Tail introduces a ~1-second delay, which can be tweaked with the -s argument if desired. Now, Wireshark should start immediately after selecting a capture interface and its capture buffer should be updated nearly in real-time. Wireshark's arguments instruct it to begin capturing immediately from standard input. (This part is optional, but recommended to avoid 'unknown libpcap format' errors in Wireshark.) The output of tail is piped to Wireshark. The -bytes=+0 bit instructs tail to begin from the first byte of the file.

Here's how the command works: The tail executable with the -f argument constantly outputs the content of the capture file as it is written. (Thanks to e36freak in #bash on Freenode for assistance manipulating the shell command to work in GNS3!) tail -bytes=+0 -f %c | wireshark -k -i -Īlso, check the option to automatically start the command when capturing. Modify the default Wireshark command from /usr/bin/wireshark %c to read as follows. Open the preferences dialog in GNS3 (Edit > Preferences.) and select capture preferences. The trick is to continuously dump the capture file being written by Dynagen to standard output, which can be fed to Wireshark as standard input. Linux), but Windows users will have to look elsewhere. My solution should work on all UNIX-like systems (e.g. After taking a clue from the Wireshark wiki I was able to modify the way in which Wireshark reads capture files generated by Dynagen/GNS3 and achieve a near-real-time view of the traffic, as if it was being sniffed from a physical interface.

In Wireshark, the contents of a capture file can be refreshed by pressing Ctrl+R, but this requires tedious manual intervention and navigating to the end of the buffer every time. The only downside to this is that the traffic does not appear live in the analysis application the capture buffer is populated only with the pakcets which have been recorded up to that point. Packets are written to a capture file on disk, which can then be opened with a packet analyzer like Wireshark. Dynagen and its complementary GUI GNS3 provide the very handy ability to capture traffic sent between emulated devices.

View loopback wireshark ubuntu