Reading pcap file to vector/array - c++

Question

I am trying to read pcap file to some data structure like vector or array and later use gathered data (only selected one like packet length, timestamp) in application. I've found some sample application for reading pcap:
#include <stdio.h>
#include <pcap.h>
#define LINE_LEN 16
void dispatcher_handler(u_char *, const struct pcap_pkthdr *, const u_char *);
int main(int argc, char **argv)
{
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
if(argc != 2)
{
printf("usage: %s filename", argv[0]);
return -1;
}
/* Open the capture file */
if ((fp = pcap_open_offline(argv[1], // name of the device
errbuf // error buffer
)) == NULL)
{
fprintf(stderr,"\nUnable to open the file %s.\n", argv[1]);
return -1;
}
/* read and dispatch packets until EOF is reached */
pcap_loop(fp, 0, dispatcher_handler, NULL);
pcap_close(fp);
return 0;
}
void dispatcher_handler(u_char *temp1,
const struct pcap_pkthdr *header,
const u_char *pkt_data)
{
u_int i=0;
/*
* unused variable
*/
(VOID*)temp1;
/* print pkt timestamp and pkt len */
printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);
printf("\n\n");
}
The problem is with pcap_loop(). I've found documentation for this, but the only information is that this is reading whole file until end of file is reached. I've been trying to treat file as a typical FILE, and in while loop read until EOF, but it doesn't work, because I cannot simply treat fp as FILE.
Also I don't see any possibility to pass pointer to pcap_handler to retrieve it later.
Can someone suggest how I can do it other way?

Answer 1

According to documentation your code looks right. pcap_loop should be doing the FILE reading, you shouldn't try to do it.
One thing the doc mentions is that in older pcap versions 0 for count in pcap_loop is undefined, so it should be safer to use -1 in case you are linking to an older version.

Answer 2

I after further documentation and Internet investigation I've found function: pcap_next_ex()
Thanks to that I can use now while loop and read line by line (or more precisely packet by packet). The general idea is as follows:
struct pcap_pkthdr *header;
const u_char *pkt_data;
int res;
while((res = pcap_next_ex(fp, &header, &pkt_data)) >= 0)
{
//Process packet
}

Answer 3

I've been trying to treat file as a typical FILE, and in while loop read until EOF, but it doesn't work, because I cannot simply treat fp as FILE.
No, because it's not a FILE. (You also get a pcap_t * from pcap_open_live() or from a pcap_create()/pcap_activate() combination, but that gives you a handle for a live capture, not for a file.)
Also I don't see any possibility to pass pointer to pcap_handler to retrieve it later.
The fourth argument to pcap_loop() is passed as the first argument to pcap_handler, so you could do
pcap_loop(fp, 0, dispatcher_handler, pointer);
and then, in dispatcher_handler(), cast temp1 to the appropriate type and use it - it'll point to the same thing that pointer does.