Windows support for live capture

[wino45]

https://wiki.wireshark.org/CaptureSetup/Pipes

Maybe this mechanism could make this project to work in real time and on MS Windows. Anyway I saw this work for nRF sniffer.
https://www.nordicsemi.com/eng/Products/Bluetooth-low-energy/nRF-Sniffer

[spacehuhn]

That nRF thing has it's own software and firmware.

Sure you can pipe things to wireshark on windows too. Still leaves the question of how to read from serial into a file. I'm sure it's possible on windows. You can port it If you want. I just don't have any intentions to do so at the moment.

[spacehuhn]

Sorry didn't mean to close this issue.

[wino45]

The nRF Sniffer is not using any files, it is not needed. When packet arrives it is send over UART to the PC (some kind of simple serialization is used - named SLIP, wihile it is not SLIP... ). The python script running on PC is deserializing a captured packet and pushes it to named pipe.
The Wireshark is configured to read from named pipe. So you have realtime sniffing. If you wan to have file you need to save it from Wireshark.

[SensorsIot]

I think this is a cool project (I am working on a similar one to detect MAC addresses in the proximity to control things).
I tried your sketch on an ESP32 and it worked quite well. But unfortunately, I got the message "Data [ Packet size limited during capture] and did not find any MAC addresses. in Wireshark.

[spacehuhn]

@SensorsIot you might want to open a new issue for this. I had the same error one or two times.

[wgaylord]

Could have python write to wiresharks stdin itself instead of using a file as a middle man. (Using subprocess.communicate)

[ankur608]

Update*
p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
By excluding the preexec_fn; was finally able to successfully stream the serial port in windows10.

---

p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True)

[emaayan]

@spacehuhn i'm guessing you know by know allready, but just incase anyone missed it
you can have windows support using named pipes, than you don't even need a file anymore.
wireshark can also use named pipes as a source and you use them in python as well
head on here for the "official" page on wireshark on this: https://wiki.wireshark.org/CaptureSetup/Pipes
additionally somone made a gist https://gist.github.com/ouoam/3462e73fcfc36d063ecd8f9a5ac77f12 with these changes

his gist also has a fix for the malformed packet
https://gist.github.com/ouoam/3462e73fcfc36d063ecd8f9a5ac77f12#file-esp32_pcap_serial-ino-L57

i also have some ideas how do improve this using tcmenu for filtering packets.