search

spacehuhn / ArduinoPcap

A library for creating and sending .pcap files for Wireshark and other programms.
MIT License
422 stars 91 forks source link

Windows support for live capture #2

Open wino45 opened 7 years ago

wino45 commented 7 years ago

https://wiki.wireshark.org/CaptureSetup/Pipes

Maybe this mechanism could make this project to work in real time and on MS Windows. Anyway I saw this work for nRF sniffer. https://www.nordicsemi.com/eng/Products/Bluetooth-low-energy/nRF-Sniffer

spacehuhn commented 7 years ago

That nRF thing has it's own software and firmware.

Sure you can pipe things to wireshark on windows too. Still leaves the question of how to read from serial into a file. I'm sure it's possible on windows. You can port it If you want. I just don't have any intentions to do so at the moment.

spacehuhn commented 7 years ago

Sorry didn't mean to close this issue.

wino45 commented 7 years ago

The nRF Sniffer is not using any files, it is not needed. When packet arrives it is send over UART to the PC (some kind of simple serialization is used - named SLIP, wihile it is not SLIP... ). The python script running on PC is deserializing a captured packet and pushes it to named pipe. The Wireshark is configured to read from named pipe. So you have realtime sniffing. If you wan to have file you need to save it from Wireshark.

SensorsIot commented 6 years ago

I think this is a cool project (I am working on a similar one to detect MAC addresses in the proximity to control things). I tried your sketch on an ESP32 and it worked quite well. But unfortunately, I got the message "Data [ Packet size limited during capture] and did not find any MAC addresses. in Wireshark.

spacehuhn commented 6 years ago

@SensorsIot you might want to open a new issue for this. I had the same error one or two times.

wgaylord commented 4 years ago

Could have python write to wiresharks stdin itself instead of using a file as a middle man. (Using subprocess.communicate)

ankur608 commented 3 years ago

Update* p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid) By excluding the preexec_fn; was finally able to successfully stream the serial port in windows10.

p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True)

emaayan commented 1 year ago

@spacehuhn i'm guessing you know by know allready, but just incase anyone missed it you can have windows support using named pipes, than you don't even need a file anymore. wireshark can also use named pipes as a source and you use them in python as well head on here for the "official" page on wireshark on this: https://wiki.wireshark.org/CaptureSetup/Pipes additionally somone made a gist https://gist.github.com/ouoam/3462e73fcfc36d063ecd8f9a5ac77f12 with these changes

his gist also has a fix for the malformed packet https://gist.github.com/ouoam/3462e73fcfc36d063ecd8f9a5ac77f12#file-esp32_pcap_serial-ino-L57

i also have some ideas how do improve this using tcmenu for filtering packets.