This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all, I am new to wireshark, I know that I am asking a silly doubt. in case of wireshark, once we start the capture we can dump each packet using pcap_dump() method. but how to retrieve a selected packet from dump file once we click on the selected row from listview in UI? Is there any offset for each packet? how can we get a pointer to each packet? How wireshark is giving the description of each packet once we select on row?

thanks , sathish

asked 30 Mar '15, 07:19

sathish308's gravatar image

sathish308
6334
accept rate: 0%


how can we get a pointer to each packet?

pcap and pcap-ng files have a defined structure.

https://wiki.wireshark.org/Development/LibpcapFileFormat
https://wiki.wireshark.org/Development/PcapNg

So, if you want to simulate the Wireshark behavior, you'll have to read all frames in memory and do the book keeping yourself. This means: You need to build an internal data structure in RAM which allows you to access every frame directly.

The other way would be to simply read the capture file and "skip" to frame number x by reading and forgetting those frames you don't need.

Please see PCAP programming tutorial on the net:

http://www.tcpdump.org/pcap.htm
http://homes.di.unimi.it/~gfp/SiRe/2002-03/progetti/libpcap-tutorial.html

Regards
Kurt

permanent link

answered 30 Mar '15, 08:10

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 30 Mar '15, 08:11

hi, kurt

here I can do like this,

if I need 100th packet I can keep it in a while loop as int count=1; while(count<=100) { packet_next_ex(); count++; if(count==100) { then I can take the data;} } I can get the selected packet data. but, will it be good solution? if my requirement is 100000 packet, then loop has to run for 100000 times. I think it is time consuming process. can you suggest me which is good solution for it....

(02 Apr '15, 05:36) sathish308

Please add more details (maybe with an example), as I don't understand what you are trying to do.

(02 Apr '15, 06:41) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×238
×89
×10

question asked: 30 Mar '15, 07:19

question was seen: 2,387 times

last updated: 02 Apr '15, 06:41

p​o​w​e​r​e​d by O​S​Q​A