NAT32 Image

Reference Manual

[ Back]


[Interface Trace] wstrace - Interact with the Wireshark Trace mechanism


wstrace [open | close | [on [ifn] [w]] | [off [ifn]] | pause | resume | [filter port]]
start wireshark


The wstrace command is used to trace network traffic with Wireshark. Argument open launches the Wireshark application with the necessary options required to run it in real-time mode with the data source set to stdin. In addition, the command creates a NAT32 pipe device that other commands can redirect their output to in order to display data within Wireshark. The name of the pipe device is typically pipe49, although it is mounted as device wireshark for ease of use.

Traffic from any source can be sent to the pipe. Shown below are a few examples:

A description of other wstrace arguments can be found here.


Because NAT32 has full access to all configured network interfaces on the machine, including WLAN, WWAN, 3G, 4G, Bluetooth, USB, RAS Client and RAS Server interfaces, Wireshark is able to display traffic to which its standard driver (WinPcap) has no access.

In addition, FritzBox traffic on any of its internal interfaces can also be displayed within Wireshark in real time. Further details can be found here.

The Wireshark Trace feature has been tested with Wireshark Version 1.12. The path of the wireshark.exe file is extracted from the Windows Registry, but can also be specified in the file wireshark.txt if the PortableApps version is to be used, in which case the path should be specified as follows:



WinPkFilter, Wireshark, WinPcap, FritzBox Traffic Monitor, Wireshark Traffic Monitor, External Routers, httpget
Valid HTML 4.0 Transitional