[API] add functions to be able to get packet's savefile offset #491
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pcap-int.h
Outdated
| @@ -200,6 +200,9 @@ struct pcap { | |||
| int activated; /* true if the capture is really started */ | |||
| int oldstyle; /* if we're opening with pcap_open_live() */ | |||
|
|
|||
| long lastpkt_offset; /* last packet offset in save file */ | |||
There was a problem hiding this comment.
Please use tabs, not 4 spaces, for indentation.
|
Sorry about the indentation, I fixed it :) I also removed |
|
Please rebase. |
…to API add current_offset and lastpkt_offset attributes to struct pcap in order to be able to get a packet's savefile offset
rename pcap_next_ex_with_file_offset to pcap_next_ex_with_sf_offset check if read from savefile to avoid useless calculations add some code documentation edit pcap_next_ex man page to add the pcap_next_*with_sf_offset API functions
fix indentation
alexandretea
force-pushed
the
pkt_file_offset
branch
from
fc104c8 to
2cf27d7
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I noticed there was no way through the API to get a packet's savefile offset, so I added those functions in order to resolve this problem :
pcap_next_with_sf_offset()andpcap_next_ex_with_sf_offset()They work the same as
pcap_next()andpcap_next_ex()but takes an additional pointer on a long, which will be set to the packet's savefile offset. If the packets are read from a live capture, then this long will be set to -1.This feature would be useful for a project I work on, which aim is to retrieve packets from pcap[-ng] files and then process them. I need to keep their savefile offsets to be able to retrieve their raw format at any time, after the processing.
It may also be useful for others :)