I am stuck.
I have used PCAP.NET to read .PCAP files and write the packets into a database. Now I can query the database and get packets back that match the constraints. I need a way to write the results to a new .PCAP file.
The problem is that, as far as I can tell, the only way to generate a new PCAP file is via the DumpFile which can only be initialized via a PacketCommunicator that is itself tied to a PacketDevice.
an example can be seen here: http://pcapdotnet.codeplex.com/wikipage?title=Pcap.Net%20Tutorial%20-%20Handling%20offline%20dump%20files&referringTitle=Pcap.Net%20User%20Guide
Well and good, but in this scenario I don't have a device.
Should I roll my own PCAP writer just for this purpose?
Have I missed something obvious?
How can I get these packets into a new PCAP file?
I am convinced that I have overlooked something simple... PCAP is new territory for me and I'm feeling very out of sorts. The Unix folks at work indicate that libpcap which winpcap and therefore pcap.net are based upon provides the ability to write directly to a pcap file. Is the functionality not exposed in the library?
Recommendations are very much appreciated.
Thanks,
Chris
P.S. This is a revision to my original question asked here: .NET writing PCAP files