Note that this does not permit capturing arbitrary protocols on a named pipe on your machine it only supports using a named pipe as a mechanism for supplying packets, in the form of a pcap or pcapng packet stream, to Wireshark. On Windows, it must be typed slowly (or pasted). The named pipe is not listed in the drop-down interface selection, and must be typed into the interface box. A few patches have been mailed to the development list that could solve this, so if you find the approach inconvenient, try the patches. This only works with the de facto standard libpcap format version 2.4, as described in Development/LibpcapFileFormat, and with the standard pcapng format.Ĭapturing from a pipe is inconvenient, because you have to set up the pipe and put a file header into the pipe before you can start the capture.

There are some limitations that you should be aware of:

because it is not a network type supported by the version of libpcap/WinPcap on your machine, or because you want to capture traffic on an interface on another machine and your version of libpcap/WinPcap doesn't support remote capturing from that machine. This is useful if you want to watch a network in real time, and Wireshark cannot capture from that network, e.g. Since pipes are supported, Wireshark can also read captured packets from another application in real time.

Before pipes, Wireshark could read the captured packets to display either from a file (which had been previously created) or for a network interface (in real time).

Wireshark tcpdump