Wireshark-dev: [Wireshark-dev] PCAP-over-IP in Wireshark?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Erik Hjelmvik <erik.hjelmvik@xxxxxxxxx>
Date: Mon, 31 Jan 2022 13:56:56 +0100
Hello folks,

Is there some way to read PCAP-over-IP in Wireshark? I.e. read a PCAP stream over a TCP socket.

Currently, the best solution to read PCAP-over-IP in Wireshark is by using netcat to read the PCAP stream and forward it to Wireshark's STDIN like this:
nc localhost 57012 | wireshark -k -i -

But it would be much nicer if this data could be read directly without having to use netcat. Maybe as an extcap interface?

Best regards,
Erik