C Pcap vs. Pcap-ng Test Function
Submitted by admin on
Well, I recently needed a quick sniffer test for pcap-ngs because it was producing unwanted work arounds for older packet captures needing conversions - here it is:
#define BLOCK_TYPE_SECTION_HEADER 0x0a0d0d0a
static int is_pcap_or_pcapng(const char *input) {
FILE *pcap = NULL;
if ((pcap = fopen(input,"r"))==NULL) {
return (-1);
}
uint32_t buffer = 0 ;
if(fread(&buffer,sizeof(uint32_t),1,pcap) < 0) {
fclose(pcap);
return (-1);
}
if (buffer != BLOCK_TYPE_SECTION_HEADER) {
printf( "Original PCAP\n");
} else {
fclose(pcap);
return (-1);
}
fclose(pcap);
static int is_pcap_or_pcapng(const char *input) {
FILE *pcap = NULL;
if ((pcap = fopen(input,"r"))==NULL) {
return (-1);
}
uint32_t buffer = 0 ;
if(fread(&buffer,sizeof(uint32_t),1,pcap) < 0) {
fclose(pcap);
return (-1);
}
if (buffer != BLOCK_TYPE_SECTION_HEADER) {
printf( "Original PCAP\n");
} else {
fclose(pcap);
return (-1);
}
fclose(pcap);
return (0);
}
Add new comment