hakanl/pcapngutils

C# full managed implementation Pcap/PcapNG file format

PcapngUtils

C# full managed implementation Pcap/PcapNG file format

The nuget package

PM> Install-Package Haukcode.PcapngUtils 

Description

Pcap and PcapNG are file formats used to store dumps of network traffic. There formats are described in: * Pcap: https://wiki.wireshark.org/Development/LibpcapFileFormat * Pcap Next Generation: https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

The implementation of these formats is made by wrapping unmanaged WinPcap library. I added the implementation of both formats in a fully managed C #.

Usage

Open Pcap file

public void OpenPcapFile(string filename,CancellationToken token)
{
  using (var reader = new PcapReader(filename))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}

Open PcapNG file

public void OpenPcapNGFile(string filename,bool swapBytes,CancellationToken token)
{
  using (var reader = new PcapNGReader("test.pcap",swapBytes))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}

Open Pcap/PcapNG file

Better solutions, library can recognize the file format,

public void OpenPcapORPcapNFFile(string filename,CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(filename))
  {
    reader.OnReadPacketEvent += reader_OnReadPacketEvent;
    reader.ReadPackets(token);
    reader.OnReadPacketEvent -= reader_OnReadPacketEvent;
  }
}  
void reader_OnReadPacketEvent(object context, IPacket packet)
{
Console.WriteLine(string.Format("Packet received {0}.{1}",packet.Seconds, packet.Microseconds ));
}

Read packages and save to Pcap file

public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(inputFileName))
  {
    using (var writer = new PcapWriter(outputFileName))
    {
      CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
      {
        writer.WritePacket(packet);
      };
      reader.OnReadPacketEvent += handler;
      reader.ReadPackets(token);
      reader.OnReadPacketEvent -= handler; 
    }                
  }
}

Read packages and save to PcapNG file

public void CloneFile(string inputFileName, string outputFileName, CancellationToken token)
{
  using (var reader = IReaderFactory.GetReader(inputFileName))
  {
    using (var writer = new PcapNGWriter(outputFileName))
    {
      CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
      {
        writer.WritePacket(packet);
      };
      reader.OnReadPacketEvent += handler;
      reader.ReadPackets(token);
      reader.OnReadPacketEvent -= handler; 
    }                
  }
}

pcapngutils's Issues

Packet enumeration throws ArgumentNullException after last packet for Pcap (non pcapng) files

Just open a .pcap file and ReadPackets throws the exception after reading the last packet

Probably the following change in PcapReader.cs would solve the problem :

public void ReadPackets(System.Threading.CancellationToken cancellationToken)
{
   while (!cancellationToken.IsCancellationRequested)
   {
   	try
   	{
   		var packet = ReadNextPacket();
   		if (packet == null) <<<< FIX
   			return;         <<<< FIX 
   		OnReadPacket(packet);
   	}
   	catch (Exception exc)
   	{
   		OnException(exc);
   	}
   }
}

Clean up the readme file

• Change to Markdown
• Update the examples to include the new methods for reading a packet at a time