Comment by Guy Harris for You would have to structure the InputStream data so that it could be divided into packets. For example, if you're writing raw packet data to the stream, before each packet you would write a number giving the size of the packet, in bytes.Then, when reading the stream and writing a pcap file, you would read the number first, and then read that number of bytes of packet data. You would also have to ensure, in each iteration of the loop, the buffer would have to have exactly that number of bytes, so that dumper.dumpRaw knows how many bytes are in the packet.This probably means that you should allocate the packet buffer separately, for every packet, and allocate it so that it's exactly the size of the packet data.Without doing that, your code will NOT work.

You *could* try 1. using the `openDead ` method of `PcapHandle` to create a fake handle for link-layer type `DLT_RAW`; 2. using that to create the `PcapDumper`; 3. for each chunk of data you read from the TCP socket, putting a fake IP header (with the right contents) and a fake TCP header in front of the chunk of data, and writing that to the file.