为C中捕获的数据包创建PCAP文件

Question

I am working on a tool though which I am able to capture incoming packets (l2 buffer and L2 length, payload) in an interface and I am able to print that packet on console. Now I want to write these packets to a pcap file so that I can transfer this file to other platform and read packet info.

How I can open a pcap file and write packet buffer to pcap file? How can I fill struct pcap_file_header ?

Answer 1

use pcap_dump to save the packet... this code might be useful :)

http://file-hub.com/cmd:thread/140400

Answer 2

以下文档将lib_pcap您使用lib_pcap http://www.tcpdump.org/pcap.html捕获数据包

Answer 3

For writing pcap use library pcap_file_generator

Using:

int i=0;
  const int  PKTS_COUNT = 212000;
  int PKTS_LEN =  540;
  static ethernet_data_t  eda;
  eda.len = PKTS_LEN;

  PCAPFILE * pfl = lpcap_create("./pcaplibtestfile.pcap");
  for( i=0;i< PKTS_COUNT;i++ )
  {
    /* TODO:  fill data   memcpy(eda.data , YOUR_DATA_BUF,SIZE_YOUR_DATA_BUF  );
       eda.len = SIZE_YOUR_DATA_BUF;
    */
   lpcap_write_data( pfl , &eda , i, 0 );
  }
  lpcap_close_file( pfl );