need help on compare tool

ski_nm · 12-03-2003, 01:06 PM

i am relatively new to prgramming and need to come up with a tool (preferably in C) that will compare to tcpdump files for similarities in the tcp ip and ethernet sections.

i have two output files that should be pretty close but want to ensure they are or note the differences in an output format that is understandable. I am just beginning and any help is appreciated, I have no code yet to post but hopefully will soon

thanks

ski

MartinN · 12-03-2003, 01:50 PM

If your goal is to compare files, then 'diff' could be the right thing for you (man diff). But if the goal is some cool programming, then I can only say: --Happy hacking!

Regards
Martin

Hko · 12-03-2003, 04:19 PM

In this case 'diff' doesn't sound very useful to me, thinking of tcpdump files.

Ski: Maybe you could have a look at the pcap library. tcpdump and similar programs use it to read and write their (binary) packet capture files.
See:

"man 3 pcap" (install libpcap-dev package if the man page isn't there) or the webbed man-page

and/or the pcap tutorial

ski_nm · 12-04-2003, 12:59 PM

thnaks for the replies. Yeah, diff wont work to well with the hex/binary files. I am trying to extract the IP, TCP and payload portions from the packet and compare these entries among two files. I have looked through the pcap library and see a couple of functions to read in the packets, but I am still not sure how to parse the ip, tcp, etc headers out of them