Re: RFC: a loadable plugin framework for external capture backends

[Guy Harris <gharris () sonic net>]

On Oct 2, 2026, at 6:56 AM, Michael Richardson <mcr () sandelman ca> wrote:

> Vadim Goncharov <vadimnuclight () gmail com> wrote:
>
> > AFAIR Wireshark already does capturing via separate process always (dumpcap).
>
> I didn't think it always did that.

The reasons for the *existence* of dumpcap are historical.

Originally, the capturing was done directly by Wireshark - but that was when you run a capture, which popped up a 
packet-counting window, and then when you stopped the capture, Wireshark would read the file and show the packets.

When "Follow captured packets in real time", or whatever it was called, was added, pthreads were not a widely-available 
feature, so Wireshark would fork and do the capturing in the child and display the packets in the parent. Eventually, 
dumpcap was created; I forget whether "run only it with privileges" was part of the motivation, or whether it was 
mainly "most of Wireshark isn't being used in the capture process, we might as well just carve that code out and put it 
in a separate program".

_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s