CODEWITHSUNDEEP
wiresharkpcaplibpcapwinpcapsharppcap
Stampy
Stampy

Reputation: 466

Does winpcap and sharppcap support the pcap-ng format

I've a file in the pcapng format and want to open it by SharpPcap - that doesn't work.

SharpPcap uses Winpcap (libpcap).

So my question: Does WinPcap and/or SharpPcap support the pcap-ng format at the moment or in future? I can't find some current information about it, only some old posts.

Upvotes: 2

Views: 1753

Answers (3)

Dmytro Ovdiienko
Dmytro Ovdiienko

Reputation: 1106

To read timestamp with nanosecond precision

  1. Update original WinPcap setup with WinPcap 4.1.3 - libpcap 1.7.3
  2. Use pcap_open_offline_with_tstamp_precision function to open the PCAP file and pass PCAP_TSTAMP_PRECISION_NANO as a second parameter.
  3. After that your app should treat pcap_pkthdr::ts structure returned from pcap_next as a seconds+nanoseconds.

Sorry, I did not have chance to port it to SharpPcap.

Upvotes: 0

Chris Morgan
Chris Morgan

Reputation: 1339

Yes. SharpPcap supports the latest libpcap and npcap releases and these releases support pcap-ng file format.

Upvotes: 0

user862787
user862787

Reputation:

Does WinPcap and/or SharpPcap support the pcap-ng format at the moment

No. Support for reading pcap-ng files was added to libpcap in libpcap 1.1.0, and the latest WinPcap is based on libpcap 1.0.0.

or in future?

Hopefully some future WinPcap release will be based on a recent libpcap release. This will require some work, mainly for remote-capture support with the new pcap_create()/pcap_activate() APIs.

Upvotes: 1

Related Questions