This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Reading pcap file in C#

0

Hello everyone,

I would like to know how to read a pcap file in c#. I don't need something which will read it and parse it, because I want to parse it by myself. I just need a hand to have some input before my parse part. I hope that was clear enough.

Thank you :)

asked 31 May '15, 03:06

superithy's gravatar image

superithy
1111
accept rate: 0%


3 Answers:

0

You mean you want some information about how a pcap file is structured? See this Wiki Page:

https://wiki.wireshark.org/Development/LibpcapFileFormat

answered 31 May '15, 04:29

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I'll read that.

Thank you very much ! :)

(31 May '15, 04:32) superithy

0

Even though you said you didn't want parser help, you still might look at pcap.net. Lots of useful stuff for C# folks there when dealing with pcap files amongst other things.

answered 31 May '15, 07:20

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

And OfflinePacketCommunicator::OpenFile() calls pcap_open_offline(), so it uses libpcap's/WinPcap's code to read capture files, meaning that, even if all you want to do is just read the file and parse the packets yourself, it should be able to do that without you having to write your own code to read pcap files.

(It also means that, on UN*Xes with newer libpcap and with some form of .NET environment installed, it will also be able to read many pcap-ng files; currently, WinPcap can't read pcap-ng files, but that will probably be possible in a future WinPcap release, once it's based on a newer version of libpcap.)

(31 May '15, 14:12) Guy Harris ♦♦

0

answered 01 Jun '15, 04:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%