Can Autoit interact and analyse Wireshark info.?

[Curious52]

I try to find the way to use Autoit for interacting and analyse Wireshark tool (get some specific data), can Autoit do it? If YES, please provide some related links?

Thanks to any help

[orbs]

in Wireshark, File > Export you can export the capture data to text file, which can later be analyzed by AutoIt.

this thread has some more info: http://serverfault.com/questions/150167/how-do-i-convert-wireshark-capture-files-to-text-files

if you mean real-time analysis, then direct the Wireshark stdout stream to be read by AutoIt. i forget how it's done, but it's not hard, search the web for it.

[Curious52]

Yes, I meant real-time analsysis and as you suggested I am searching the web.

Thanks for helping

[corgano]

STDoutread in the help file. If that's not what it's called, search for STD in the help file, or start typing it in SciTE and it will give you an autocorrect option for it. The example in the help file should be good enough to get you going

good luck

[iamtheky]

use tshark to dump logs of desired output. But if its a large capture you might want to set some artificial limits, unless you want to reach the physical ones.

http://www.wireshark.org/docs/man-pages/tshark.html

 

maybe a loop with the parameter -c set to something reasonable, that writes a uniquely named file each iteration.

-c <capture packet count>

Set the maximum number of packets to read when capturing live data. If reading a capture file, set the maximum number of packets to read.

Edited September 13, 2013 by boththose

[Curious52]

Hi boththose,

I did look at your TShark link, it sound interesting. However, have you try using Autoit to dump logs of desired output? By any chance you can provide some related Autoit codes?

Thanks for helping

[FireFox]

Hi,

Have you tried the Winpcap UDF?

Br, FireFox.

[Curious52]

Hi FireFox,

I haven't yet, can you provide the related link for using it with Autoit?

[FireFox]

Sure... http://lmgtfy.com/?q=winpcap+udf

[Curious52]

Thanks I will try it, thanks

[iamtheky]

If you are trying to perform real-time capture and analysis, and then maybe take actions based off what is analyzed.  I would allow AutoIt to do only the last part and allow the other tools to do exactly what they are designed for.  There was nothing gained by adding AutoIt to the Wireshark+Tshark solution as we had no need to further display or act upon the output once the target traffic was captured.

If you could explain what the endgame is, we could perhaps lead you toward the most effective solution.

[Curious52]

Hi Firefox,

I couldn't find where I can download Winpcap.au3, by any chance you know where is it?

 

[iamtheky]

'?do=embed' frameborder='0' data-embedContent>>

points to

http://opensource.grisambre.net/pcapau3/

Edited September 17, 2013 by boththose

[FireFox]

points to

 

http://opensource.grisambre.net/pcapau3/

Which is the first result in the search link I posted.

[Curious52]

Hi bothhose & firefox,

I got the Wincap.au3 as your link.

Many thanks,