If you miss an important parameter, you can create an issue.īut if you want something to be added quickly, please do a patch proposal with the missing parameter or feature (it is easy!). There is actually no specific work to add more TShark parameters. unwrap_or_else ( | e | panic! ( 'Error starting tshark: Development rules New parameters input_path ( '/tmp/my.pcap ' ) // Start a new tshark process let mut rtshark = builder. Example // Creates a builder with needed tshark parameters let builder = rtshark :: RTSharkBuilder ::builder ( ). This crates supports both offline processing (using pcap file) and live analysis (using an interface or a fifo). TShark application must be installed for this crate to work properly. TShark's native capture file format is pcapng format, which is also the format used by Wireshark and various other tools. It lets you capture packet data from a live network or read packets from a previously saved capture file, printing a decoded form of those packets. This crate provides an API to start TShark and analyze it's output.

TShark is a part of Wireshark distribution. A Rust interface to TShark, the famous network protocol analyzer.

Tshark read pcap