Reading cached packets with Wireshark
Would you like to sniff packets that were sent/received some minutes, hours or even days ago in Wireshark? Can't afford to buy a time machine? Then your best chance is to install PacketCache, which allows you to read OLD packets with Wireshark.
We recently released a free tool for keeping a cache of recently sent/received network traffic in Windows. The tool, called PacketCache, is actually a Windows service that saves a copy of recent packets in RAM. The cached packets can be read simply by connecting to a named pipe called “PacketCache”, for example by using a PowerShell script as shown on the PacketCache page.
After talking to some Wireshark core developers at
SharkFest Europe
last week we managed to get Wireshark to read packets from PacketCache's named pipe stream.
However, you will need to use Wireshark 2.3 or later to properly read from a named pipe.
Unfortunately version 2.3 isn't scheduled for release until next summer (2017),
so until then you'll have to use one of the automated builds instead.
I usually go for the latest WiresharkPortable build, since it doesn't require installation.
You can download the portable version of Wireshark 2.3 here:
https://www.wireshark.org/download/automated/win32/
Look for a file called “WiresharkPortable_2.3.[something].paf.exe”.
Follow these steps in order to read packets captured by PacketCache:
- Make sure you have Wireshark 2.3.0 (or later)
- Start Wireshark with admin rights (right-click > “Run as administrator”)
- Press: Capture > Options
- Click “Manage Interfaces...”
- Select the “Pipes” tab
- Press the “+” button to add a named pipe
- Name the pipe “\\.\pipe\PacketCache” and press ENTER to save it
- Press “OK” in the Manage Interface window.
- Press “Start” to read the packets from PacketCache
The status field in Wireshark will say “Live capture in progress”, which is somewhat true. Wireshark will be updating the GUI live as packets are read from PacketCache, but the packets displayed can be several hours or even days old depending on when they were captured by PacketCache. The “live” capture will stop once all packets have been read from the PacketCache.
Posted by Erik Hjelmvik on Friday, 28 October 2016 14:50:00 (UTC/GMT)
Tags: #Netresec #PCAP #PacketCache #Wireshark #named pipe #SharkFest
