Timeline for How to record packet/frames data without a pcap header
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 14, 2024 at 9:09 | comment | added | Marcus Müller | And now, I frankly don't care about how your headers look, but seeing that the usual interface to capturing packets on most operating systems is pcap, and pcap comes with its headers, and it comes with its header interpreter library, it would be pretty unnecessarily complex to use any other header format. | |
| Jul 14, 2024 at 9:07 | comment | added | Marcus Müller |
When I speak to you clearly (and assuming your hearing works well), you know where one word starts end ends, and can infer the length of words simply as the thing between the gaps between words. Now, remove all the gaps from my speech (or remove all the spaces from written text), and do the understanding again. That's going to be ambiguous! Worse if what I speak aren't words but I just dictate numbers. You lose all usefulness if you write these down without headers; 102 1003 are simple not the same numbers as 10 21003. So, if you write things to a file, you'll need headers. Like it or not.
|
|
| Jul 14, 2024 at 9:03 | comment | added | Marcus Müller | you should be using libpcap, is what my answer says. Also, you already are (in tcpdump), you just don't realize. The NIC driver knows because the card includes that info in however it gets data from device to host memory. (usually, these are ring buffers of packet buffer descriptors, and the packet buffer descriptors are what you'd call a header here). Thing is, in a driver, you're not trying to put the bytes from packets one after the other in a file. The packets are separate to begin with in the driver. Think of it like this: | |
| Jul 13, 2024 at 22:36 | comment | added | intrigued_66 | Thank you for replying. You're assuming I'm using libpcap..... I'm not. And how do NIC drivers know how many bytes given the PCAP header doesn't exist in real wire traffic? | |
| Jul 13, 2024 at 19:47 | history | answered | Marcus Müller | CC BY-SA 4.0 |