Parsing PCAPs in LabVIEW

[DailyDose]

Not too long ago I wrote a very simple parser to read the data packets out of a PCAP created by wireshark.  It was simple, but it worked.  But then someone gave me a PCAP created by TSHARK and my parser couldn't do anything with it.  I searched the internet for TSHARK data structure and it's not that different from Wireshark - however there's a decent amount of PC meta data in the header which is not specified in any document I've read and I can't find any common values in the header that would suggest it know the next X characters are meta data.  And I also realized that I was just parsing and assuming the PCAPs given to me were all UDP - but what if there's other traffic in that PCAP. So my simple parser suddenly felt very lacking.  Instead of sinking a ton of work into something created in other languages, I was wondering if anyone had a DLL suggestion that can parse PCAPs - can be instructed to just spit out UDP, and spits out ALL the data packets as either string or U8 array.  Really hoping here.  Would be extremely helpful.

[PalanivelThiruvenkadam]

Have you tried accessing the TSHARK Files in Wireshark? Any Difference?

What is the Data Parsing method you have tried for reading WIRESHARK PCAP Files.?

Also can you share the TSHARK  PCAP files here?

[DailyDose]

---

@PalanivelThiruvenkadam wrote:

Have you tried accessing the TSHARK Files in Wireshark? Any Difference?

---

Yes.  Looks exactly the same in terms of viewing in wireshark.

---

@PalanivelThiruvenkadam wrote:

What is the Data Parsing method you have tried for reading WIRESHARK PCAP Files.?

---

It was a custom one I made.  Following Wireshark PCAP header guidelines that you can find on the internet, I made a parser that was pretty accurate when it came to UDP packets (I only read UDP).

---

@PalanivelThiruvenkadam wrote:

Also can you share the TSHARK  PCAP files here?

---

I've posted a couple images and I'll detail what's going on.

Circled in red is the "Magic phrase" that describes some details about the header and endianess of the data.  According to the internet, this should be the very first thing in the header for both TShark and Wireshark.  As you can see, it is not.  But Wireshark is still able to pull in the TShark PCAP and read it just fine.

You will also notice in the following image, circled in red, is network/PC meta data (this data is within the header). You'll notice this data is not present in the Wireshark PCAP.  I've looked through the internet for a TShark explanation and I am coming up dry.  So, at this point... just give me a pre-existing PCAP reader.

[billko]

Do you think anything in this link could be of use to you?

[DailyDose]

I had been using those commands to do the TShark stuff... but while I was reading, I noticed the -R/-r commands and the details it gave about that.  Which prompted me to go to Wireshark forums and ask them.  So we'll see what they say about those commands and if they can be helpful.

[billko]

---

@DailyDose wrote:

I had been using those commands to do the TShark stuff... but while I was reading, I noticed the -R/-r commands and the details it gave about that.  Which prompted me to go to Wireshark forums and ask them.  So we'll see what they say about those commands and if they can be helpful.

---

Unfortunately I don't know very much about tshark.  Good luck!  🙂