sure, firstly for other bespoke network analysis tools that aim to use Wireshark to analyse low level network data (but where the main focus of the tool isn't aimed at that level of detail). In comparison to it's alternatives Wireshark is feature-rich, very customisable and also stable which makes it desirable to hook into from other applications. This type of tool ranges from in-house testing tools to other open-source applications.
For my self personally, a colleague and I are hoping to release a light-weight open source tool that provides a top-down view on network data. It has already been written, tested and used in anger by others at the company where we work. It analyses pcap data then provides statistics on a list of IP conversations between hosts, allowing you to drill down into details about the TCP Connections for each conversation. Then from TCP Connections it can drill down into the individual packet data where it currently hooks into a prototype-dev version of Wireshark (by changing the filters on the GUI). It also provides the ability to script your own data classifications to help identify specific network conditions quickly. Our aim is to release it to the open source community within the next few weeks/months.
In my opinion I would rather connect to a Wireshark remote control API than use a bespoke version or re-create the wheel.
I think a "GUI remote control" would only need to support "Change GUI Filter" and "Remove GUI Filter" although it has a lot more potential too. I have implemented these controls in our prototype-dev version or Wireshark and the source code supports it fairly well.
Any help you can offer would be appreciated.
Thanks,
Lee
