c++ - 数据包在 .pcap 文件中存储错误

Question

我正在尝试使用 pcap_dump() 和 pcap.h 库中的其他函数将示例数据包保存到 .pcap 文件。当我在 Wireshark 中打开它时，数字与我在程序中保存的数字不同。这是我的代码:

void create_pcap_file() {

string udp = "ff ff ff ff ff ff 00 21 85 11 29 1b 08 00 45 00 00 1c 0c 12 40 00 80 11 00 00 93 af 6a 8d ff ff ff ff 44 5c 44 5c 00 08 78 e9 ";
u_char* packet = (u_char*)malloc(udp.size() * sizeof(u_char*));
for (int i = 0; i < udp.size(); i++) {
    packet[i] = (u_char) udp[i];
}

pcap_dumper_t * file = pcap_dump_open(pcap_open_dead(DLT_EN10MB, 65535), "dumper_item1.pcap");
pcap_pkthdr header;
header.caplen = (bpf_u_int32)42; //size of an UDP/IP packet without any data
header.len = (bpf_u_int32)42;
header.ts.tv_sec = time(NULL);
header.ts.tv_usec = 0;
pcap_dump((u_char*)file, &header, packet);
} 

Wireshark 显示如下:

有人知道为什么会这样吗？

Answer 1

正如 Alan Stokes 在他的回答中指出的(他应该作为回答给出，而不仅仅是评论)，pcap 文件是二进制文件，而不是文本文件，因此内容应该是原始的十六进制数据，而不是文本字符串看起来像十六进制数据转储。

你想要的是:

void create_pcap_file() {

u_char packet[] = {
    0xff, 0xff, 0xff, 0xff, 0xff, 0xff,  // Ethernet destination address
    0x00, 0x21, 0x85, 0x11, 0x29, 0x1b,  // Ethernet source address
    0x08, 0x00,                          // Ethernet type (0x0800 = IPv4)
    0x45,                                // IPv4 version/IHL
    0x00,                                // IPv4 Type of Service
    0x00, 0x1c,                          // IPv4 total length (0x001c = 28)
    0x0c, 0x12,                          // IPv4 identification (0x0c12)
    0x40, 0x00,                          // IPv4 flags and fragment offset
    0x80,                                // IPv4 time-to-live (0x80 = 128)
    0x11,                                // IPv4 protocol (0x11 = 17 = UDP)
    0x00, 0x00,                          // IPv4 header checksum (not valid)
    0x93, 0xaf, 0x6a, 0x8d,              // IPv4 source address (147.175.106.141)
    0xff, 0xff, 0xff, 0xff,              // IPv4 destination address (255.255.255.255)
    0x44, 0x5c,                          // UDP source port (0x445C = 17500)
    0x44, 0x5c,                          // UDP destination port (0x445C = 17500)
    0x00, 0x08,                          // UDP length (0x0008 = 8)
    0x78, 0xe9                           // UDP checksum (0x78e9)
};

pcap_dumper_t * file = pcap_dump_open(pcap_open_dead(DLT_EN10MB, 65535), "dumper_item1.pcap");
pcap_pkthdr header;
header.caplen = (bpf_u_int32)sizeof packet; //size of an UDP/IP packet without any data
header.len = (bpf_u_int32)sizeof packet;
header.ts.tv_sec = time(NULL);
header.ts.tv_usec = 0;
pcap_dump((u_char*)file, &header, packet);
}