C++ - 讀寫沒有libpcap的pcapng文件

Question

我很感興趣在不使用libpcap或WinPcap的情況下讀寫pcapng文件。任何人都知道如何做到這一點？

Answer 1

我可以推薦一個C庫，它被稱爲LightPcapNg，顯然PcapPlusPlus正在使用它來有一個更乾淨的C++包裝。

由於您希望在C++中，這裏是如何使用PcapPlusPlus讀取PCAP-NG文件的代碼片段：

#include <PcapFileDevice.h> 

void readAndWritePcapNg(char* inputFileName, char* outputFileName) 
{ 
    // reader instance 
    PcapNgFileReaderDevice readerDev(inputFileName); 

    // writer instance 
    PcapNgFileWriterDevice writerDev(outputFileName); 

    // open reader and writer 
    readerDev.open(); 
    writerDev.open(); 

    RawPacket rawPacket; 

    // read packets from file 
    while (readerDev.getNextPacket(rawPacket)) 
    { 
     Packet packet(&rawPacket); 

     // do whatever you want with the packet 
     .... 
     .... 

     // write the packet to the output file 
     writerDev.writePacket(rawPacket); 
    } 

    // close reader and writer 
    readerDev.close(); 
    writerDev.close(); 
}