So the Wireshark explicit documentation on extcap is somewhat sparse, so I’m writing down my own investigation on how the protocol works.

For reference, here is the Wireshark documentation:

https://www.wireshark.org/docs/man-pages/extcap.html https://www.wireshark.org/docs/wsdg_html_chunked/ChCaptureExtcap.html …

Old fat spider spinning in a tree! Old fat spider can’t see me! Attercop! Attercop! Won’t you stop, Stop your spinning and look for me?

https://www.ettercap-project.org/