Re: RFC: a loadable plugin framework for external capture backends

[Guy Harris <gharris () sonic net>]

On Oct 9, 2026, at 3:12 PM, Denis Ovsienko <denis () ovsienko info> wrote:

> In this case each plugin would be able to crash, hang, run OOM, set and
> trip setrlimit(2), configure, receive and handle signals, set timers and
> atexit(3) handlers, override standard library calls, link with 3rd-party
> libraries, experience/mitigate/fix its own vulnerabilities, elevate and
> drop privileges, run containerised, under debugger/strace/profiler etc.
> -- all entirely at its end of the "socket".

So the plugin is an executable running in a process separate from the process using libpcap rather than a loadable 
object running in the process using libpcap?

This sounds similar to Wireshark extcaps, although those are oriented towards the captured packets being consumed by 
reading a file. That works for Wireshark and TShark, but it wouldn't work for all applications (and doesn't work very 
well for TShark being run without writing to a file, i.e. capture packets and print the dissection, like tcpdump 
without -w).

Either that, or the plugin is loaded into the address space, but just sets up the external process, or sets up the 
external process and passes the packets it delivers to libpcap's caller.
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s