在pcap文件中收集数据包长度

Question

大家好,我如何收集pcap文件中每个数据包的数据包长度？非常感谢

Answer 1

我建议采用一种高科技方法,很少有人知道:阅读文档.

man pcap告诉我们实际上有两种不同的长度:

              caplen a  bpf_u_int32  giving the number of bytes of the packet that are
                     available from the capture

              len    a bpf_u_int32 giving the length of the packet,  in  bytes  (which
                     might  be  more  than the number of bytes available from the cap-
                     ture, if the length of the packet is larger than the maximum num-
                     ber of bytes to capture)

C中的一个例子:

/* Grab a packet */
                packet = pcap_next(handle, &header);
                if (packet == NULL) {   /* End of file */
                        break;
                }
                printf ("Got a packet with length of [%d] \n",
                                     header.len);

另一个Python中的pcapy库:

import pcapy

reader = pcapy.open_offline("packets.pcap")

while True:
    try:
        (header, payload) = reader.next()
        print "Got a packet of length %d" % header.getlen()
    except pcapy.PcapError:
        break