Is there any function for retrieving the pcap file header or is it done manually(type casting)?
0
votes
2 Answers
1
votes
What information are you trying to retrieve from the file header?
You can get the major and minor version with pcap_major_version() and pcap_minor_version(), the snapshot length with pcap_snapshot(), and the link-layer type with pcap_datalink(). There is no guarantee that the time zone offset and time stamp accuracy are valid (libpcap sets both to 0). Note also that libpcap 1.1.0 and later can read pcap-ng files, which don't have a pcap file header.
Libpcap provides no routines to directly hand you the file header, and does not supply anything that you could typecast to be a file header, so you can't do this with libpcap. If you want to read the file header, you will have to write your own code to replace libpcap, and that code will not be able to handle, for example, pcap-ng files (which will be the default file type in the next release of Wireshark), unlike code that uses libpcap (which can read pcap-ng files, as long as all the network interfaces in the pcap-ng file have the same link-layer header type and snapshot length, when they're using libpcap 1.1.0 or later).
1
votes
The pcap file header is handled by libpcap internally. You shouldn't have to manipulate it manually.
You can open a pcap file for writing using pcap_dump_open.
You can open a pcap file for reading using pcap_open_offline.
