Link to home
Start Free TrialLog in
Avatar of Blowfelt82
Blowfelt82

asked on

Dynamically process Wireshark output with Powershell

I have started to use Wireshark to monitor some network traffic, I can configure the settings to get exactly the data I want but want to dynamically (i.e. alongside wireshark obtaining the data) process it with a powershell script. Is there a way I can do this - I am new to both Wireshark and Powershell so a fool proof description would be good.
Avatar of giltjr
giltjr
Flag of United States of America image

Is there any reason you want to do both at the same time?

First Wireshark is an inteface into winpcap, which actually does the data capture.  What you see in wireshark is NOT what you get out of winpcap.  Winpcap passes the raw data to Wireshark and Wireshark formats it for humans and can analyze the data.

Have you actually looked at a saved Wireshark file to see what it looks like?
ASKER CERTIFIED SOLUTION
Avatar of Qlemo
Qlemo
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The first step when using WireShark is always to ask "What do I want to see?". Just letting it run, and hoping you find something suspicious is naive. Interpreting the WireShark capture is a sophisticated act; you can't apply rules unless you know very clearly what to look after.