-1

Is there a way to open an offline Pcap from an InputStream and not from a local file?

In the documentation it say that you can use pcap_fopen_offline() to open Pcap from an open stream but I don't know how to use it.

msrd0
  • 7,816
  • 9
  • 47
  • 82
Amir Rossert
  • 1,003
  • 2
  • 13
  • 33
  • Doesn't the documentation come with a sample? At least, what's the signature of this function? It probably uses a file handle, and not a `std::ifstream`. – πάντα ῥεῖ Oct 12 '14 at 09:50

1 Answers1

0

pcap_fopen_offline(3) is a C API of which JNetPCap works as a wrapper (you should have noticed this fact because naming convention is so different from Java API!) You don't have a direct access to it unless you code in C without JNetPCap (maybe you can access it with JNI/JNA, but that's no different from coding in C)

Moreover, when a document about C API talks about "stream", it's almost always a "file stream" in C's terminology. It doesn't necessarily mean a data stream from a file in a filesystem, but you basically need to be fluent with C to use it anything other than STDIN/OUT or files in a filesystem. I quickly went through Javadoc of JNetPCap, but I don't think it can do the work of translating a general InputStream into C's file stream for you.

nodakai
  • 7,773
  • 3
  • 30
  • 60
  • Hi, thanks, so if i'm getting the file from DB as an InputStream I will have to write it to the disk and then open it? or there is any way to get around this? – Amir Rossert Oct 12 '14 at 16:55
  • @AmirRossert I'm afraid that is the only way. I `grep`ped for `pcap_fopen_offline` in the source directory of `jnetpcap-src-1.4.r1425-1`, in vain. JNetPCap only calls `pcap_open_offline()`. – nodakai Oct 12 '14 at 17:31