C ++ - 无需libpcap即可读写pcapng文件

时间:2017-07-27 06:33:51

标签: pcap-ng

我有兴趣在不使用libpcap或WinPcap的情况下读取和编写pcapng文件。谁知道怎么做?

1 个答案:

答案 0 :(得分:1)

我可以推荐一个这样做的C库,它被称为LightPcapNg,显然PcapPlusPlus正在使用它来创建一个更干净的C ++包装器。

由于您对C ++感兴趣,以下是如何使用PcapPlusPlus读取pcap-ng文件的代码片段:

#include <PcapFileDevice.h>

void readAndWritePcapNg(char* inputFileName, char* outputFileName)
{
    // reader instance
    PcapNgFileReaderDevice readerDev(inputFileName);

    // writer instance
    PcapNgFileWriterDevice writerDev(outputFileName);

    // open reader and writer
    readerDev.open();
    writerDev.open();

    RawPacket rawPacket;

    // read packets from file
    while (readerDev.getNextPacket(rawPacket))
    {
        Packet packet(&rawPacket);

        // do whatever you want with the packet
        ....
        ....

        // write the packet to the output file
        writerDev.writePacket(rawPacket);
    }

    // close reader and writer
    readerDev.close();
    writerDev.close();
}