This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello everyone,

I would like to know how to read a pcap file in c#. I don't need something which will read it and parse it, because I want to parse it by myself. I just need a hand to have some input before my parse part. I hope that was clear enough.

Thank you :)

asked 31 May '15, 03:06

superithy's gravatar image

superithy
1111
accept rate: 0%


You mean you want some information about how a pcap file is structured? See this Wiki Page:

https://wiki.wireshark.org/Development/LibpcapFileFormat

permanent link

answered 31 May '15, 04:29

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I'll read that.

Thank you very much ! :)

(31 May '15, 04:32) superithy

Even though you said you didn't want parser help, you still might look at pcap.net. Lots of useful stuff for C# folks there when dealing with pcap files amongst other things.

permanent link

answered 31 May '15, 07:20

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

And OfflinePacketCommunicator::OpenFile() calls pcap_open_offline(), so it uses libpcap's/WinPcap's code to read capture files, meaning that, even if all you want to do is just read the file and parse the packets yourself, it should be able to do that without you having to write your own code to read pcap files.

(It also means that, on UN*Xes with newer libpcap and with some form of .NET environment installed, it will also be able to read many pcap-ng files; currently, WinPcap can't read pcap-ng files, but that will probably be possible in a future WinPcap release, once it's based on a newer version of libpcap.)

(31 May '15, 14:12) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×238
×12

question asked: 31 May '15, 03:06

question was seen: 11,835 times

last updated: 01 Jun '15, 04:28

p​o​w​e​r​e​d by O​S​Q​A