用于实时集成的数据包捕获

Question

I need to capture packets and use the data for a real time integration.

The packets flow between two legacy systems which provide no other means of accessing the data.

This appears simple to do using tcpdump or tshark, but I am unable to find a streamlined way to get the data off the capture device (raspberry pi) and to the service that manages the integration. As far as I can see from documentation, tcpdump and tshark only write to files or the console.

Ideally, the data in each packet would be sent from the capture device to a remote MQTT topic. This would avoid the write and file parsing that are inherent to tcpdump/tshark. I get that I can extract the data from a file, but I am looking to eliminate that step. The packet traffic that will be captured is low volume (max one packet per second). Am I missing something that would do this easily?

Answer 1

Tcpdump and wire/tshark both make use of the pcap (libpcap) library to do the actual packet capture and to process rules to decide which packets to keep.

Your best bet will be to write a small application that uses this and a MQTT client library to capture and forward the packets you want