Winpcap : using pcap_stats() for saved files - c++

Question

I have to following problem.
I need to scan a .pcap file (saved file) for re-transmitted tcp packets.
I'm using the Winpcap lib. I tried using pcap_stats() to check for dropped packets (which will also represent re-transmitted packets), but found out pcap_stats() can only be used for live captures and not saved files. Is there any way around this limitation, or am I looking at it wrong?
Here is my code so far:
int main(int argc, char **argv)
{
pcap_t *fp; //File pointer
char errbuff[PCAP_ERRBUF_SIZE]; //Error buffer
char source[PCAP_BUF_SIZE]; //Source string
struct pcap_pkthdr *header; //Packet header
const u_char *pkt_data; //Packet data
pcap_stat *ps; // Packet stats
char packet_filter[] = "tcp"; //Filter paramaters
struct bpf_program fcode; //compiled filter code
int res; //File reading result
u_int i = 0;
time_t start = time(NULL);
time_t sec;
int lps; //Lines per second
//Create source string
if (pcap_createsrcstr(source, //Source string
PCAP_SRC_FILE, //Open local file
NULL, //Host
NULL, //Port
argv[1], //File name
errbuff //Error buffer
) != 0)
{
fprintf(stderr, "\n Error creating source string");
return -1;
}
//Open File
if ((fp = pcap_open(source, //Device
65536, //Capture size (65536 = whole packet)
PCAP_OPENFLAG_PROMISCUOUS, //Flags
1000, //Timeout
NULL, //Authentication
errbuff //Error buffer
)) == NULL)
{
fprintf(stderr, "Error opening file", source);
return -1;
}
//Complie filter
if ((pcap_compile(fp, //File pointer
&fcode, //Compiled filter code
packet_filter, //Filter paramaters
1, //Optimazation
NULL //netmask
)) < 0)
{
fprintf(stderr, "\n Unable to complile packet filter");
return -1;
}
//Set filter
if ((pcap_setfilter(fp, //File pointer
&fcode //Compiled filter code
)) < 0)
{
fprintf(stderr, "\n Error setting filter");
return -1;
}
if ((pcap_stats(fp, ps)) < 0)
{
fprintf(stderr, "failed to retrive statistics");
printf(pcap_geterr(fp));
return -1;
}
//Read file
while ((res = pcap_next_ex(fp, &header, &pkt_data)) >= 0)
{
}
if (res == -1)
{
printf("Error reading the packets %s\n", pcap_geterr(fp));
}
printf("%f%%", (ps->ps_capt)/(ps->ps_recv) * 100); //percentage of accepted packets
sec = time(NULL) - start;
if (sec > 0)
{
lps = (ps->ps_recv) / sec;
printf("\nSpeed: %d Packets/second", lps);
}
else
{
lps = (ps->ps_recv);
printf("\nSpeed: %d Packets/second", lps);
}
return 0;
}

Answer 1

For better or worse, packet statistics are not saved in pcap files; there's nothing in the file format to support that.
pcap-ng supports it, but libpcap doesn't yet support writing pcap-ng files, and WinPcap is based on an earlier version of libpcap that didn't even support reading them.
This will probably improve at some unknown point in the future.