Wireshark consists of the following major parts:
-
Packet dissection - in the /epan/dissector and /plugin/\* directories
-
File I/O - using Wireshark’s own wiretap library
-
Capture - using the libpcap/winpcap library, in /wiretap
-
User interface - using the Qt or GTK+ and associated libraries
-
Utilities - miscellaneous helper code
-
Help - using an external web browser and GTK text output