Read pcap file using java

This will create a pcap directory with a pom. Inside the created directory, edit the pom. It should look similar to this:. Now we are ready to start writing source code. We can start editing in that file. It should already look something like this:. Let's modify the App. Update the code to look more like this:. Now that we have some code we actually want to run and test, let's set up Maven to package our app in to an executable JAR file with dependencies that is ready for us to run.

To make packaging and running the application easier, we should package the application as a JAR with all the dependencies embedded. Modify the pom. While we're at it, let's tell the compiler plugin to target Java version 1.

After adding those plugins, we can navigate to the root project directory with the pom. When you run the example it will print out all available devices and you must enter a number to select a device.

Before we move on and make this program more complex, let's break out the code from the main method in to a separate method like this. If you want to get the list of devices yourself, instead of using the selector tool provided, call the native Pcaps. Refer to this code snippet taken from the NifSelector class.

Once you have selected a device, you can create call openLive to create a handle that can be used to listen for packets. Laxdeep Bomble. Optional 'thank-you' note:. I am trying to read. I want to read inner header and data with their source and destination address. I am successful in decoding the global header, but the inner header is not showing the expected result shows different bytes. I am doing code in java. I am using bytebuffer to read the bytes. The source and destination address is of length 6 bytes.

An Interface Description Block is valid only inside the section which it belongs to. The structure of a Interface Description Block is shown in Figure 4. Now, let us try to understand how it looks in actually captured file with an example,.

The first 4 bytes d4 c3 b2 a1 constitute the magic number which is used to identify pcap files. The next 4 bytes 02 00 04 00 are the Major version 2 bytes and Minor Version 2 bytes , in our case 2. Why is 2 written on 2 bytes as 0x and not 0x? This is called little endianess in which, the least significant byte is stored in the least significant position: This means that 2 would be written on 2 bytes as 02 How do we know that we are not using Big Endianness instead? The magic number is also used to distinguish between Little and Big Endianness.

AOL 0x00a0: e 6c Improve this question. Tony Tony 3, 9 9 gold badges 33 33 silver badges 29 29 bronze badges. I was able to extract a readable email from pcap data using 'strings' — Yaakov Kuperman.

Add a comment. Active Oldest Votes. Hos 0x a 6c74 2e63 t:. X11 0x 3b20 b c e b ;. For example. Improve this answer. Zoredache Zoredache k 39 39 gold badges silver badges bronze badges. It can make for messy reading, but useful for those in-the-field scenarios. Which reminds me - ngrep! Show 2 more comments.