Bug#968484: wireshark hard-wired to libsystemd0?

[Vincent Lefevre]

On 2020-12-14 23:33:19 +0100, Thorsten Glaser wrote:
> On Mon, 14 Dec 2020, Cristian Ionescu-Idbohrn wrote:
> 
> > > It doesn't depend on the init, but it links against the library to
> > > parse the journal files,
> >
> > I have no journal files on my system (yet).  So, that dependency is
> > total nonsense to me.
> 
> Not on your system but in the packet stream it analyses.
> AIUI when capturing data traffic, wireshark can inspect
> the traffic if it is structured data, and for this it
> needs interpreters for the various formats, and I think
> it just reuses the libsystemd0 one for network logging.

Not arbitrary network logging, though, but for systemd journals sent
across the network. This apparently comes from the following file in
the wireshark source

  epan/dissectors/packet-systemd-journal.c

which says

 * Dissector for systemd's mostly-text-based Journal Export Format described
 * at https://www.freedesktop.org/wiki/Software/systemd/export/.

And at this URL: "Note that this document describes the binary
serialization format of journals only, as used for transfer
across the network."

This is probably useless for data transferred with the local
non-systemd machine, but I suppose that this may be useful
even on such a machine if packets between other machines on
the local network can be captured (though this usage is not
intended by the systemd developers, otherwise there would be
a separate library for this purpose).

So, if I understand correctly, this support should be optional,
but not necessarily completely useless on non-systemd machines.

-- 
Vincent Lefèvre <vincent at vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)