I already know how to read a pcap file and get the packets it have.B ut how can I write the packets into a new pcap file? I need this to merge two pcap files into one.
Merging two pcap files with libpcap
2.4k views Asked by wangx1ng At
2
There are 2 answers
2
On
This can be done using joincap
.
go get -u github.com/assafmo/joincap
To merge 1.pcap
and 2.pcap
:
joincap 1.pcap 2.pcap > merged.pcap
I wrote joincap
to overcome what I believe is bad error handling by mergecap
and tcpslice
.
For more details go to https://github.com/assafmo/joincap.
As per my comment, libpcap/WinPcap is a library, not a program, so to use libpcap/WinPcap to merge capture files, you'd have to write your own code to do the merging, using libpcap/WinPcap to read the input files and write the output files.
You could use an existing tool, such as tracemerge or Wireshark's mergecap, to merge the captures.
Assuming the goal is to merge two files' packets by time stamp, then, if you wanted to write your own code, you'd:
pcap_t
s (it doesn't matter which one; all thepcap_t
does is tellpcap_dump_open()
what link-layer header type and snapshot length to use);and have a loop where you:
and then, when you exit the loop, close the dump file. At that point, you're done.