0

I am using Sharppcap wrapper for WinPcap and I am trying to read multiple pcap files, consecutively, in one instance of a program/ program lifetime

foreach (FILENAME in LIST) // pseudocode
{
    ICaptureDevice device;

    try
    {

        device = new SharpPcap.LibPcap.CaptureFileReaderDevice(FILENAME);
        device.Open();
    }
    catch (Exception e){}

    while ((device.GetNextPacket()) != null)
    {
        // Handle Packet from FILENAME
    }

    device.Close()


}

It traverses the first file all right, but as soon as it tries parsing the second file, it throws an AccessViolationException.

I know I can have one instance of this program for 1 pcap file, but I would really like to handle all the files in one program. Any ideas?

Murph
  • 3
  • 5
  • You *are* checking whether `new SharpPcap.LibPcap.CaptureFileReaderDevice(FILENAME)` succeeded, right? Don't assume it succeeds. –  Jun 24 '14 at 21:00
  • Yes. I do have something in the catch block. I just wanted to simplify the code. In any case, I have already solved my issue. Unfortunately I can't add my own answer for about another 5 hours. (It was unrelated to the problem and instead there was something wrong with my pcap file) – Murph Jun 24 '14 at 22:04
  • So was the crash due to the open failing and the exception handler not quitting (so that it tried to read from a non-opened `CaptureFileReaderDevice`), in which case the code was buggy, or was the crash due to SharpPcap having a bug (in which case you should report that to its developers), or was that due to libpcap, which SharpPcap presumably uses, having a bug (in which case you should [report that to its developers](https://github.com/the-tcpdump-group/libpcap/issues/new))? –  Jun 25 '14 at 18:11
  • I believe it was the former. – Murph Jun 25 '14 at 19:03
  • I.e., it was a bug in your code, not handling open failures correctly. –  Jun 26 '14 at 01:52

1 Answers1

0

If you just want to read PCAP files, I'd suggest to do it by your own. The format is really simple, and you won't have any problems with some external libraries.

http://wiki.wireshark.org/Development/LibpcapFileFormat

adjan
  • 13,371
  • 2
  • 31
  • 48