/// <summary>
/// Saves packets to a new temp file
/// </summary>
/// <param name="basePcapngFile">Possible back file to copy the packets from. Can be null if no such file exists</param>
/// <param name="packets">List of temporary packets to write. Might be empty ONLY IF <paramref name="basePcapngFile"/> is not NULL</param>
/// <returns>Path of the temporary PCAP that was created</returns>
public string WritePackets(PcapngWeakHandle basePcapngFile, IEnumerable <TempPacketSaveData> packets)
{
if (basePcapngFile != null)
{
return(DoExportBasedOfFile(basePcapngFile, packets));
}
if (packets == null || !packets.Any())
{
throw new ArgumentNullException(
$"WritePackets failed because both {nameof(basePcapngFile)} and {packets} where NULL/empty");
}
TimestampHelper tsh = new TimestampHelper(0, 0);
string pcapngPath = Path.ChangeExtension(Path.GetTempFileName(), "pcapng");
IEnumerable <LinkLayerType> allLinkLayers = packets.Select(packetData => packetData.LinkLayer).Distinct();
// A local "Link layer to Interface ID" dictionary
Dictionary <ushort, int> linkLayerToFakeInterfaceId = new Dictionary <ushort, int>();
int nextInterfaceId = 0;
// Collection of face interfaces we need to add
List <InterfaceDescriptionBlock> ifaceDescBlock = new List <InterfaceDescriptionBlock>();
foreach (LinkLayerType linkLayer in allLinkLayers)
{
InterfaceDescriptionBlock ifdb = new InterfaceDescriptionBlock((LinkTypes)linkLayer, ushort.MaxValue,
new InterfaceDescriptionOption(Comment: null, Name: "Fake interface " + nextInterfaceId));
ifaceDescBlock.Add(ifdb);
linkLayerToFakeInterfaceId.Add((ushort)linkLayer, nextInterfaceId);
nextInterfaceId++;
}
// Place all interfaaces in a header
HeaderWithInterfacesDescriptions hwid =
new HeaderWithInterfacesDescriptions(SectionHeaderBlock.GetEmptyHeader(false), ifaceDescBlock);
Haukcode.PcapngUtils.PcapNG.PcapNGWriter ngWriter = new PcapNGWriter(pcapngPath, new List <HeaderWithInterfacesDescriptions>()
{
hwid
});
foreach (TempPacketSaveData packet in packets)
{
int interfaceId = linkLayerToFakeInterfaceId[(ushort)packet.LinkLayer];
byte[] packetData = packet.Data;
EnhancedPacketBlock epb = new EnhancedPacketBlock(interfaceId, tsh, packetData.Length, packetData, new EnhancedPacketOption());
ngWriter.WritePacket(epb);
}
ngWriter.Dispose();
return(pcapngPath);
}
public static void WritePcapFile()
{
//IPacket packet = new PcapPacket();
//PcapNGWriter writer = new PcapNGWriter(@"d:\temp\new.pcap");
// writer.WritePacket();
using (var reader = new PcapReader(@"d:\temp\2020-05-16-20-08.pcap"))
{
using (var writer = new PcapNGWriter(@"d:\temp\new.pcap"))
{
CommonDelegates.ReadPacketEventDelegate handler = (obj, packet) =>
{
writer.WritePacket(packet);
};
CancellationTokenSource tokenSource = new CancellationTokenSource();
reader.OnReadPacketEvent += handler;
reader.ReadPackets(tokenSource.Token);
reader.OnReadPacketEvent -= handler;
}
}
}