05. Catnip Wireshark Integration

Wireshark Integration

Catnip provides native integration with Wireshark through the extcap (External Capture) plugin mechanism.

Current Limitations:

• Multiple instances: Running multiple simultaneous Wireshark captures on the same machine is not recommended.
• Permissions: May require elevated permissions depending on system configuration.

Extcap Plugin Installation

Extcap is a Wireshark plugin interface that allows external tools to appear as native capture interfaces. This means CatSniffer can integrate directly into Wireshark's graphical interface without the need for intermediate processes.

Important

Symbolic links are necessary to ensure the catnip tool correctly executes the Wireshark integration

Windows

1.Clone/download the CatSniffer-Tools and Sniffle repository. Unzip the download files if needed. It is recommended to save them in an easy-to-access path.

2.Open WireShark.

3.Find the location of your Personal Extcap folder in the 'About Wireshark' dialog (Help > About Wireshark > Folders > Personal Extcap path).

Note

It may be possible that the Extcap folder does not exist. Click on the "Personal Extcap path" text so Wireshark creates this directory. The directory will be created after allowing the process.

• Under Windows, it can be found at %USERPROFILE%\AppData\Roaming\Wireshark\extcap

Personal Extcap Path

4.Create a symbolic link to the lora_extcap.py and sniffle_extcap.py files. Creating symbolic links allows easy updates to the files.

• Navigate to the path where you saved the CatSniffer-Tools and Sniffle files
• Create the symbolic link to the Extcap Personal directory

Important

Symbolic links in Windows can only be made using CMD with admin permissions; using PowerShell or similar will end up with an error message.

• Symbolic link for lora_extcap.py

  mklink "%APPDATA%\Wireshark\extcap\lora_extcap.py" "C:\{PATH}\{TO}\CatSnifer-Tools\catnip\lora_extcap.py"

Symbolinc creation for lora_extcap.py

• Symbolic link for sniffle_extcap.py

  mklink "%APPDATA%\Wireshark\extcap\sniffle_extcap.py" "C:\{PATH}\{TO}\Sniffle\python_cli\sniffle_extcap.py"

Symbolinc creation for sniffle_extcap.py

This way, you can pull any updates in the Sniffle folder, and the changes to the sniffle_extcap.py will be directly made. This also applies to the lora_extcap.py, as this will be automatically updated if Catnip finds a new version.

5.Once the plugin has been installed, restart Wireshark or choose Capture > Refresh Interfaces to enable the Sniffle interface.

---

Linux and macOS

1.Clone/download the Sniffle repository. Unzip the download file if needed.

2.Locate the Wireshark extcap directory.

• Linux: ~/.local/lib/wireshark/extcap/
• macOS: ~/Library/Application Support/Wireshark/extcap/

3.Create a symbolic link from the terminal. From your terminal, navigate to the directory containing the dissector files and run the following commands to link them to Wireshark:

• Command to link the lora_extcap.py dissector:

ln -s /path/to/CatSniffer-Tools/catnip/lora_extcap.py ~/.local/lib/wireshark/extcap/lora_extcap.py

• Command to link the sniffle_extcap.py dissector:

ln -s /path/to/sniffle/sniffle_extcap.py ~/.local/lib/wireshark/extcap/sniffle_extcap.py

Your Wireshark extcap directory should look like this:

4.Give execution permissions.

chmod +x ~/.local/lib/wireshark/extcap/lora_extcap.py
chmod +x ~/.local/lib/wireshark/extcap/sniffle_extcap.py

5.Verify installation by restarting Wireshark. The Plugin should appear in the capture interface list.

Note

You may face an error when trying to trigger the Wireshark integration with a permission error; if so, use the following command to give Wireshark capture permissions:

1. Configure the capture permissions

sudo dpkg-reconfigure wireshark-common.

2. Add your user to the group.

sudo usermod -aG wireshark $USER

3. Apply the changes by logging out and logging in again.

Capture workflow

Usage example command:

catnip sniff ble --wireshark -c 37 -m passive_scan

Refer to section Sniffing BLE for complete information about the available commands.

What happens internally:

1. Firmware verification: If Sniffle is not installed, it is flashed automatically
2. PCAP pipe creation: /tmp/fcatnip is created as a named pipe
3. Sniffer configuration: BLE channel and mode are configured
4. Wireshark launch: Wireshark is executed, pointing to the pipe
5. Packet streaming: Captured packets flow in real-time to Wireshark

Advantages of integrated workflow:

• Real-time analysis: View packets as they are captured
• Wireshark filters: Apply complex display filters
• Export: Save captures in .pcap format for later analysis
• Advanced dissectors: Leverage Wireshark's dissectors for BLE, 802.15.4, etc.