3 ms·

Just realized I’ve been using Wireshark over two decades (well, Ethereal until 2006). One thing some may overlook is that it uses WinPcap (now Npcap) to actual

by 300bps 5y ago

Just realized I’ve been using Wireshark over two decades (well, Ethereal until 2006). One thing some may overlook is that it uses WinPcap (now Npcap) to actually do packet capturing. It is trivial to make .NET and probably other framework applications to make your own special-purpose sniffer using that library. I once wanted a feature that mimicked the Wireshark Conversations feature but didn’t require storing total details of every packet. Rather it just stored the bytes in/bytes out of every host seen on the wire. Had first version up in about an hour! Took a day and some iteration for it to be fast enough to handle the real-time flow of data coming from WinPcap though.

cookiengineer 5y ago
The amazing part behind the pcapng format is that it's a streamlined format for multiple network interface streams. And, tcpdump and most snort using tools have support for it too. You can literally build a local IDS/IPS by using command line tools these days. As a former network security engineer, wireshark helped me really _understand_ problems in network protocols, in addition to reading other implementations and the RFCs. It taught me about wrong assumptions in the protocols, naive implementations and their exploitable bugs, and so on. It's amazing as a tool to make unit tests with exported buffers for your parsers, too :) Wireshark and tcpdump are really underappreciated tools in the network space, and I can highly recommend getting familiar with them. Having the possibility to have a remote pcap stream from a buggy server inside your local wireshark GUI is just way much more efficient for debugging. Debugging time is reduced from days to minutes, quite literally. I use tcpdump in my CI/CD build environments, too, which makes debugging a failed network test a blaze. I can just open the pcap file with wireshark or do a local replay of the same packages to test the code, which is amazing.
spydum 5y ago
You can use netsh trace to perform packet captures, and convert them to pcapng format. Real common for server workloads (where I don't recommend installing Wireshark.. analysis should not be done on the server, in case any type of vuln in Wireshark could be abused)
- adzm 5y ago
  This is amazing! https://github.com/microsoft/etl2pcapng https://github.com/microsoft/etl2pcapng microsoft's etl2pcapng tool appears to be the tool of choice to convert it.

by 300bps 5y ago

cookiengineer 5y ago

The amazing part behind the pcapng format is that it's a streamlined format for multiple network interface streams. And, tcpdump and most snort using tools have support for it too. You can literally build a local IDS/IPS by using command line tools these days. As a former network security engineer, wireshark helped me really _understand_ problems in network protocols, in addition to reading other implementations and the RFCs. It taught me about wrong assumptions in the protocols, naive implementations and their exploitable bugs, and so on. It's amazing as a tool to make unit tests with exported buffers for your parsers, too :) Wireshark and tcpdump are really underappreciated tools in the network space, and I can highly recommend getting familiar with them. Having the possibility to have a remote pcap stream from a buggy server inside your local wireshark GUI is just way much more efficient for debugging. Debugging time is reduced from days to minutes, quite literally. I use tcpdump in my CI/CD build environments, too, which makes debugging a failed network test a blaze. I can just open the pcap file with wireshark or do a local replay of the same packages to test the code, which is amazing.

spydum 5y ago

You can use netsh trace to perform packet captures, and convert them to pcapng format. Real common for server workloads (where I don't recommend installing Wireshark.. analysis should not be done on the server, in case any type of vuln in Wireshark could be abused)

adzm 5y ago
This is amazing! https://github.com/microsoft/etl2pcapng https://github.com/microsoft/etl2pcapng microsoft's etl2pcapng tool appears to be the tool of choice to convert it.