This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Reading pcap file in C#

Hello everyone,

I would like to know how to read a pcap file in c#. I don't need something which will read it and parse it, because I want to parse it by myself. I just need a hand to have some input before my parse part. I hope that was clear enough.

Thank you :)

c# pcap packet

asked 31 May '15, 03:06

superithy
1●1●1●1
accept rate: 0%

3 Answers:

0	You mean you want some information about how a pcap file is structured? See this Wiki Page: https://wiki.wireshark.org/Development/LibpcapFileFormat answered 31 May '15, 04:29 Jasper ♦♦ 23.8k●5●51●284 accept rate: 18% I'll read that. Thank you very much ! :) (31 May '15, 04:32) superithy

Even though you said you didn't want parser help, you still might look at pcap.net. Lots of useful stuff for C# folks there when dealing with pcap files amongst other things.

answered 31 May '15, 07:20

grahamb ♦
19.8k●3●30●206
accept rate: 22%

And OfflinePacketCommunicator::OpenFile() calls pcap_open_offline(), so it uses libpcap's/WinPcap's code to read capture files, meaning that, even if all you want to do is just read the file and parse the packets yourself, it should be able to do that without you having to write your own code to read pcap files.

(It also means that, on UN*Xes with newer libpcap and with some form of .NET environment installed, it will also be able to read many pcap-ng files; currently, WinPcap can't read pcap-ng files, but that will probably be possible in a future WinPcap release, once it's based on a newer version of libpcap.)

(31 May '15, 14:12) Guy Harris ♦♦

0	Please try SharpPcap http://sourceforge.net/projects/sharppcap/ https://github.com/rubystream/SharpPcap http://www.codeproject.com/Articles/12458/SharpPcap-A-Packet-Capture-Framework-for-NET Regards Kurt answered 01 Jun '15, 04:28 Kurt Knochner ♦ 24.8k●10●39●237 accept rate: 15%