2

I have successfully installed wireshark on centos 6.4 I can run the command tshark it works perfectly fine. I want to run gdb so that I want to learn how it decodes tcp and udp packet as I am writing an application where I need to dissect these two types of packets. When I run libtool --mode=execute gdb tshark it run and stop at here (gdb) it not capturing anything.

2

Gdb doesn't automatically run the executable for you, it just loads it. This way you can set things up (e.g. breakpoints) as you wish first.

The "run" command at the (gdb) prompt will start execution. This also allows you to specify command-line arguments to tshark, eg:

(gdb) run -i lo

Will run tshark the same way tshark -i lo would.

  • I tried and got this (gdb) run -i lo Starting program: /root/Desktop/wireshark-1.10.1/.libs/lt-tshark -i lo [Thread debugging using libthread_db enabled] Detaching after fork from child process 3232. Running as user "root" and group "root". This could be dangerous. Detaching after fork from child process 3255. Capturing on 'Loopback' Detaching after fork from child process 3270. – biz14 Aug 11 '13 at 17:01
2

Keep in mind that Wireshark and its suite of related tools (mergecap, TShark, etc.) are all open-source. Perhaps you'll find it easier to read the source, as opposed to stepping through disassembly?

The TShark application in particular is a single C source file (tshark.c) in the Wireshark source code distribution, which can be downloaded here: https://www.wireshark.org/download/src/

  • infact I know the protocol I want to disassemble and I find that like the packet-tcp.c is very detail. I got my payload how to just capture the url for now. – biz14 Aug 12 '13 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.