Perl script as a sniffer with built-in statistics

C Clears the GUI

In other words, when the user presses c, the callback in line 46 sends a "clear" event to interested parties, who used reg_cb() to register with the TopGUI class object – in this case, the main program in Listing 1. This in turn calls the reset() method in the TopCapture module line 12, which causes it to reset the counter. The next timer call with stats() finds empty entries; the call to the update() method in line 40 of Listing 1 notifies the TopGUI module, which in turn cleans up the GUI after the counters have been reset to zero.

When new packet data arrives, Listing  1 only needs to sort the stats data based on the counter state, format it with sprintf(), and then call update() in the TopGUI module.

Anyone hoping that TShark will also grab packets not addressed to the current host on the current subnet should think again, however. Modern switches (in contrast to the hubs from 20 years ago) do not send all packets to all connected interfaces. Packets not addressed to the host on which tshark is running, therefore, do not physically reach the host.

In a wireless LAN, however, all packets may reach all WiFi cards in the reception area, but these cards can rarely be switched to a mode in which packets addressed to other targets are forwarded to the analyzing host. If TShark is not installed on a router or a host with a special network card, it only shows the outgoing and incoming packets for the TShark host.

The Author

Mike Schilli works as a software engineer in the San Francisco Bay Area. He can be contacted at Mike's homepage can be found at

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Tshark

    The simple and practical Tshark packet analyzer gives precise information about the data streams on the network.

  • Capture File Filtering with Wireshark

    Wireshark doesn’t just work in real time. If you save a history of network activity in a pcap file using a tool such as tcpdump, you can filter the data with Wireshark to search for evidence.

  • Core Technologies

    Learn what's going on in your network, using Linux and its arsenal of packet capture tools.

  • Security Lessons

    Building a network flight recorder with Wireshark.

  • An Essential Sys Admin and Security Tool

    Wireshark fills the gap between security and system administration for those who need to know more about what’s flowing through the wires or over the airwaves in the corporate network.

comments powered by Disqus