[PATCH v5 0/4] wireshark extcap support
Stephen Hemminger
stephen at networkplumber.org
Sat Oct 17 00:30:30 CEST 2026
This series adds live packet capture from a running DPDK application
over the telemetry socket which is usable as a source of Wireshark
external capture (https://www.wireshark.org/docs/man-pages/extcap.html)
Capture is avaliable by default but can be disabled on the command
line with --no-capture. It works on Linux and FreeBSD.
How it works:
- The capture library registers telemetry commands (/ethdev/capture/*)
- Callbacks are installed on the specified port/queues to copy packets
- Packets are formatted as pcapng and written to the specified output
- No packet data passes through the telemetry socket itself
Advantages of this:
- no secondary process needed to capture
- installation is just putting the helper in the extcap directory
- the helper has no dependency on DPDK libraries,
so it can be packaged with Wireshark
- allows for live capture
- supports BPF (with JIT) for filtering
Implementation Details:
- uses it is own version of userspace RCU to allow for callback
to not need read-modify-write operations. Existing DPDK QSBR
is ununsuitable because it requires the application to report quiescent
states, and the point here is that the application stays unchanged.
This RCU implementation could be integrated later into existing library.
- helper is a C program so that it can be installed with privilege.
That is what lets Wireshark capture from a root application
without itself running as root.
See doc/guides/tools/wireshark_extcap.rst.
- Windows support is not possible with current design because
telemetry is not available on DPDK for Windows.
Testing:
- dpdk-wireshark-extcap --extcap-interfaces lists the ports.
Reasons for an empty list go to stderr, which the GUI hides.
- Unit tests are in app/test/test_capture.c
- Tested on Linux capturing from a root application as a non-root
user. The unit test also passes on FreeBSD.
v5
- fix build errors on FreeBSD
- split into smaller files
- callbacks use a local userspace RCU instead of a use count,
so the datapath has no atomic read-modify-write
- added the --no-capture EAL option
- renamed the internal filter API, it was using an rte_ prefix
for something private to the library
Stephen Hemminger (4):
capture: infrastructure wireshark packet capture
eal: add --no-capture option
test: add test for capture hooks
usertools: add script for wireshark capture
MAINTAINERS | 5 +
app/test/meson.build | 1 +
app/test/test_capture.c | 688 ++++++++++
doc/guides/linux_gsg/eal_args.include.rst | 4 +
doc/guides/prog_guide/capture_lib.rst | 196 +++
.../prog_guide/img/capture_overview.svg | 49 +
doc/guides/prog_guide/index.rst | 1 +
doc/guides/rel_notes/release_26_11.rst | 5 +
doc/guides/tools/index.rst | 1 +
doc/guides/tools/wireshark_extcap.rst | 203 +++
lib/capture/capture.c | 661 ++++++++++
lib/capture/datapath.c | 414 ++++++
lib/capture/filter.c | 179 +++
lib/capture/meson.build | 42 +
lib/capture/multiproc.c | 250 ++++
lib/capture/output.c | 311 +++++
lib/capture/private.h | 233 ++++
lib/capture/rcu.c | 258 ++++
lib/capture/rcu.h | 112 ++
lib/eal/common/eal_common_config.c | 7 +
lib/eal/common/eal_common_options.c | 3 +
lib/eal/common/eal_internal_cfg.h | 1 +
lib/eal/common/eal_option_list.h | 1 +
lib/eal/include/rte_eal.h | 9 +
lib/meson.build | 1 +
usertools/dpdk-wireshark-extcap.c | 1131 +++++++++++++++++
usertools/meson.build | 23 +
27 files changed, 4789 insertions(+)
create mode 100644 app/test/test_capture.c
create mode 100644 doc/guides/prog_guide/capture_lib.rst
create mode 100644 doc/guides/prog_guide/img/capture_overview.svg
create mode 100644 doc/guides/tools/wireshark_extcap.rst
create mode 100644 lib/capture/capture.c
create mode 100644 lib/capture/datapath.c
create mode 100644 lib/capture/filter.c
create mode 100644 lib/capture/meson.build
create mode 100644 lib/capture/multiproc.c
create mode 100644 lib/capture/output.c
create mode 100644 lib/capture/private.h
create mode 100644 lib/capture/rcu.c
create mode 100644 lib/capture/rcu.h
create mode 100644 usertools/dpdk-wireshark-extcap.c
--
2.53.0
More information about the dev
mailing list