Wireshark-dev: Re: [Wireshark-dev] develop a tool to parse captured file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 2 Jul 2007 21:01:53 -0700

On Jul 2, 2007, at 8:12 PM, Stephen Fisher wrote:


Wireshark's main file format is normal libpcap:

 http://wiki.wireshark.org/Development_2fLibpcapFileFormat
...which means you can use libpcap on UN*X and WinPcap on Windows to read the packets.
Note that what you get from libpcap/WinPcap is raw packet data; parsing the link-layer header, IP header (if the packet is IP), etc. is up to the developer of the program using libpcap/WinPcap.