[PATCH v5 0/4] wireshark extcap support

Stephen Hemminger stephen at networkplumber.org
Sat Oct 17 00:30:30 CEST 2026


This series adds live packet capture from a running DPDK application
over the telemetry socket which is usable as a source of Wireshark
external capture (https://www.wireshark.org/docs/man-pages/extcap.html)

Capture is avaliable by default but can be disabled on the command
line with --no-capture. It works on Linux and FreeBSD.

How it works:
 - The capture library registers telemetry commands (/ethdev/capture/*)
 - Callbacks are installed on the specified port/queues to copy packets
 - Packets are formatted as pcapng and written to the specified output
 - No packet data passes through the telemetry socket itself

Advantages of this:
 - no secondary process needed to capture
 - installation is just putting the helper in the extcap directory
 - the helper has no dependency on DPDK libraries,
   so it can be packaged with Wireshark
 - allows for live capture
 - supports BPF (with JIT) for filtering

Implementation Details:
 - uses it is own version of userspace RCU to allow for callback
   to not need read-modify-write operations. Existing DPDK QSBR
   is ununsuitable because it requires the application to report quiescent
   states, and the point here is that the application stays unchanged.
   This RCU implementation could be integrated later into existing library.
 - helper is a C program so that it can be installed with privilege.
   That is what lets Wireshark capture from a root application
   without itself running as root.
   See doc/guides/tools/wireshark_extcap.rst.
 - Windows support is not possible with current design because
   telemetry is not available on DPDK for Windows.

Testing:
  - dpdk-wireshark-extcap --extcap-interfaces lists the ports.
    Reasons for an empty list go to stderr, which the GUI hides.
  - Unit tests are in app/test/test_capture.c
  - Tested on Linux capturing from a root application as a non-root
    user. The unit test also passes on FreeBSD.

v5
 - fix build errors on FreeBSD
 - split into smaller files
 - callbacks use a local userspace RCU instead of a use count,
   so the datapath has no atomic read-modify-write
 - added the --no-capture EAL option
 - renamed the internal filter API, it was using an rte_ prefix
   for something private to the library

Stephen Hemminger (4):
  capture: infrastructure wireshark packet capture
  eal: add --no-capture option
  test: add test for capture hooks
  usertools: add script for wireshark capture

 MAINTAINERS                                   |    5 +
 app/test/meson.build                          |    1 +
 app/test/test_capture.c                       |  688 ++++++++++
 doc/guides/linux_gsg/eal_args.include.rst     |    4 +
 doc/guides/prog_guide/capture_lib.rst         |  196 +++
 .../prog_guide/img/capture_overview.svg       |   49 +
 doc/guides/prog_guide/index.rst               |    1 +
 doc/guides/rel_notes/release_26_11.rst        |    5 +
 doc/guides/tools/index.rst                    |    1 +
 doc/guides/tools/wireshark_extcap.rst         |  203 +++
 lib/capture/capture.c                         |  661 ++++++++++
 lib/capture/datapath.c                        |  414 ++++++
 lib/capture/filter.c                          |  179 +++
 lib/capture/meson.build                       |   42 +
 lib/capture/multiproc.c                       |  250 ++++
 lib/capture/output.c                          |  311 +++++
 lib/capture/private.h                         |  233 ++++
 lib/capture/rcu.c                             |  258 ++++
 lib/capture/rcu.h                             |  112 ++
 lib/eal/common/eal_common_config.c            |    7 +
 lib/eal/common/eal_common_options.c           |    3 +
 lib/eal/common/eal_internal_cfg.h             |    1 +
 lib/eal/common/eal_option_list.h              |    1 +
 lib/eal/include/rte_eal.h                     |    9 +
 lib/meson.build                               |    1 +
 usertools/dpdk-wireshark-extcap.c             | 1131 +++++++++++++++++
 usertools/meson.build                         |   23 +
 27 files changed, 4789 insertions(+)
 create mode 100644 app/test/test_capture.c
 create mode 100644 doc/guides/prog_guide/capture_lib.rst
 create mode 100644 doc/guides/prog_guide/img/capture_overview.svg
 create mode 100644 doc/guides/tools/wireshark_extcap.rst
 create mode 100644 lib/capture/capture.c
 create mode 100644 lib/capture/datapath.c
 create mode 100644 lib/capture/filter.c
 create mode 100644 lib/capture/meson.build
 create mode 100644 lib/capture/multiproc.c
 create mode 100644 lib/capture/output.c
 create mode 100644 lib/capture/private.h
 create mode 100644 lib/capture/rcu.c
 create mode 100644 lib/capture/rcu.h
 create mode 100644 usertools/dpdk-wireshark-extcap.c

-- 
2.53.0



More information about the dev mailing list