Offline PCAP reader performance

May 28, 2014 at 12:38 PM
Hi,

I am doing pcap file reader and I wonder if there is a way to use MemoryMappedFile instead of a file path as an input?

I would like to read the file fully prior to parsing of the packets.
using (PacketCommunicator communicator = new OfflinePacketDevice( PCAP_file).Open(65536,
                                        PacketDeviceOpenAttributes.Promiscuous, // promiscuous mode
                                        1000))     // read timeout
                {
                    communicator.ReceivePackets(0, parsePacket);
                }
Coordinator
Nov 15, 2014 at 3:34 PM
Hi JacekJacek,

Sorry for the (very) late reply.
Pcap.Net is a wrapper over WinPcap and uses WinPcap's methods to read pcap files.
As far as I know, there are no WinPcap methods to read files from memory.
I believe it's possible to implement them without using WinPcap's methods but it is non-trivial.
Feel free to open an issue for this.

Boaz.