Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/HakanL/PcapngUtils
C# full managed implementation Pcap/PcapNG file format
https://github.com/HakanL/PcapngUtils
Last synced: 7 days ago
JSON representation
C# full managed implementation Pcap/PcapNG file format
- Host: GitHub
- URL: https://github.com/HakanL/PcapngUtils
- Owner: HakanL
- License: mit
- Fork: true (ryrychj/PcapngUtils)
- Created: 2019-11-30T16:55:03.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2024-06-14T19:41:49.000Z (5 months ago)
- Last Synced: 2024-08-02T16:33:23.913Z (3 months ago)
- Language: C#
- Size: 4.74 MB
- Stars: 10
- Watchers: 3
- Forks: 8
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# PcapngUtils [](https://www.nuget.org/packages/Haukcode.PcapngUtils/)
C# full managed implementation Pcap/PcapNG file format
## The nuget package
PM> Install-Package Haukcode.PcapngUtils
Description
Pcap and PcapNG are file formats used to store dumps of network traffic. There formats are described in:
* Pcap: https://wiki.wireshark.org/Development/LibpcapFileFormat
* Pcap Next Generation: https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
The implementation of these formats is made by wrapping unmanaged WinPcap library.
I added the implementation of both formats in a fully managed C #.
Usage
Open Pcap file
public void OpenPcapFile(string filename,CancellationToken token)
{
using (var reader = new PcapReader(filename))
{
reader.OnReadPacketEvent += reader_OnReadPacketEvent;
reader.ReadPackets(token);
reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
}
}
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}
Open PcapNG file
public void OpenPcapNGFile(string filename,bool swapBytes,CancellationToken token)
{
using (var reader = new PcapNGReader("test.pcap",swapBytes))
{
reader.OnReadPacketEvent += reader_OnReadPacketEvent;
reader.ReadPackets(token);
reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
}
}
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}
Open Pcap/PcapNG file
Better solutions, library can recognize the file format,
public void OpenPcapORPcapNFFile(string filename,CancellationToken token)
{
using (var reader = IReaderFactory.GetReader(filename))
{
reader.OnReadPacketEvent += reader_OnReadPacketEvent;
reader.ReadPackets(token);
reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
}
}
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}
Read packages and save to Pcap file
public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
using (var reader = IReaderFactory.GetReader(inputFileName))
{
using (var writer = new PcapWriter(outputFileName))
{
CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
{
writer.WritePacket(packet);
};
reader.OnReadPacketEvent += handler;
reader.ReadPackets(token);
reader.OnReadPacketEvent -= handler;
}
}
}
Read packages and save to PcapNG file
public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
using (var reader = IReaderFactory.GetReader(inputFileName))
{
using (var writer = new PcapNGWriter(outputFileName))
{
CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
{
writer.WritePacket(packet);
};
reader.OnReadPacketEvent += handler;
reader.ReadPackets(token);
reader.OnReadPacketEvent -= handler;
}
}
}