pcap_open_dead() equivalent in pcapdotnet?

Feb 18, 2015 at 6:00 AM
Edited Feb 18, 2015 at 6:02 AM
I want to dump a packet into a file created by an hexadecimal array.
I got this one in Cpp code by using pcap_open_dead(),pcap_dump_open , pcap_dump() APIs. How can I Achieve the same thing using Pcapdotnet dlls in C#.

I am giving sample of C++.

here the ip_pkt is an array of hexa decimal data.

pcap_t *pcap;
/* open pcap context for Raw IP (DLT_RAW), see

define DLT_RAW 12

pcap = pcap_open_dead(DLT_RAW, 65565);
char* test="E://sathishreddy";
pcap_dumper_t *d;
/ open output file (stdout) /
d = pcap_dump_open(pcap, test);
if (d == NULL) {
pcap_perror(pcap, "pcap_dump_fopen");
return 1;
}
for(int i=0;i<5;i++)
{
/ prepare for writing /
struct pcap_pkthdr hdr;
int l=sizeof(pcap_pkthdr);
hdr.ts.tv_sec = 0; / sec /
hdr.ts.tv_usec = 0; / ms /
hdr.caplen = hdr.len = ip_pkt_len;
/ write single IP packet /
pcap_dump((u_char *)d, &hdr, ip_pkt);
}
/ finish up /
pcap_dump_close(d);
return 0;


could you please help me,
thanks in advance
sathish
Coordinator
Feb 20, 2015 at 5:23 AM
Hi sathish,

Can you write how have you tried doing this?
Creating a Packet instance from a buffer is simple (Packet's constructor or Packet.FromHexadecimalString()).
Dumping a packet to a file can be done using PacketDumpFile::Dump() static method.

I hope this helps,

Boaz.