Function is_extcap_invocation 

pub fn is_extcap_invocation() -> bool

Whether Wireshark, rather than a person, is running this process.

Every phase carries at least one --extcap- flag — --capture always arrives with --extcap-interface — so the arguments alone settle it. Deliberately not a check on argv[0]: a copy and a symlink of the same binary must behave identically.