4 ms·
Wireshark offers a different query language. As an alternative, just open a raw socket directly (or use any of the ringbuffer-ish alternatives - look at what t
by JoachimSchipper 10y ago
Wireshark offers a different query language.
As an alternative, just open a raw socket directly (or use any of the ringbuffer-ish alternatives - look at what tcpdump=libpcap does for your OS). Working directly with raw sockets can make perfect sense, but you may still want to use libpcap to compile your BPF (i.e. traffic filters).
- txutxu 10y agoDid find this: http://www.ntop.org/products/packet-capture/pf_ring/ http://www.ntop.org/products/packet-capture/pf_ring/ I think does not rely in libpcap. Also did find some python which can read pcap files but does not use libpcap. It's hard to find tested/adopted alternatives.