Question

If I want to write a script that uses Wireshark’s functionality, I use tshark. I hear there is also a libwireshark that can be used when writing a program in C but, for the life of me, I can’t find any documentation for it! I tried isolating the library code in the wireshark source tree, but it seems the code is not very well organized and such isolation does not exist (either that, or I have failed to find it).

I have two questions:

1. Am I right in thinking that libwireshark can indeed be used to programatically get any functionality I can get from wireshark/tshark?
2. Can you point me to any documentation/tutorials/examples on the subject? Even a few simple examples can go a long way. Failing that, can you point me to an explanation of how I can find my way around in the wireshark source tree?

Answer 1

No.

libwireshark is not intended to be used outside of Wireshark itself, and trying to do so will leave you on your own for trying to figure out what is going wrong. libwireshark actually part of the packet analyzing portion of Wireshark (called epan for Ethereal packet analyzer), which you can see in the Developer’s Guide is not all of Wireshark. What libwireshark actually provides is the main interface for all of the built-in protocol dissectors, hooks for the plugin dissectors, and the complete packet dissection API. It relies on the machinery set up by the rest of Wireshark for things that are not directly packet dissection tools, but enable the dissectors to do their work (e.g. allocate a deallocate memory chunks, handle compressed or encrypted data, etc).

Write a dissector in stead.
If your project is to strictly analyze network traffic in some way, you might want to consider writing a dissector for Wireshark rather than reinventing the many wheels that Wireshark could provide for you. If you need to do something more complex, like monitor network traffic and then kick off other tasks or send data yourself, you are probably better off using tshark and shell scripting as you already are (keep in mind that you shouldn’t let tshark run for extremely long periods of time in any case).

If you really, really want to use libwireshark directly, you will need to resolve all of its dependencies somehow (preferably by making it an actual stand-alone library) and provide for the assumptions it makes about Wireshark (or tshark) actually being running. The code for libwireshark is all well organized, it’s just that it consists of the entire epan directory under the Wireshark source tree and is laid out according to the conventions established back when Wireshark was still Ethereal. The documentation for each function is provided in the header files when it is publicly visible, and more deeply in the source files in every case. Also bear in mind that the README.developer distributed with the version of the source code you have is a good place to get a few hints (and you may as well read all of the README.* files if you want to undertake this task).