[Dario Lombardo <lomato@xxxxxxxxx>]

You can have a look at udpdump, which doesn't use TCP but UDP, but it may fit your purpose.

On Mon, Jan 31, 2022 at 1:57 PM Erik Hjelmvik <erik.hjelmvik@xxxxxxxxx> wrote:

Hello folks,

Is there some way to read PCAP-over-IP in Wireshark? I.e. read a PCAP stream over a TCP socket.

Currently, the best solution to read PCAP-over-IP in Wireshark is by using netcat to read the PCAP stream and forward it to Wireshark's STDIN like this:

nc localhost 57012 | wireshark -k -i -

But it would be much nicer if this data could be read directly without having to use netcat. Maybe as an extcap interface?

Best regards,
Erik

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

--

Naima is online.