How do I export Pcap.Net Packet Class Object To .pcap File

Question

I am developing an application in which users will use my tool, but every time the tool encounters some packets it will upload the packet class in c# as a .pcap file up to my site so that I can personally inspect it and make the necessary changes. I was wondering if anyone knew of a way for me to accomplish this goal of mine.

    public XXXXXCapturer(LivePacketDevice globalDevice) {
        PacketCommunicator globalCommunicator = globalDevice.Open(512, PacketDeviceOpenAttributes.Promiscuous, 1000);

        using (BerkeleyPacketFilter filter = globalCommunicator.CreateFilter("ether host XX:XX:XX:XX:XX:XX"))
        {
            globalCommunicator.SetFilter(filter);
        }
        globalCommunicator.NonBlocking = false;
        globalCommunicator.ReceivePackets(1, HandlePackets);
    }

    private void HandlePackets(Packet packet)
    {
        XXXXXDecoder Decoder = new XXXXXDecoder(packet);
        // Get Packet & Upload
        Info = new XXXXXInfo(Decoder.Data);
    }

score 0 · Accepted Answer · answered Dec 19 '17 at 00:55

0

I have looked for hours prior to posting this question and found no results, so while I waited for someone to hopefully reply to this question I decided I would dive in and start viewing some of the code of Pcap.Net. That is when I found the static class called PcapDumpFile with a method called Dump(). That method with a few arguments accomplished what I asked of in this question. I will leave this question up because I am hoping someone else with a similar question may be helped by this.

My Dump() method usage:

 PacketDumpFile.Dump(System.IO.Directory.GetLogicalDrives()[0] + @"Program Files (x86)\XXXXX\" + "temp.pcap", packet.DataLink.Kind, packet.Length, new List<Packet> { packet });

answered Dec 19 '17 at 00:55

Sean Mitchell

447
2
21

Is anything missing from the tutorial (https://github.com/PcapDotNet/Pcap.Net/wiki/Pcap.Net-Tutorial-Handling-offline-dump-files#saving-packets-to-a-dump-file) – brickner Jan 12 '18 at 13:56
@brickner Sure, show up to the party late with a snarky comment when I made my mistake. Grow up. – Sean Mitchell Jan 17 '18 at 09:38
I was actually looking to see if something is missing in the documentation, or maybe some pointers to the documentation are missing. The tutorial link might be useful for others. What would prevent the next person to spend hours looking for an answer? However, it might be too late for me to grow up. – brickner Apr 03 '18 at 08:55
@brickner My solution explains that I just found it while searching the class itself. – Sean Mitchell Apr 05 '18 at 00:27

How do I export Pcap.Net Packet Class Object To .pcap File

1 Answers1

Linked