So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the former containing the information it is programmed to receive in pcapng format, and the latter a human-readable text interpretation.

As it stands, I can't find a way to reliably and continuously get information from the hone device. I could use cat, but it runs the risk of cutting off writing mid-packet. HONE also comes with a program for logging the information to a file, called honelogd, but still, I need to run my software continuously.

Is it possible to configure Wireshark to accept this pseudo-device as a capture interface?


Wireshark is usually a poor choice for things that must run continuously. dumpcap, part of the wireshark suite, is a better choice. You should be able to specify the hone device with -i hone (or -i /dev/hone) to dumpcap. Alternatively, dumpcap can read from a named pipe, which could read from the device. See: https://www.wireshark.org/docs/man-pages/dumpcap.html

  • Thanks for the advice. I'd tried the former, which didn't work, but given the chance, I'll attempt the named pipe route. – Dolphiniac May 4 '13 at 14:17
  • Okay, finally checked the man page, and even though it told me the problem, I tried it just to be thorough. I made a named pipe and read info from /dev/hone into it, then used the pipe to capture with dumpcap. Apparently, reading from a named pipe does not support pcap-ng format. It throws an 'unrecognized libpcap format' error and exits. Unless I can have something capture pcapng, there is no point to it, as the extra information is essential to my project. – Dolphiniac May 5 '13 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.