This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

in general, I want to analyze a tcp packet ,first I should read the pcap file in c++(this is my first problem), after that I want to analyze just the tcp packets in the flow of packets, and find it's header details such that "syn","ack","fin","source ip","destination ip" and etc ,for this I read something a bout "pcap" that I found it here, but it doesn't give me enough information, it doesn't give me any thing about "syn" or "ack",.....and now I don't know how and with which program in c++ or c# I can do it??? that is my big problem! thank you so much for your attention

asked 16 Jan '14, 08:22

mesmslampanah's gravatar image

mesmslampanah
11112
accept rate: 0%


What you need is a c++/c# 'wrapper library' for libpcap. There are two candidates I know of:

Pcap.Net

http://pcapdotnet.codeplex.com/

SharpPcap

http://sourceforge.net/apps/mediawiki/sharppcap/index.php?title=Main_Page

For both you need

  • some c++/c# programming experience. Nothing we can help you with
  • some understanding of TCP/IP and networking. Something you can only learn yourself, by reading the right books, like: TCP/IP Illustrated Volume 1
  • a rough idea how to use the libpcap libraries. See their docs.

and now I don't know how and with which program in c++ or c# I can do it???

If you don't know how to program in c++/c# you will have a hard time to finish your task. Maybe you'll find some example code in one of the wrapper libraries above, that does similar things you need.

Regards
Kurt

permanent link

answered 16 Jan '14, 10:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 16 Jan '14, 10:15

thanks for your help,I know C# programming and C++,but i dont know what's of their is easier to do this? I saw a sample written by Perl,but it had some functions(read byte and byte) and Data Type (like hash)

(17 Jan '14, 08:10) mesmslampanah

what's of their is easier to do this?

Well, that's something you should decide for yourself, as it mainly depends on your skills and your personal preferences...

(17 Jan '14, 10:51) Kurt Knochner ♦

You can also use PcapPlusPlus. It has all that you need and more...

permanent link

answered 02 Jun '15, 11:21

seladb's gravatar image

seladb
11
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×18
×17
×12

question asked: 16 Jan '14, 08:22

question was seen: 13,218 times

last updated: 02 Jun '15, 11:21

p​o​w​e​r​e​d by O​S​Q​A