CODEWITHSUNDEEP
c#tcppcapsharppcap
Max Vlaschuk-Gorelik
Max Vlaschuk-Gorelik

Reputation: 79

Loading a pcap file

I am trying to write a tcp reconstruction program in c# , by using SharpPcap. So far I am doing a pretty good job, and the reconstruction is working fine. My only problem is, that in order to reconstruct big Pcap files by myself, I need to load them by parts/chunks to the memory, because sharppcap only let's me load the whole file( I think). Any suggestions?

Thanks

Upvotes: 2

Views: 3417

Answers (2)

user862787
user862787

Reputation:

Given that SharpPcap PcapDevices have a GetNextPacket method, from which both LibPcapLiveDevice and CaptureFileReaderDevice inherit that method, I don't see anything that would require you to load the whole file - you might have to read the entire file, but you can just ignore packets you don't want.

Upvotes: 0

Len Holgate
Len Holgate

Reputation: 21644

The pcap file format is really simple, see here: http://wiki.wireshark.org/FileFormatReference/libpcap

Why not load the file yourself, possibly a packet at a time, and then you can do what you want as you go along rather than having a library dictate your memory usage patterns?

Upvotes: 2

Related Questions