On Mar 4, 2010, at 1:05 PM, Shawn Mayer wrote:
> Where is the Wireshark API/code documentation located?
Some of it is in the "doc" directory in the source code, in a bunch of README.* files.
The rest of it is scattered in the source tree, in a bunch of .c and .h files. :-)
> Also is it described anywhere of what happens to a packet as it is captured
> (basically how it traverses the code?)
As it is captured, or as it is dissected?
"As it is captured" is, at least in part, OS-dependent. Packets are initially processed by a mechanism running in kernel mode; it's built into the OS in UN*Xes (BPF, PF_PACKET sockets, DLPI, etc.), and provided as a driver with WinPcap on Windows. Then it's received by libpcap/WinPcap, which hands them to the application - dumpcap, in this case - and then written to a file, which Wireshark/TShark read.