Creating pcap file from packets?

Dec 10, 2010 at 12:32 PM

What is the best way of creating the new pcap file from the packets extracted from another one?

Most likely it is something very simple but I cannot find the way so far.

Any ideas will be greatly appreciated.

Thanks

Dec 13, 2010 at 4:21 AM
Edited Dec 13, 2010 at 6:15 AM

I think I have found one way to do this.

  using (PacketDumpFile dumpFile = [Any instance of PacketCommunicator].OpenDump("test.pcap"))
{
    dumpFile.Dump(packets.First());
}

While the code above works it is a bit ugly as it requires creating a PacketCommunicator either for the actual device or a dummy pcap file.

Is there a better way? Something like this:

 using (PacketDumpFile dumpFile = PacketCommunicator.OpenDump("test.pcap"))
{
    dumpFile.Dump(packets.First());
}
Thanks
Coordinator
Dec 13, 2010 at 5:13 AM

Hi taras_b,

 

I think you can use PacketDumpFile.Dump() static method.

It does need a few parameters that can usually be extracted from the PacketCommunicator instance.

 

I hope this helps,

Boaz.

Dec 13, 2010 at 5:30 AM

Thank you, this is exactly what I was looking for.