Re: Wireshark API/packet "trace"

[dest <dest () ptd net>]

On 3/5/2010 2:04 PM, Guy Harris wrote:
> On Mar 4, 2010, at 1:05 PM, Shawn Mayer wrote:
>
> > Where is the Wireshark API/code documentation located?
>
> Some of it is in the "doc" directory in the source code, in a bunch of
README.* files.
> The rest of it is scattered in the source tree, in a bunch of .c and .h
files. :-)

Thanks, I'll take a look.

> > Also is it described anywhere of what happens to a packet as it is
captured 
> > (basically how it traverses the code?)
>
> As it is captured, or as it is dissected?
>
> "As it is captured" is, at least in part, OS-dependent.  Packets are
initially processed by a mechanism running in kernel mode; it's built into
the OS in UN*Xes (BPF, PF_PACKET sockets, DLPI, etc.), and provided as a
driver with WinPcap on Windows.  Then it's received by libpcap/WinPcap,
which hands them to the application - dumpcap, in this case - and then
written to a file, which Wireshark/TShark read.

The goal of my project is to write a plugin for Wireshark that compiles the
AIM conversations occurring on a network using APR Poisoning by Cain in the
background in order to demonstrate privacy concerns for a senior project.
> From your explanation I think as it is dissected would be of more use. I
only require the information that is displayed by the "Aim Messaging"
protocol and the source and destination IP addresses. Once I figure out how
to pull that information into my plugin I can then group the messages into
conversations, ect.Thanks for the assistance.
>
___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>             
mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
>

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe