2

I am trying to write a tcp reconstruction program in c# , by using SharpPcap. So far I am doing a pretty good job, and the reconstruction is working fine. My only problem is, that in order to reconstruct big Pcap files by myself, I need to load them by parts/chunks to the memory, because sharppcap only let's me load the whole file( I think). Any suggestions?

Thanks

Max Vlaschuk-Gorelik
  • 79
  • 2
  • 10

2 Answers2

2

The pcap file format is really simple, see here: http://wiki.wireshark.org/FileFormatReference/libpcap

Why not load the file yourself, possibly a packet at a time, and then you can do what you want as you go along rather than having a library dictate your memory usage patterns?

Len Holgate
  • 21,282
  • 4
  • 45
  • 92
0

Given that SharpPcap PcapDevices have a GetNextPacket method, from which both LibPcapLiveDevice and CaptureFileReaderDevice inherit that method, I don't see anything that would require you to load the whole file - you might have to read the entire file, but you can just ignore packets you don't want.