So the Wireshark explicit documentation on extcap is somewhat sparse, so I’m writing down my own investigation on how the protocol works.

For reference, here is the Wireshark documentation:

https://www.wireshark.org/docs/man-pages/extcap.html https://www.wireshark.org/docs/wsdg_html_chunked/ChCaptureExtcap.html …

So picked up a yubikey, and am digging into how linux handles these sorts of things exactly. It looks like the linux-pam module delegates to pam-u2f, which appears to be written by Yubico themselves.