0

I am writing code that scan the packets of pcap file.

I use the command

pcap_next_ex()

to get the next packet.

is there a way to get the first packet- somewhere in the middle of the code, without close and reopen the pcap file?

Thanks.

user3378689
  • 209
  • 1
  • 4
  • 12
  • Not unless you save the packet somewhere in memory yourself – nos Apr 13 '14 at 16:22
  • I.e., you've already read the first packet once (your first call to `pcap_next_ex()` after `pcap_open_offline()` will give you the first packet in the file), and you want to seek backwards in the file and read the first packet again? –  Apr 13 '14 at 19:46
  • yes.. I need to seek from the beginning.. and scan the pcap again from the start. is there a way to load specific packet? for example only from dest_port? thanks. – user3378689 Apr 14 '14 at 06:24

1 Answers1

0

You can use

    long pos = ftell(pcap_file(p));

before the first pcap_next_ex(), and

    fseek(pcap_file(p), pos, SEEK_SET);

when you want to get the first packet again.

Armali
  • 18,255
  • 14
  • 57
  • 171