{"id":3789,"date":"2015-06-24T09:03:01","date_gmt":"2015-06-24T09:03:01","guid":{"rendered":"http:\/\/blog.bachi.net\/?p=3789"},"modified":"2015-06-24T14:11:56","modified_gmt":"2015-06-24T14:11:56","slug":"libpcap-tutorial","status":"publish","type":"post","link":"https:\/\/blog.bachi.net\/?p=3789","title":{"rendered":"libpcap Tutorial"},"content":{"rendered":"<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n$ sudo apt-get install libpcap-dev\r\n<\/pre>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n$ cat \/var\/lib\/dpkg\/info\/libpcap-dev.list \r\n$ cat \/var\/lib\/dpkg\/info\/libpcap0.8-dev.list \r\n<\/pre>\n<h3>Manual Pages<\/h3>\n<p><a href=\"http:\/\/www.tcpdump.org\/manpages\/pcap_dump_open.3pcap.html\">pcap_dump_open<\/a><br \/>\n<a href=\"http:\/\/www.tcpdump.org\/manpages\/pcap_next_ex.3pcap.html\">pcap_next<\/a><br \/>\n<a href=\"http:\/\/www.tcpdump.org\/manpages\/pcap_open_dead.3pcap.html\">pcap_open_dead<\/a><\/p>\n<h3>Live Capture<\/h3>\n<p><a href=\"http:\/\/www.tcpdump.org\/pcap.htm\">Programming with pcap<\/a><br \/>\n<a href=\"http:\/\/yuba.stanford.edu\/~casado\/pcap\/section1.html\">The Sniffer&#8217;s Guide to Raw Traffic<\/a><br \/>\n<a href=\"http:\/\/yuba.stanford.edu\/~casado\/pcap\/section2.html\">Capturing Our First Packet<\/a><\/p>\n<h3>Offline Processing<\/h3>\n<p><a href=\"http:\/\/seclists.org\/tcpdump\/2010\/q2\/22\">Writing pcap files with fake headers?<\/a><br \/>\n<a href=\"https:\/\/code.google.com\/p\/pcapsctpspliter\/issues\/detail?id=6\">PCAP Offline Parsing Example<\/a><br \/>\n<a href=\"http:\/\/dog.tele.jp\/winpcapeng\/html\/group__wpcap__tut7.html\">Handling offline dump files<\/a><\/p>\n<pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\r\n    pcap_t *pd;\r\n    pcap_dumper_t *pdumper;\r\n\r\n    pd = pcap_open_dead(DLT_RAW, 65535 \/* snaplen *\/);\r\n\r\n    \/* Create the output file. *\/\r\n    pdumper = pcap_dump_open(pd, &quot;\/tmp\/capture.pcap&quot;);\r\n\r\n    while (1) {\r\n        \/*\r\n         * Create fake IP header and put UDP header\r\n         * and payload in place\r\n         *\/\r\n        ...\r\n\r\n        \/* write packet to savefile *\/\r\n        pcap_dump(pdumper, xxxx, yyyy);\r\n    }\r\n\r\n    pcap_close(pd);\r\n    pcap_dump_close(pdumper);\r\n<\/pre>\n<h3>Java jNetPCAP<\/h3>\n<p><a href=\"http:\/\/jnetpcap.com\/examples\">API Examples<\/a><br \/>\n<a href=\"http:\/\/jnetpcap.com\/tutorial\">Tutorials<\/a><br \/>\n<a href=\"http:\/\/jnetpcap.com\/?q=examples\/offline\">Offline Capture<\/a><br \/>\n<a href=\"http:\/\/jnetpcap.org\/?q=book\/export\/html\/51\">The Main libpcap API Overview<\/a><\/p>\n<h3>DotNet \/ .NET<\/h3>\n<p><a href=\"https:\/\/github.com\/PcapDotNet\/Pcap.Net\">Pcap.Net<\/a><br \/>\n<a href=\"https:\/\/pcapdotnet.codeplex.com\/wikipage?title=Pcap.Net%20Tutorial%20-%20Handling%20offline%20dump%20files\">Handling offline dump files<\/a><\/p>\n<h3>Scheme pcap.egg<\/h3>\n<p><a href=\"http:\/\/schemers.org\/\">Schemers.org<\/a><br \/>\n<a href=\"http:\/\/www.call-cc.org\/\">CHICKEN Scheme<\/a><br \/>\n<a href=\"http:\/\/wiki.call-cc.org\/eggref\/3\/pcap\">pcap.egg<\/a><\/p>\n<h3>Go programming language<\/h3>\n<p><a href=\"https:\/\/golang.org\/\">The Go Programming Language<\/a><br \/>\n<a href=\"https:\/\/godoc.org\/code.google.com\/p\/gopacket\/pcap\">package pcap<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>$ sudo apt-get install libpcap-dev $ cat \/var\/lib\/dpkg\/info\/libpcap-dev.list $ cat \/var\/lib\/dpkg\/info\/libpcap0.8-dev.list Manual Pages pcap_dump_open pcap_next pcap_open_dead Live Capture Programming with pcap The Sniffer&#8217;s Guide to Raw Traffic Capturing Our First Packet Offline Processing Writing pcap files with fake headers? PCAP Offline Parsing Example Handling offline dump files pcap_t *pd; pcap_dumper_t *pdumper; pd = pcap_open_dead(DLT_RAW, 65535 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3789","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/posts\/3789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3789"}],"version-history":[{"count":12,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/posts\/3789\/revisions"}],"predecessor-version":[{"id":3801,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=\/wp\/v2\/posts\/3789\/revisions\/3801"}],"wp:attachment":[{"href":"https:\/\/blog.bachi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.bachi.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}