Create a tcpdump/Wireshark pcap File

 

The pcap file format is the format in which BPF saves the original data packets. Many software applications are used, such as tcpdump and Wireshark. Understanding the pcap format can enhance understanding of the original data packets, you can also manually construct any data packet for testing.

 
The pcap file format is:
File Header in 24 bytes
The data packet header + the data packet header is 16 bytes followed by the data packet
Data packet header + data packet ......
 
The format of the file header is defined in pcap. h.

[CPP]View plaincopy

1. Struct pcap_file_header {
2. Bpf_u_int32 magic;
3. U_short version_major;
4. U_short version_minor;
5. Bpf_int32 thiszone;/* GMT to local correction */
6. Bpf_u_int32;/* accuracy of timestamps */
7. Bpf_u_int32 snaplen;/* max length saved portion of each Pkt */
8. Bpf_u_int32 linktype;/* Data Link Type (linktype _*)*/
9. };

Let's take a look at the meaning of each field:
Magic: 4-byte pcap File ID: D4 C3 B2 A1"
Major: 2-byte primary version # define pcap_version_major 2
Minor: 2-byte version # define pcap_version_minor 4
Thiszone: The 4-byte time zone is not used. Currently, all values are 0.
Sigfigs: The 4-byte exact timestamp is not used and is currently all 0
Snaplen: The maximum length of 4-byte packet capture. If you want to fully capture the packet, set it to 0x0000ffff (65535 ),
Tcpdump-S 0 sets this parameter. The default value is 68 bytes.
Linktype: 4-byte link types are generally 1: Ethernet
Common link types:
0 BSD loopback devices, memory T for later OpenBSD
1 Ethernet, and Linux loopback Devices
6 802.5 Token Ring
7. ARCNET
8 slip
9 PPP
10 FDDI
100 LLC/snap-encapsulated ATM
101 "raw IP", with no link
102 BSD/OS slip
103 BSD/OS PPP
104 Cisco HDLC
105 802.11
108 later OpenBSD loopback devices (with the af_value in network byte order)
113 special Linux "cooked" Capture
114 localtalk

========================================================== ========================================================== ========
| Magic | major | minor | thiszone | sigfigs | snaplen | linktype
| D4 C3 B2 A1 | 02 00 | 04 00 | 00 00 00 00 | 00 00 00 00 | FF 00 00 00 | 01 00 00 00
========================================================== ========================================================== ========
 
 
Data Header Format

[CPP]View plaincopy

1. Struct pcap_pkthdr {
2. Struct timeval ts;/* Time Stamp */
3. Bpf_u_int32 caplen;/* length of portion present */
4. Bpf_u_int32 Len;/* length this packet (Off wire )*/
5. };
6. Struct timeval {
7. Long TV _sec;/* seconds (xxx shocould be time_t )*/
8. Suseconds_t TV _usec;/* and microseconds */
9. };

TS: 8-byte packet capture time 4 bytes indicates the number of seconds, 4 bytes indicates the number of microseconds
Caplen: The length of the 4-byte stored package (up to snaplen, for example, 68 bytes)
Len: The actual length of a 4-byte data packet. If the file does not store the complete data packet, it may be larger than caplen.

 

After learning about the pcap file format, you can manually construct any data packet, which can be based on the recorded package,

Example of building a pcap file:

There are two methods to create a file, because you do not know how to use pcap_open_dead & pcap_dump_open to create a file and write it into the file header.

