小编Sco*_*ott的帖子

不使用libpcap我试图写一个符合pcap文件格式(格式)的日志文件.WireShark需要读取此文件.到目前为止,我用C++编写了这个:

struct pcapFileHeader {
    uint32_t magic_number;   /* magic number */
    uint16_t version_major;  /* major version number */
    uint16_t version_minor;  /* minor version number */
    int16_t  thiszone;       /* GMT to local correction */
    uint32_t sigfigs;        /* accuracy of timestamps */
    uint32_t snaplen;        /* max length of captured packets, in octets */
    uint32_t network;        /* data link type */
};

ofstream fileout;
fileout.open("file.pcap", ios::trunc);

pcapFileHeader fileHeader;
fileHeader.magic_number = 0xa1b2c3d4;
fileHeader.version_major = 2;
fileHeader.version_minor = 4;
fileHeader.thiszone = 0;
fileHeader.sigfigs = …