As examples on how to use the tap system see the implementation of
tap-rpcstat.c (tshark version)
-gtk/rpc_stat.c (gtk-wireshark version)
+ui/qt/rpc_service_response_time_dialog.cpp (wireshark version)
If all you need is to keep some counters, there's the stats_tree API,
which offers a simple way to make a GUI and tshark tap-listener; see
This callback is used when Wireshark wants your application to redraw its
output. It will usually not be called unless your application has received
new data through the (*packet) callback.
-On some ports of Wireshark (gtk2) (*draw) will be called asynchronously
+On some ports of Wireshark (Qt) (*draw) will be called asynchronously
from a separate thread up to once every 2-3 seconds.
On other ports it might only be called once when the capture is finished
or the file has been [re]read completely.
Perhaps you want an extension that will execute a certain command
every time it sees a certain packet?
Well, try this :
- int packet(void *tapdata,...) {
+ gboolean packet(void *tapdata,...) {
...
system("mail ...");
- return0;
+ return FALSE;
}
register_tap_listener("tcp", struct, "tcp.port==57", NULL, packet, NULL);
See tap-rpcstat.c for an example
See tap.c as well. It contains lots of comments and descriptions on the tap
system.
-
-
-
-