在pcap文件中收集數據包長度

Question

嗨，大家好我如何收集pcap文件中每個數據包的數據包長度？非常感謝

Answer 1

我建議一種高科技方法，很少有人知道：閱讀文檔。

人PCAP告訴我們有可實際上是兩個不同的長度：

 
       caplen a bpf_u_int32 giving the number of bytes of the packet that are 
        available from the capture 

       len a bpf_u_int32 giving the length of the packet, in bytes (which 
        might be more than the number of bytes available from the cap- 
        ture, if the length of the packet is larger than the maximum num- 
        ber of bytes to capture) 

用C的一個例子：

 
/* Grab a packet */ 
       packet = pcap_next(handle, &header); 
       if (packet == NULL) { /* End of file */ 
         break; 
       } 
       printf ("Got a packet with length of [%d] \n", 
            header.len); 

另外一個在Python與pcapy library：

 
import pcapy 

reader = pcapy.open_offline("packets.pcap") 

while True: 
    try: 
     (header, payload) = reader.next() 
     print "Got a packet of length %d" % header.getlen() 
    except pcapy.PcapError: 
     break 

Answer 2

下面的兩個例子工作正常：

• 使用python使用C，WinPcap的
• ，Scapy的

（WinPcap的）（編譯CL，微軟VC） 我已經寫了這個功能（C語言）來獲得數據包的大小並能正常工作。 不要忘了包括編譯器的預處理器

u_int getpkt_size(char * pcapfile){ 

pcap_t *indesc; 
char errbuf[PCAP_ERRBUF_SIZE]; 
char source[PCAP_BUF_SIZE]; 
u_int res; 
struct pcap_pkthdr *pktheader; 
u_char *pktdata; 
u_int pktsize=0; 



/* Create the source string according to the new WinPcap syntax */ 
if (pcap_createsrcstr(source,   // variable that will keep the source string 
         PCAP_SRC_FILE, // we want to open a file 
         NULL,   // remote host 
         NULL,   // port on the remote host 
         pcapfile,  // name of the file we want to open 
         errbuf   // error buffer 
         ) != 0) 
{ 
    fprintf(stderr,"\nError creating a source string\n"); 
    return 0; 
} 

/* Open the capture file */ 
if ((indesc= pcap_open(source, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf)) == NULL) 
{ 
    fprintf(stderr,"\nUnable to open the file %s.\n", source); 
    return 0; 
} 


/* get the first packet*/ 

    res=pcap_next_ex(indesc, &pktheader, &pktdata); 

    if (res !=1){ 
     printf("\nError Reading PCAP File"); 
        return 0; 
      } 



/* Get the packet size*/ 
pktsize=pktheader->len; 

/* Close the input file */ 
pcap_close(indesc); 

return pktsize; 

} 

用精彩SCAPY

from scapy.all import * 

    pkts=rdpcap("data.pcap",1) # reading only 1 packet from the file 
    OnePkt=pkts[0] 
    print len(OnePkt) # prints the length of the packet