Does winpcap and sharppcap support the pcap-ng format

Question

I've a file in the pcapng format and want to open it by SharpPcap - that doesn't work.

SharpPcap uses Winpcap (libpcap).

So my question: Does WinPcap and/or SharpPcap support the pcap-ng format at the moment or in future? I can't find some current information about it, only some old posts.

Answer 1

Does WinPcap and/or SharpPcap support the pcap-ng format at the moment

No. Support for reading pcap-ng files was added to libpcap in libpcap 1.1.0, and the latest WinPcap is based on libpcap 1.0.0.

or in future?

Hopefully some future WinPcap release will be based on a recent libpcap release. This will require some work, mainly for remote-capture support with the new pcap_create()/pcap_activate() APIs.

Answer 2

To read timestamp with nanosecond precision

1. Update original WinPcap setup with WinPcap 4.1.3 - libpcap 1.7.3
2. Open file using pcap_open_offline_with_tstamp_precision function and pass PCAP_TSTAMP_PRECISION_NANO as a second parameter.
3. After that your app should treat pcap_pkthdr::ts structure returned from pcap_next as a seconds+nanoseconds.

Sorry, I did not have chance to port it to SharpPcap.

Answer 3

Yes. SharpPcap supports the latest libpcap and npcap releases and these releases support pcap-ng file format.