Comment by GGFPC for You are reading raw packet data through the use of...
Thanks for the reply. I thought pcap4j already did that. Can you point me to a resource on how to do that!
View ArticleComment by Guy Harris for You are reading raw packet data through the use of...
> You simply dump the raw packet data into a file. They're also writing it through libpcap - see the `handle.dumpOpen` and `dumper.dumpRaw` calls.
View ArticleComment by Jaap for You are reading raw packet data through the use of...
Oh, I see. It's encapsulating `pcap_dump_fopen()` then. Still not seeing `dumpRaw` encapsulating `pcap_dump()`, where's the packet header info (in particular the size)?
View ArticleComment by Guy Harris for You are reading raw packet data through the use of...
> where's the packet header info Nowhere. `dumpRaw` generates it. > in particular the size It's the size of the array that was handed to it. The `dumpRaw` code in pcap4j does: pcap_pkthdr header...
View ArticleComment by GGFPC for You are reading raw packet data through the use of...
Okay I managed to overcome the error by writing to the PcapDumper only the exact number of bytes that were read. But now everything shows as Ethernet on Wireshark. How does libpcap decode the protocol...
View ArticleAnswer by Jaap for I'm trying to build a transparent proxy in Java with the...
You are reading raw packet data through the use of Pcap4J, but are not writing [PCAP](https://wiki.wireshark.org/Development/LibpcapFileFormat) format files. You simply dump the raw packet data into a...
View ArticleComment by GGFPC for You would have to structure the InputStream data so that...
Hi, thanks for the answer. I'm trying to write a transparent proxy for any protocol to record the data sent to a specific port. This is so I don't have to sniff all traffic with libpcap as I'm trying...
View ArticleComment by Guy Harris for You would have to structure the InputStream data so...
> I changed my code to write to the file only the amount of data that has been read from the stream in that iteration, which I feel would be okay since only one packet is sent at a time. If you're...
View ArticleComment by GGFPC for You would have to structure the InputStream data so that...
Thanks once again. Yes it is a TCP socket. In that case I think I'm out of options, other than sniffing with libpcap right?
View ArticleComment by Guy Harris for You would have to structure the InputStream data so...
You *could* try 1. using the `openDead ` method of `PcapHandle` to create a fake handle for link-layer type `DLT_RAW`; 2. using that to create the `PcapDumper`; 3. for each chunk of data you read from...
View ArticleComment by GGFPC for You would have to structure the InputStream data so that...
I'm trying that with the following code IpV4Packet p = new IpV4Packet.Builder() .dstAddr((Inet4Address) Inet4Address.getByName("172.0.0.1")) .srcAddr((Inet4Address) Inet4Address.getByName("172.0.0.2"))...
View ArticleComment by Guy Harris for You would have to structure the InputStream data so...
> Is this what you meant? Something *like* that - but if you know the host and port numbers of both endpoints of the conversation, you should use those rather than hardcoded IP addresses and ports....
View ArticleAnswer by Guy Harris for I'm trying to build a transparent proxy in Java with...
You would have to structure the InputStream data so that it could be divided into packets. For example, if you're writing raw packet data to the stream, before each packet you would write a number...
View ArticleComment by Guy Harris for I'm trying to build a transparent proxy in Java...
What is `mInputStream`? What class is it an instance of? It needs *somehow* to be divided into packets, so that each `.read` call returns one packet. And if a packet is bigger than 262144 bytes,...
View ArticleComment by GGFPC for I'm trying to build a transparent proxy in Java with the...
It's just an InputStream directly from the Socket
View ArticleTrying to write Java raw InputStream data as PCAP to view in Wireshark
I'm trying to build a transparent proxy in Java with the ability to record data that passed through to be viewed later in wireshark. I was able to get the proxy working correctly with this snippet...
View Article
