Comment by Guy Harris for You would have to structure the InputStream data so that it could be divided into packets. For example, if you're writing raw packet data to the stream, before each packet you would write a number giving the size of the packet, in bytes.Then, when reading the stream and writing a pcap file, you would read the number first, and then read that number of bytes of packet data. You would also have to ensure, in each iteration of the loop, the buffer would have to have exactly that number of bytes, so that dumper.dumpRaw knows how many bytes are in the packet.This probably means that you should allocate the packet buffer separately, for every packet, and allocate it so that it's exactly the size of the packet data.Without doing that, your code will NOT work.

> Is this what you meant? Something *like* that - but if you know the host and port numbers of both endpoints of the conversation, you should use those rather than hardcoded IP addresses and ports. > but for some reason wireshark loads the packets as "Bogus Length, must be at least 20". If that's an error in the IPv4 header, then the IPv4 builder is somehow not setting the length correctly. If that's an error in the TCP header, then the TCP builder is somehow not setting the length correctly. You need to do whatever is necessary to make sure that the header length in the IPv4 header, and the data offset field in the TCP header, is set to the appropriate value. The builders probably won't add any options, so the appropriate value is 20 in both cases. You would also need to do whatever is necessary to make sure that the *total* length in the IPv4 header is set to the appropriate value. Again, the builders probably won't add any options, so the appropriate value would be 20 (for the IPv4 header) + 20 (for the TCP header) + bytesRead (which I'm assuming is the length of the TCP payload).