Wireshark Library for 6.2.3

Following numerous requests from customers and prospects in EMEA, I decided to build a library for Wireshark based on it's tshark and capinfos command line interfaces. For extra flexibility, the library allows remote calling of Wireshark functions via SSH and telnet as well as local access on Windows.

I welcome feedback (good and bad) so that I can improve the library.

Function Summary

Capture Functions

• Capture to File Simple: Limited number of options such as interface name/id, output path, capture filter and duration.
• Capture to File Advanced: Many more options covering almost the entire option set from tshark including autostop condition and capture link type.

Analysis Functions

• Read from Capture File: Shows frame information for supplied capture file path with options such as display filter and start/end frame.
• Capture File Infos: Using the capinfos command line, this command returns key pieces of info such as captured number of packets, captured file size in bytes and average packet size.
• Statistics on Capture File: Uses the -z tshark option to present further stats on a capture file

Listings

• List Interfaces: interfaces available on the host machine for Wireshark to capture on
• List Available Capture File Types
• List Supported Link Types

Miscellaneous

• Print Tshark version

There is extensive descriptive text on the commands and their parameters plus URL references to key Wireshark web pages. The output from the commands is mostly presented in its raw form with the exception of theCapture File Infoscommand. For example, there are no transforms applied to the output of theRead from Capture Filecommand. I thought it was better to allow the end user to apply their own.

Installation

Like any other library, simply go to the Libraries area under Admin in Studio and add a new library. Point to the DLL supplied (this was generated in 6.2.3). it should create a new stencil in your Tool palette with an appropriate icon.

IMPORTANT

• The driver uses Terminal and PowerShell sessions under the hood so it is reliant on the user setting the right Prompt value to ensure it knows when tshark commands have been completed. This is declared as part of the session parameters (see highlighted areas below). (Note that if a regular expression is used, this takes precedence if you have set the other option too.) There may be a better way of doing this so I would welcome feedback on this.

• If you are using Wireshark locally on Windows, some of the above options can be left blank, for exampleUsernameandPassword.
• There is little error handling at the moment so please ensure that the above highlighted value(s) are set correctly because you will still get a connection. This is something that I will remedy if people want to use this library.