getting-started-with-pcap

PCAP experiments

Create PCAPs with defined content

• See: zero-httpd

Read PCAPs

• See pcapfile-reader

Create PCAPs with real content

• See: fritzdump

Stream PCAPs

• See: pcapfile-streamer

Next

• Stream layer 3 content in manipulated layer 2 frames (ethernet, add vlan tags or gre tunnel headers)
• Try layer 2 streaming on tap interface and capture PCAPS

Lessons learned

TODOs

• Capture from fritz box (non-ethernet, dsl, ppp, ...)
• Try to implement zero-http as layer 2 packet generator (maybe too difficult to implement tcp)
• What is the difference between flow, meta, and content data?
• Search and read RFCs