How to leave only the dissectors of signaling protocols?
I have already built full versions of wireshark, but I need to make one that only interprets the signaling protocols for GSM mobile communications and IP telephony. I must also modify the capture so that it never stops, I guess that to achieve this I must modify the buffers but I have no idea how to do it until now if you could help me with this I would also appreciate it.
Comments
Why not use tcpdump, which doesn't have all the extra dissectors, to make the captures?
Or
dumpcap
, which is cross-platform. You could even usetshark
too, which is also cross-platform, and in theory could also be used to capture "To Infinity and Beyond!"; however, I still prefer to usedumpcap
for long-term capturing.Actually, I need to create an UI that returns a file with the dissection information that I request. but that does not compromise the processing speed so as not to affect the capture. I'm going to explore the functionalities of the modules that you mention, but I wanted to see if there is a way to use the dissectors that I want before the compilation, to lighten the processing load.
Note that if your capture traffic doesn't include packets for other dissectors, then they won't be doing anything apart from taking up some memory.
If you can externally limit traffic to your capture device, or concoct a capture filter that limits the captured traffic to that which you require, then you will have reduced the load considerably.