---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github/duckdb/community-extensions repository, check README there
title: wireduck
excerpt: |
  DuckDB Community Extensions
  Read and dissect PCAP files from DuckDB

extension:
  name: wireduck
  description: Read and dissect PCAP files from DuckDB
  version: 0.0.2
  language: c++
  build: cmake
  license: MIT
  excluded_platforms: "osx_amd64;osx_arm64;windows_amd64;wasm"
  maintainers:
    - hyehudai

repo:
  github: hyehudai/wireduck
  ref: 19c4018cc8ebad08547d621bcdc25df86294ca2b

docs:
  hello_world: |
    -- Basic PCAP reader for local files.
    D select count(*) , sum ("tcp.len") , "tcp.srcport" ,"tcp.dstport"   from read_pcap('~/wireduck/fix.pcap', protocols:=['ip','tcp'],climit:=100)  group by  "tcp.srcport" ,"tcp.dstport" ;;
    ┌──────────────┬────────────────┬─────────────┬─────────────┐
    │ count_star() │ sum("tcp.len") │ tcp.srcport │ tcp.dstport │
    │    int64     │     int128     │    int64    │    int64    │
    ├──────────────┼────────────────┼─────────────┼─────────────┤
    │          429 │         259678 │       11001 │       53867 │
    │           56 │          19702 │       53867 │       11001 │
    └──────────────┴────────────────┴─────────────┴─────────────┘

  extended_description: |
    ### pcap dissector extention
    Wireduck runs tshark behind the scenes utilizing wireshark's glossary to be able to parse any packet from any supported protocol to its fields. 
    enabeling network data analysis and analytics.

    ### Features
    - read_pcap table function.
    - support any protocol supported by wireshark.
    - allow push down filters to wireshark using cfilter climit  parameters

    ### Prerequities
    tshark (installed as part of wireshark) should be installed.
    validate its exists via
    ```
    tshark --version
    ```
    > For examples and instructions check out [Readme](https://github.com/hyehudai/wireduck)
    
        
    > Note: Wireduck is still experimental.

extension_star_count: 48
extension_star_count_pretty: 48
extension_download_count: 1071
extension_download_count_pretty: 1.1k
image: '/images/community_extensions/social_preview/preview_community_extension_wireduck.png'
layout: community_extension_doc
---

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}

### Added Functions

<div class="extension_functions_table"></div>

|     function_name      | function_type | description | comment | examples |
|------------------------|---------------|-------------|---------|----------|
| check_tshark_installed | scalar        | NULL        | NULL    |          |
| initialize_glossary    | table         | NULL        | NULL    |          |
| read_pcap              | table         | NULL        | NULL    |          |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

This extension does not add any settings.