I am trying to do an offline capture of the packets from a .cap file using SharpPcap. I intend to capture these packets based on a filter.
Following is my code snippet.
private static void device_PcapOnPacketArrival(object sender, CaptureEventArgs e)
{
System.Console.WriteLine(e.Packet.LinkLayerType);
}
static void ParseLogFile(string l_FileName)
{
CaptureFileReaderDevice l_Parser = new CaptureFileReaderDevice(l_FileName);
l_Parser.Open();
string l_filter = "tcp";
string ErrMsg;
PcapDevice.CheckFilter(l_filter, out ErrMsg);
l_Parser.Filter = l_filter;
System.Console.WriteLine("ErrMsg: " + ErrMsg);
//l_Parser.OnPacketArrival += device_PcapOnPacketArrival;
//l_Parser.Capture();
SharpPcap.RawCapture pac;
while ((pac = l_Parser.GetNextPacket()) != null)
{
//Prints the time and length of each received packet
System.Console.WriteLine(BitConverter.ToString(pac.Data));
}
l_Parser.Close();
}
public static void Main() {
ParseLogFile(@"Sample.cap");
System.Console.WriteLine("THE END");
}
When I set the filter to "tcp" I don't see any frame logged on the console but I can see see them on the wireshark.
Instead if I set the filter to " " I can see all the frames from the .cap file on console.
Is Packet filtering supported in the offline mode ? If Supported, then is anything wrong with my filter here ?