[CPP]View plaincopy

1. # Include <stdio. h>
2. # Include <stdlib. h>
3. # Include <string. h>
4. # Include <unistd. h>
5. # Include <stdint. h>
6. # Include <errno. h>
7. # Include <pcap. h>
8. # Include "common. H"
11. # Define tcpdump_magic 0xa1b2c3d4
12. # Ifndef pcap_version_major
13. # Define pcap_version_major 2
14. # Define
15. # Define pcap_version_minor
16. # Define pcap_version_minor 4
17. # Endif
20. # Define linktype_null dlt_null
21. # Define linktype_ethernet dlt_en10mb/* also for 100 mb and up */
22. # Define linktype_exp_ethernet dlt_en3mb/* 3 MB experimental Ethernet */
23. # Define linktype_ax25 dlt_ax25
24. # Define linktype_pronet dlt_pronet
25. # Define linktype_chaos dlt_chaos
26. # Define linktype_token_ring dlt_ieee802/* dlt_ieee802 is used for Token Ring */
27. # Define linktype_arcnet dlt_arcnet/* BSD-style headers */
28. # Define linktype_slip dlt_slip
29. # Define linktype_ppp dlt_ppp
30. # Define linktype_fddi dlt_fddi
33. Static int
34. Pcap_write_header (File * FP, int linktype, int thiszone, int snaplen)
35. {
36. Struct pcap_file_header HDR;
38. HDR. Magic = tcpdump_magic;
39. HDR. version_major = pcap_version_major;
40. HDR. version_minor = pcap_version_minor;
42. HDR. thiszone = thiszone;
43. HDR. snaplen = snaplen;
44. HDR. sigfigs = 0;
45. HDR. linktype = linktype;
47. If (fwrite (char *) & HDR, sizeof (HDR), 1, FP )! = 1)
48. Return (-1 );
50. Return (0 );
51. }
53. # Define file_save "pcap_write.pcap"
55. Uint8_t l2_data [] = {
56. 0x00, 0x0c, 0x29, 0x99, 0xfc, 0xa6, 0x00, 0x0c, 0x29, 0xd7, 0xc1, 0xf2, 0x08, 0x00, 0x45, 0x00,
57. 0x00, 0x46, 0x87, 0x8a, 0x00, 0x00, 0x40, 0x11, 0x6e, 0xa5, 0xc0, 0xa8, 0x01, 0x31, 0xc0, 0xa8,
58. 0x01, 0xf6, 0x7e, 0x75, 0x00, 0x35, 0x00, 0x32, 0x89, 0x42, 0x0a, 0x5d, 0x00, 0x00, 0x00, 0x01,
59. 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x6e, 0x73, 0x31, 0x05, 0x67, 0x75, 0x61, 0x72, 0x64,
60. 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00,
61. 0x80, 0x00, 0x00, 0x00
62. };
63. Int main (INT argc, char ** argv)
64. {
66. # If 0
67. File * fp = NULL;
68. Struct pcap_pkthdr h;
69. Fp = fopen (file_save, "WB ");
70. If (! FP ){
71. Fprintf (stderr, "fopen % s for write failed. errno = % d DESC = % s \ n ",
72. File_save, errno, strerror (errno ));
73. Return 1;
74. }
76. Pcap_write_header (FP, linktype_ethernet, 0x0, 0x0000ffff );
77. Gettimeofday (& H. Ts, null );
78. H. caplen = sizeof (l2_data );
79. H. Len = sizeof (l2_data );
81. Pcap_dump (uint8_t *) FP, & H, l2_data );
82. Fflush (FP );
83. Fclose (FP );
84. # Else
85. Pcap_t * P = NULL;
86. Pcap_dumper_t * fp = NULL;
87. Struct pcap_pkthdr h;
89. P = pcap_open_dead (linktype_ethernet, 0x0000ffff );
90. If (null = P ){
91. Fprintf (stderr, "pcap_open_dead failed. \ n ");
92. Return 1;
93. }
94. Fp = pcap_dump_open (p, file_save );
95. If (null = FP ){
96. Fprintf (stderr, "pcap_dump_open failed. \ n ");
97. Return 1;
98. }
99. Gettimeofday (& H. Ts, null );
100. H. caplen = sizeof (l2_data );
101. H. Len = sizeof (l2_data );
103. Pcap_dump (uint8_t *) FP, & H, l2_data );
104. Pcap_dump_close (FP );
105. # Endif
107. Return 0;
108. }

 

Compilation & Link

# GCC pcap_write.c-O pcap_write-lpcap

Create a tcpdump/Wireshark pcap File