modify captured pcap and write back

Question

I need to read captured pcap file, that contains some proprietary descriptor appended by FPGA at the start of file right after MAC header, add extra 2 bytes to the descriptor and write back.

I'm trying to implement this in C using libpcap library on linux. Am I right that I will need to call pcap_dump_open() and pcap_dump() to write buffer? Also, is is true that I'll need to increment caplen and and 'len' from pcap_pkthdr accordingly (add 2) prior writing the buffer with pcap_dump?

Thanks in advance !

Answer 1

I need to read captured pcap file, that contains some proprietary descriptor appended by FPGA at the start of file right after MAC header

So the packet format is, in order:

• MAC header
• proprietary descriptor
• payload

?

add extra 2 bytes to the descriptor and write back.

So the proprietary descriptor will become 2 bytes longer, moving the payload down by two bytes?

I'm trying to implement this in C using libpcap library on linux. Am I right that I will need to call pcap_dump_open() and pcap_dump() to write buffer?

That's probably the easiest way to do it.

Also, is is true that I'll need to increment caplen and and 'len' from pcap_pkthdr accordingly (add 2) prior writing the buffer with pcap_dump?

If you're adding 2 bytes to the packet, yes, you'll need to increment both the caplen and len fields of the pcap_pkthdr structure by 2 before writing the packet out.

Unless you know for certain that caplen is large enough to include the MAC header and all the data in the proprietary descriptor up to the point where you'll be adding the 2 bytes in question, you should also check to make sure that it is and, if it isn't, don't modify the packet in question and only modify len, not caplen, for that particular packet.