Dynamically process Wireshark output with Powershell

Posted on 2014-08-04
Medium Priority
Last Modified: 2014-08-11
I have started to use Wireshark to monitor some network traffic, I can configure the settings to get exactly the data I want but want to dynamically (i.e. alongside wireshark obtaining the data) process it with a powershell script. Is there a way I can do this - I am new to both Wireshark and Powershell so a fool proof description would be good.
Question by:Blowfelt82
  • 2
LVL 57

Expert Comment

ID: 40239026
Is there any reason you want to do both at the same time?

First Wireshark is an inteface into winpcap, which actually does the data capture.  What you see in wireshark is NOT what you get out of winpcap.  Winpcap passes the raw data to Wireshark and Wireshark formats it for humans and can analyze the data.

Have you actually looked at a saved Wireshark file to see what it looks like?
LVL 72

Accepted Solution

Qlemo earned 2000 total points
ID: 40239187
PowerShell does have no native way to access WireShark, which would be necessary to process live data.
The non-GUI tools of WireShark (in particular tshark can provide a text stream you can pipe into a PS script.

But the main question is: What do you want to achieve with that? Sophisticated analysis is usually applied to capture files, not the live stream, as online analyzing consumes a lot of resources.
LVL 72

Expert Comment

ID: 40239193
The first step when using WireShark is always to ask "What do I want to see?". Just letting it run, and hoping you find something suspicious is naive. Interpreting the WireShark capture is a sophisticated act; you can't apply rules unless you know very clearly what to look after.

Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question