libpcap problem (hdr.len vs tcpdump file size)?
From: D (c00l_79_at_yahoo.com)
Date: 10/27/03
- Previous message: Gerhard W. Gruber: "gdk_pointer_grab"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: 26 Oct 2003 16:16:55 -0800
Hi,
I'm trying to use libpcap to output tpcdump raw data that I've
captured in a file.
here's the info of the tcpdump file:
-rw-r--r-- 1 david david 1042 Oct 26 01:36 tcpdump.out
now, when I use my code to capture the packets in that file and
directly printing them out, the output of this code is somehow larger
than the actual dump file.
Here's my (C++) code:
-------------
#include <iostream>
#include <netinet/in.h>
#include <linux/inet.h>
#include <netinet/if_ether.h>
#include <pcap.h>
#include <fstream>
int main(){
using namespace std;
ofstream fout;
fout.open("pcaptest.out");
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *descr= pcap_open_offline("/home/david/tcpdump.out",
errbuf);
const u_char * packet;
struct pcap_pkthdr hdr;
packet = pcap_next(descr, &hdr);
while (packet){
unsigned packetSize= hdr.len;
for (unsigned i=0; i< packetSize;i++){
fout<<packet[i];
}
packet = pcap_next(descr, &hdr);
}
return 0;
}
--------------------------------
and here's the info on the output file:
-rw-r--r-- 1 david david 1508 Oct 26 01:36 pcaptest.out
How come the size of the output file does not match the actual dump
file at all? And furthermore, how come the it's larger in size?
any help/comment is appreciated.
thanks in advanced!
-D
- Previous message: Gerhard W. Gruber: "gdk_pointer_grab"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
