Opening flows in one of many pcap helper apps

[philrz]

A community user asked:

If I want to use other programs,not the wireshark,How?eg networkminer.

At the moment, the Packets button in Brim extracts the flow to a temporary file and then opens it up in whatever application the operating system has tied to that file type. On Windows for instance (which happens to be the platform of this particular community user), this app is controlled via Settings > Apps > Default apps > Choose default apps by file type.

That means a Brim user today wanting to select a different app would need to toggle that one OS-level setting, which seems fairly rigid. However, those working at the Windows "Explorer" level will be familiar right-click "Open with" option that can allow the selection of an alternative app, and these choices seem to be cached to make it easy to re-select them in the futrue.

In a group discussion on 2021-02-02, @jameskerr thought that Electron might offer some way to query the OS to know the list of all apps that might be able to open files of a particular type, such that we could present this list to the user.

Another approach proposed was to instead allow extraction of the flow to a target directory and then trigger an open of the OS's "File Explorer" app on that directory with the file for the extracted flow highlighted, similar to what happens with Slack after downloading an attachment and clicking "Show in Finder" on a Mac. This way the user would have all the flexibility at the OS level to open the app of their choosing, or also work with the files of extracted flows in other ways. #1423 tracks this approach.