"Wireshark" capture package and file format support

1. Grab Bag

Capture extracts the package from the network adapter and saves it to the hard disk.

Access to the underlying network adapter requires elevated privileges, so the ability to grab packets from the underlying NIC is encapsulated in Dumpcap, the only program in Wireshark that requires privileged execution, and the rest of the code (including parsers, user interfaces, and so on) requires only normal user rights.

To hide all underlying machine dependencies, the Libpcap/winpcap library is used. This library provides a variety of different network interface types (Ethernet, Token Ring,...) The common interface on the capture package.

2. File format

Wireshark can read and write the capture file in Libpcap format, which is its default file format and is used by many other network capture tools, such as tcpdump. In addition, Wireshark can read and write many different file formats used by other network capture tools. Wiretap Library, Developed with Wireshark, it provides a common interface for reading and writing all these file formats. If you need to add additional capture file formats, you should start here.

The package format of the Pcap file is as shown. The value of magic number is 0x1a2b3c4d for files written in host byte order.

Two important structs see/wiretap/libpcap.h.

/*"Libpcap" File header (minus magic number).*/structPCAP_HDR {unsigned ShortVersion_major; unsigned ShortVersion_minor; intThiszone; unsignedintSigFigs; unsignedintSnaplen; unsignedintNetwork;};/*"Libpcap" Record header.*/structPCAPREC_HDR {unsignedintts_sec; unsignedintts_usec; unsignedintIncl_len; unsignedintOrig_len;};

3. Message parsing

When Wireshark loads a package from a file, each package is parsed. Wireshark attempts to probe the package type and obtain as much information as possible about the package. At this point, however, you only need to display information in the Message list pane (Packet List pane).

When a user selects a specific package in the Package List pane, it is re-parsed once. At this point, Wireshark attempts to obtain each piece of information and appears in the Message details pane (Packet Detail pane).

Wireshark supports a variety of file formats, which are implemented by the code in the wiretap directory. In a nutshell, there is a open_info struct array open_info_base in FIRE_ACCESS.C, which is part of the following:

Static structOpen_info open_info_base[] = {    { "Pcap", Open_info_magic, Libpcap_open,"Pcap", NULL, null}, {"PcapNG", Open_info_magic, Pcapng_open,"Pcapng", NULL, null}, {"Ngsniffer", open_info_magic, ngsniffer_open, NULL, NULL, NULL}, {"Snoop", open_info_magic, snoop_open, NULL, NULL, NULL}, {"IP Trace", open_info_magic, iptrace_open, NULL, NULL, NULL}, {"Netmon", open_info_magic, netmon_open, NULL, NULL, NULL}, {"NetXRay", open_info_magic, netxray_open, NULL, NULL, NULL}, {"Radcom", open_info_magic, radcom_open, NULL, NULL, NULL}, {"Nettl", open_info_magic, nettl_open, NULL, NULL, NULL}, {"Visual", open_info_magic, visual_open, NULL, NULL, NULL}, {"5 views", open_info_magic, _5views_open, NULL, NULL, NULL}, {"Network Instruments", open_info_magic, network_instruments_open, NULL, NULL, NULL}, {"Peek Tagged", open_info_magic, peektagged_open, NULL, NULL, NULL}, {"DBS Etherwatch", open_info_magic, dbs_etherwatch_open, NULL, NULL, NULL}, {"K12", open_info_magic, k12_open, NULL, NULL, NULL}, {"Catapult DCT", open_info_magic, catapult_dct2000_open, NULL, NULL, NULL}, {"Aethra", open_info_magic, aethra_open, NULL, NULL, NULL}, {"Btsnoop", Open_info_magic, Btsnoop_open,"Log", NULL, null}, {"eyesdn", open_info_magic, eyesdn_open, NULL, NULL, NULL}, {"TNEF", open_info_magic, tnef_open, NULL, NULL, NULL}, {"MIME Files with Magic Bytes", open_info_magic, mime_file_open, NULL, NULL, NULL}, {"Lanalyzer", Open_info_heuristic, Lanalyzer_open,"TR1", NULL, null}, ...};

In the Init_open_routines function in FILE_ACCESS.C, it is assigned to the global variable Open_routines.

In the Wtap_open_offline function in FILE_ACCESS.C, this array is traversed until the open function can open the given file.

Switch((*open_routines[i].open_routine) (wth, err, Err_info)) { Case-1:    /*I/O error-give up*/Wtap_close (wth); returnNULL; Case 0:    /*No I/O error, but not that type of file*/     Break; Case 1:    /*We found the file type*/    Gotosuccess;}

4. Reference

Wireshark Development Guide 6th Chapter "How Wireshark Works"

Wireshark capture Package and file format support