Hi,
I write a software for multipath TCP analysis
(https://github.com/teto/mptcpanalyzer) and would like to extend it to
do live analysis (it's limited to offline for now).
I wonder what is the best way to retrieve live wireshark information
such as the `tcp.*` and `mptcp.*` analysis from the dissection tree.
Termshark seems to watch for tshark output:
https://github.com/gcla/termshark/blob/master/docs/FAQ.md#how-does-termshark-use-tshark
but I wondered if there was any other way:
- calling out functions directly from libshark
- via tsharkd ? if there was a server of sort that could send the
dissection tree via RPC, wireshark could decouple the GUI and the
engine (as it is certainly done via libshark already). I am for
instance thinking of neovim that decouples the UI from the server so
that you can create your own GUI using a vim engine.
Cheers
Matt