packet sniffer example - how to save as .pcap files?

[Mathan]

I have downloaded the packet sniffer example from here. In the program "raw data" was the output exactly required. I have to save this data as a log file in .pcap format suitable to open in Ethereal for debugging purpose.

I don't know how to save that raw data in a file with extension .pcap

All suggestions are appreciated.

Thanks a lot,

Mathan

[MikeS81]

Hi mathan,

in this link http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html you can see the description of this format.

Mike

[Mathan]

Dear Mike,

Thanks a lot for that link. Got more informations from it.

But in our program, the raw data itself is coming in the required format including ipheader.....everything.......

From LabVIEW i can save the data in a text file. But Ethereal can parse only .pcap file. Hence i need something that converts text to .pcap file.

Thanks,

Mathan

[Mathan]

Dear Mike,

I found one utility named text2pcap.exe that will do something like i require. But i can't able to save my data fully. Only data from first line in the text file is saved in .pcap file. I can't able to understand the options available with this utility. Could you please help me out.

Message Edited by mathan on 03-19-2009 05:57 AM

[MikeS81]

Hi mathan,

maybe your text file isn't correct.

Mike

[Mathan]

Dear Mike,

See the attached picture i am using the same format as required by the utility as shown here. But no guess where is wrong.

000000 12 34 dc 23 12 32 56 76
000008 43 bc 3c 7d cd ad 34 99
000010 23 44 64 76 12 00 cb ae
000018 ab 23 45 bc 5d e8 cc 00

Message Edited by mathan on 03-19-2009 07:14 AM

[Mathan]

Bump!

Anybody know something about this text2pcap.exe utility coming along with ethereal.

[Edit: I saw Smercurio replying lot of posts related to winpcap.  Maybe he will have a look at this by chance and help me out.

Message Edited by mathan on 03-20-2009 06:56 AM

[Ben]

Hi Mathan,

I wish I had the time to dig into this with but I don't. When I am trying to do these types of projects I start out with files from the original source and work to emulate them exactly. From what you have posted it look like one of your fields is wrong (I know, Duh!). Since your file is so small you could change one field at a time until you see the eror message change (techniclly that is hacking) then you will know which filed is is complaining about. It alomost looks like you have an extra character somewhere.

Sorry to be of so little service.

Ben

[smercurio_fc]

---

mathan wrote:

Dear Mike,

See the attached picture i am using the same format as required by the utility as shown here. But no guess where is wrong.

000000 12 34 dc 23 12 32 56 76
000008 43 bc 3c 7d cd ad 34 99
000010 23 44 64 76 12 00 cb ae
000018 ab 23 45 bc 5d e8 cc 00

---

Add a space at the end of each line. (Yeah, I know.)

Message Edited by smercurio_fc on 03-20-2009 04:30 PM

[Labview_expert]

Any one find solution on this?

or still it is pending?