4 Capturing
4.3 Statistics
The host tool
--capture-stats
option can be used to enable regular statistic updates on the terminal.
The ”set capture-stats true” command can be used to do this at runtime. (You can enter this command on
the Wireshark extcap toolbar, for example.)
4.4 Capturing to a File
The host tool
--fifo
option can be used to capture either to a real file on disk, or a named FIFO. The
capture_start
command is similar, and can be used to start capturing via the host tool command line or
IPC interface. The format of the output is PcapNG (see https://pcapng.github.io/pcapng/). You may use
the third party open source libpcap library to parse such files. If you use an actual FIFO, you can stream
in real time.
Note that if you capture to disk, overruns can happen due to waiting on disk I/O. The host tool tries to
avoid this by using decoupled memory buffers, but these may be slowly filled up, until a software overrun
happens.
Example
# Capturing to a file until Ctrl+C is hit, and log capture statistics to stdout.
nose --capture-stats --fifo target_file.pcapng
# Manually starting Wireshark.
# On terminal 1:
mkfifo /tmp/fifo
nose --fifo /tmp/fifo
# On terminal 2:
wireshark -k -i /tmp/fifo
4.5 Selecting the Device
If you have multiple Ethernet Debuggers, the
--device
option can be used to pick a specific device. Pass-
ing the special value
help
to this option lists all devices that were found.
Multi-Capture
Selecting multiple devices at once is not possible. However, if extcap is correctly installed,
you can select multiple capture devices in Wireshark. This will provide a merged view of
data coming from multiple devices and host tool instances.
4.6 Configuring the Buffer Size
The
--capture-soft-buffer
and
--capture-usb-buffer
can be used to fine-tune the sizes of the fixed
size buffers allocated on the host. Raising them may reduce buffer overruns on the host PC.
14
