This chapter will give you a short overview of how Wireshark works.

The following will give you a simplified overview of Wireshark's function blocks:

The function blocks in more detail: GTK 1/2 Handling of all user input/output (all windows, dialogs and such). Source code can be found in the gtk directory. Core Main "glue code" that holds the other blocks together. Source code can be found in the root directory. Epan Ethereal Packet ANalyzer (XXX - is this correct?) the packet analyzing engine. Source code can be found in the epan directory. Protocol-Tree - Keep data of the capture file protocol information. Dissectors - The various protocol dissectors in epan/dissectors. Plugins - Some of the protocol dissectors are implemented as plugins. Source code can be found at plugins. Display-Filters - the display filter engine at epan/dfilter. Capture Capture engine. Wiretap The wiretap library is used to read/write capture files in libpcap and a lot of other file formats. Source code in the wiretap directory. Win-/libpcap (not part of the Wireshark package) The platform dependent packet capture library, including the capture filter engine. That's the reason why we still have different display and capture filter syntax, as two different filtering engines are used.

Capturing will take packets from a network adapter, and save them to a file on your harddisk. To hide all the lowlevel machine dependent details from Wireshark, the libpcap/WinPcap (see ) library is used. This library provides a general purpose interface to capture packets from a lot of different network interface types (Ethernet, Token Ring, ...).

Wireshark can read and write capture files in its natural file format, the libpcap format, which is used by many other network capturing tools, e.g. tcpdump. In addition to this, as one of its strengths, Wireshark can read/write files in many different file formats of other network capturing tools. The wiretap library, developed together with Wireshark, provides a general purpose interface to read/write all the file formats. If you need to add another capture file format, this is the place to start.

While Wireshark is loading packets from a file, each packet is dissected. Wireshark tries to detect the packet type and gets as much information from the packet as possible. In this run though, only the information shown in the packet list pane is needed. As the user selects a specific packet in the packet list pane, this packet will be dissected again. This time, Wireshark tries to get every single piece of information and put it into the packet details pane.