Creating a pcap file
c, libpcap, linux, pcap, udp
Solution
You shouldn't need to write that header, `pcap_open_dead` should do it for you. You only need to fill out and write that header yourself if you want to write the file directly instead of using `pcap_dump` and friends. There's an example here of a trivial program write out a pcap file with those functions.
original answer, concerning writing the file directly:
I can't remember exactly how this works, but I wrote a patch to `redir` a while ago that would write out pcap files, you may be able to use it as an example.
You can find it attached to this debian bug. (bug link fixed.)
Some of it is for faking the ethernet and IP headers, and may not be applicable as you're using `pcap_dump_open` and `pcap_dump` where as the patch linked above writes out the `pcap` file without using any libraries, but I'll leave this here anyway in case it helps.
Problem
I need to save UDP packets to a file and would like to use the pcap format to reuse the various tools available (wireshark, tcpdump, ...). There are some information in this thread but I can't find how to write the global file header 'struct pcap_file_header'. ``` pcap_t* pd = pcap_open_dead(DLT_RAW, 65535); pcap_dumper_t* pdumper = pcap_dump_open(pd, filename); struct pcap_file_header file_hdr; file_hdr.magic_number = 0xa1b2c3d4; file_hdr.version_major = 2; file_hdr.version_minor = 4; file_hdr.thiszone = 0; file_hdr.sigfigs = 0; file_hdr.snaplen = 65535; file_hdr.linktype = 1; // How do I write file_hdr to m_pdumper? while( (len = recvmsg(sd, &msg_hdr, 0)) > 0 ) pcap_dump((u_char*)m_pdumper, &m_pcap_pkthdr, (const u_char*)&data); ``` How should I write the global file header? If there is no specific pcap function available, how can I retrieve the file descriptor to insert the header using write()?