how to get protocol details from packets stored in a pcap file

2.4k views Asked by At

I want to make a switch loop (in java) whose cases are the protocol of the ip header of the packets stored in a pcap file.

I am using jnetpcap library to access the packets.

I know how to get ip address, port numbers etc. from the packet but I want to know whether there is a function which tells me directly the protocol of the packet i.e. tcp, udp, icmp etc. One can also suggest if he/she knows any other library which has this kind of function.

Thanks in advance.

2

There are 2 answers

0
Aayush Rathore On BEST ANSWER

I found the answer myself:

using JNETPCAP library,
For TCP/IP stack: We can get the protocols on the basis of port number of tcp header

Port numbers corresponding to different protocols are given on the following link: http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Getting protocol in jnetpap:
PcapPacket packet =//get from somewhere

Tcp tcp = new Tcp();
Ip4 ip = new IP4();

if(packet.hasHeader(ip)&&packet.hasHeader(tcp)){
     if(tcp.source()==80){
         System.out.println("HTTP protocol");
     else if(tcp.source==23)
         System.out.println("Telnet protocol");

}

1
user3823859 On

There exists jpcap library from which built-in functions are available to extract protocol of packet and other details.