Skip to content

ryrychj/PcapngUtils

Repository files navigation

Icon

PcapngUtils

C# full managed implementation Pcap/PcapNG file format

The nuget package NuGet Status

PM> Install-Package PcapngUtils 

Description

Pcap and PcapNG are file formats used to store dumps of network traffic. There formats are described in: * Pcap: https://wiki.wireshark.org/Development/LibpcapFileFormat * Pcap Next Generation: https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

The implementation of these formats is made by wrapping unmanaged WinPcap library. I added the implementation of both formats in a fully managed C #.

Usage

Open Pcap file


public void OpenPcapFile(string filename,CancellationToken token)
{
  using (var reader = new PcapReader(filename))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  

void reader_OnReadPacketEvent(object context, IPacket packet) { Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds )); }

Open PcapNG file


public void OpenPcapNGFile(string filename,bool swapBytes,CancellationToken token)
{
  using (var reader = new PcapNGReader("test.pcap",swapBytes))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  

void reader_OnReadPacketEvent(object context, IPacket packet) { Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds )); }

Open Pcap/PcapNG file

Better solutions, library can recognize the file format,

public void OpenPcapORPcapNFFile(string filename,CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(filename))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  

void reader_OnReadPacketEvent(object context, IPacket packet) { Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds )); }

Read packages and save to Pcap file


public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(inputFileName))
  {
    using (var writer = new PcapWriter(outputFileName))
    {
      CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
      {
        writer.WritePacket(packet);
      };
      reader.OnReadPacketEvent += handler;
      reader.ReadPackets(token);
      reader.OnReadPacketEvent -= handler; 
    }                
  }
}

Read packages and save to PcapNG file


public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(inputFileName))
  {
    using (var writer = new PcapNGWriter(outputFileName))
    {
      CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
      {
        writer.WritePacket(packet);
      };
      reader.OnReadPacketEvent += handler;
      reader.ReadPackets(token);
      reader.OnReadPacketEvent -= handler; 
    }                
  }
}

About

C# full managed implementation Pcap/PcapNG file format

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published