text: You are not logged in.
  Pages: 1
  Hi all,
  I'm writing a program using libpcap, and I have multiple pcap files in a folder that I want to capture.
  I currently have
  handle = pcap_open_offline("/data/traffic/pcap1.pcap", errbuf");
  which works fine since pcap_open_offline() takes in a filename. However, I want to process multiple pcap files from the directory /data/traffic/ at once. Is there a way to do that?
  Thank you.
  Regards,
  Rayne
  Look for the program "mergecap" or "tcpslice" on your system... (One ships with
  wireshark, the other with tcpdump, generally...) Those can merge together multiple
  pcap files into one, which you can then load as a single file...
  I've done that, but I would like to be able to open variable number of files just by changing the number of files in the directory, instead of opening one merged pcap file which contains a fixed number of individual pcap files.
  It sounds like all you really need to do is scan the directory for file names, and then feed those file names to your pcap_open_offline() command, one at a time.
  If that's all you're asking about, it's easy enough to do:
  #include <dirent.h> #include <stdio.h> int main(int argc, char ** argv) { DIR * d = opendir("/data/traffic"); if (d) { while(1) { struct dirent * e = readdir(d); if (e) { if (e->d_name[0] != '.') // avoid . and .. and other .files { char buf[1024]; snprintf(buf, sizeof(buf), "/data/traffic/%s", e->d_name); puts(buf); } } else break; } closedir(d); } else fprintf(stderr, "Couldn't find directory!\n"); return 0; }
  Just replace the puts() command with your own command....
  -Jeremy
  Pages: 1