This is our old Q&A Site. Please post any new questions and answers at

can anyone point me to wireshark documentation that will tell me how to write a standalone program that reads a .cap file (created by NA Sniffer version 2.0) and give me a pcap_pkthdr offset?

Thanks. Mark Young

asked 27 Apr '11, 09:43

markfyoung's gravatar image

accept rate: 0%

The Libpcap file format is pretty straightforward. You can implement a reader program in whatever your favorite language is.

permanent link

answered 27 Apr '11, 10:33

multipleinterfaces's gravatar image

accept rate: 12%

he's not talking about libpcap, he wants to read NAI Sniffer .cap files (do not let the extension fool you into thinking that it is enough to detect the file format or Jaap will hunt you down :-D)

(27 Apr '11, 10:40) Jasper ♦♦

Uh oh, depending on what you want to do you're in for quite an amount of trouble. I have written a standalone program that reads NAI v2.00 cap files, and it has some strange features that makes reading it quite a challenge (talking about ring buffered captures; quite funny - not to say "annoying" - how they implemented them).

What you can do is read the source code of the according Wireshark module, which would be in /wiretap/netxray.c. Yes, quite confusing, but I guess it's called Netxray because that was the Windows program the DOS-Sniffer was merged with back in... the last century as far as I know.

Keep in mind that the Wireshark code does not always know what each bit and byte is good for. I have reverse engineered a few of the unknown bytes myself, but I haven't checked if the Wireshark wiretap code knows about their functionality in the meantime. I always wanted to give feedback on those but didn't have the time yet.

If you can give more details of what you want to do I may be able to give some additional tips.

permanent link

answered 27 Apr '11, 10:38

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

edited 27 Apr '11, 10:41

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 27 Apr '11, 09:43

question was seen: 4,141 times

last updated: 27 Apr '11, 10:41

p​o​w​e​r​e​d by O​S​Q​A