Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the former containing the information it is programmed to receive in pcapng format, and the latter a human-readable text interpretation.

As it stands, I can't find a way to reliably and continuously get information from the hone device. I could use cat, but it runs the risk of cutting off writing mid-packet. HONE also comes with a program for logging the information to a file, called honelogd, but still, I need to run my software continuously.

Is it possible to configure Wireshark to accept this pseudo-device as a capture interface?

share|improve this question
add comment

1 Answer

Wireshark is usually a poor choice for things that must run continuously. dumpcap, part of the wireshark suite, is a better choice. You should be able to specify the hone device with -i hone (or -i /dev/hone) to dumpcap. Alternatively, dumpcap can read from a named pipe, which could read from the device. See: https://www.wireshark.org/docs/man-pages/dumpcap.html

share|improve this answer
    
Thanks for the advice. I'd tried the former, which didn't work, but given the chance, I'll attempt the named pipe route. –  Dolphiniac May 4 '13 at 14:17
    
Okay, finally checked the man page, and even though it told me the problem, I tried it just to be thorough. I made a named pipe and read info from /dev/hone into it, then used the pipe to capture with dumpcap. Apparently, reading from a named pipe does not support pcap-ng format. It throws an 'unrecognized libpcap format' error and exits. Unless I can have something capture pcapng, there is no point to it, as the extra information is essential to my project. –  Dolphiniac May 5 '13 at 13:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.