LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 02-12-2016, 03:31 AM   #1
kikilinux
Member
 
Registered: Sep 2012
Posts: 125

Rep: Reputation: Disabled
Question reassembling fragmented ip packets from a pcap file and save the results into another pcap file


Hi all
I need to know is it possible to read a pcap file from a c/c++ programming language and reassemble the ip fragmented packets then save the results into another pcap file ?
I googling a lot but i cant find a solution to reassemble fragmented packets and save the results into another pcap file, most of the solutions are reassembling and printing results onto console.
Is it possible to do this with libpcap library ?
 
Old 02-12-2016, 04:00 AM   #2
NevemTeve
Senior Member
 
Registered: Oct 2011
Location: Budapest
Distribution: Debian/GNU/Linux, AIX
Posts: 4,878
Blog Entries: 1

Rep: Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871
A note: IP packets might be bigger than the maximal size of Ethernet packets.
 
Old 02-12-2016, 07:09 AM   #3
kikilinux
Member
 
Registered: Sep 2012
Posts: 125

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by NevemTeve View Post
A note: IP packets might be bigger than the maximal size of Ethernet packets.
I know that but I dont want to reinject packets into the network, I just want to have complete packets in my pcap file not fragmented packets.
I just wanna analyse that pcap file which does not have fragmented packets.

Last edited by kikilinux; 02-12-2016 at 07:11 AM. Reason: to clarify subject better
 
Old 02-12-2016, 08:04 AM   #4
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,883
Blog Entries: 13

Rep: Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931Reputation: 4931
It's been a long time for me using Wireshark. I think it's called something else these days. Either case, are the pcap files ASCII readable? If so, then just open() the file, parse it, grab what you want, and process it however you wish. An alternative is to use the tool which generates and reviews the pcap file and have it export the relevant sections as CSV or something and then do the processing.
 
  


Reply

Tags
defragment, pcap file


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] How to export just source/destination field of pcap file into a plain text file kikilinux Linux - Networking 5 11-27-2014 07:13 AM
convert pcap file to mitm file format chakka.lokesh Programming 5 03-07-2014 01:16 AM
Sort pcap file contents by file date zakiakhmad Linux - Networking 5 01-03-2012 06:40 AM
How can I read a .pcap file? abefroman Linux - Software 3 05-29-2008 03:18 PM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 07:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration