Thank you for finding the time to look at it.
Yes you are correct about the timestamp. It is indeed an absolute time offset but not a relative one as I incorrectly concluded initially. Thus resetting the packet timestamp is unnecessary.
>I'm considering adding an easier way to change a Packet timestamp...
Thank you. Yes it makes sense to allow one to changes the timestamp if required. Even if I do not need it for solving my problem. :o)
>if you know the packets are Ethernet packets, you can do it by doing the following:....
This is where I have a problem with the current API.
- First of all I have a heterogeneous pcaps and there is the warranty that not all of them are the Ethernet packets.
- Second problem is more "fundamental". I have a packet object. The object can be easily persisted thus I see no logical reason to disassemble this object into extracted layers and then reassemble it again with the builder. Unless of course
you builder based proposal was specifically about solving the timestamp resetting problem.
- The third problem is that the PacketDumpFile cannot be constructed independently and has to be "derived" from the existing pcap file. The resulting Pcap file also has a timestamp in the header. This timestamp is independent of
the packets timestamps. However because this timestamp still logically
depends on the first packet timestamp (packet timestamp must be equal or "newer" then the Pcap timestamp) it is desirable to be able to read and modify the Pcap timestamp.
Thus the constructor "new PacketDumpFile(string fileName, DateTime timestamp)" would solve the problem.
Anyway I ended up with the not the most elegant but an adequate solution based on using the input pcap file with the "oldest" packet for the creation of the output dump file:
public class PcapMerger
public string Merge(string outFile, params string inFiles)
if (inFiles.Length == 0)
return outFile; // To allow Fluent API
PacketDumpFile dumpFile = null;
var allPackets = new List<Packet>();
foreach (string file in inFiles.OrderBy(x => GetFirstPacketTimestamp(x)))
using (PacketCommunicator comm = new OfflinePacketDevice(file).Open(-1, PacketDeviceOpenAttributes.Promiscuous, 700000))
var packets = comm.ReceivePackets(-1).ToArray();
if (dumpFile == null)
dumpFile = comm.OpenDump(outFile);
foreach (Packet item in allPackets.OrderBy(x => x.Timestamp))
private DateTime? GetFirstPacketTimestamp(string pcapFile)
using (PacketCommunicator comm = new OfflinePacketDevice(pcapFile).Open(-1, PacketDeviceOpenAttributes.Promiscuous, 700000))
Packet packet = comm.ReceivePackets(1).FirstOrDefault();
if (packet == null)