pcap - 在 pcap 文件中收集数据包长度

Question

大家好，我如何收集 pcap 文件中每个数据包的数据包长度？非常感谢

Answer 1

我推荐一个很少有人知道的高科技方法:阅读文档。

man pcap 告诉我们实际上有两种不同的长度可用:

              caplen a  bpf_u_int32  giving the number of bytes of the packet that are                     available from the capture              len    a bpf_u_int32 giving the length of the packet,  in  bytes  (which                     might  be  more  than the number of bytes available from the cap-                     ture, if the length of the packet is larger than the maximum num-                     ber of bytes to capture)

C 中的一个例子:

/* Grab a packet */                packet = pcap_next(handle, &header);                if (packet == NULL) {   /* End of file */                        break;                }                printf ("Got a packet with length of [%d] \n",                                     header.len);

Python 中的另一个 pcapy library :

import pcapyreader = pcapy.open_offline("packets.pcap")while True:    try:        (header, payload) = reader.next()        print "Got a packet of length %d" % header.getlen()    except pcapy.PcapError:        break