Network Captures

[Guest]

Archived from groups: comp.dcom.lans.ethernet (More info?)

If anyone out there has used SoftPerfect's Network Analyzer, I need to
find a way to convert the capture files I have from their format to
something more in line with a generla .CAP format used by programs such
as Ethereal. I'm not a programmer, but I do have the Capture file
format as follows:


CAP - is a capture file in which captured packets (sessions) are
stored.
Offset Size Name Description
0x0 - 0x2 3 Bytes CAPSIGN Signature line. This string value
always equal to "CAP".
0x3 1 Byte CAPVER In this version of the software the
value is always 1.
0x4 - 0x7 4 Bytes VTOTAL A long integer number (DWord). It is
equal to the total number of data packets in a file.

VTOTAL packet records then follow the above header data. Here is the
format of each variable length packet record:
- 8 Bytes TIMESTAMP A Double type number holding the date and time the
packet was received.
- 2 Bytes PKTLEN A Word type number, which gives the packet's length.
- PKTLEN PKTDATA A block of PKTLEN length. This is the packet's data.


If anyone could offer a utility (Ethereal's will not work..already
tried) or an easy solution, I'd be most appreciative. Thanks.


AL

 

[Guest]

Archived from groups: comp.dcom.lans.ethernet (More info?)

In article <1126623707.139361.297710@g14g2000cwa.googlegroups.com>,
aerielord <aerielord@gmail.com> wrote:
:If anyone out there has used SoftPerfect's Network Analyzer, I need to
:find a way to convert the capture files I have from their format to
:something more in line with a generla .CAP format used by programs such
:as Ethereal. I'm not a programmer, but I do have the Capture file
:format as follows:

It appears that there have been several different pcap file formats,
some incompatible with the others.

A draft of a proposed file format is at
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

I have not checked how far along that got -- I do not know if it
is still draft stage or is now widely implemented.
--
"Never install telephone wiring during a lightning storm." -- Linksys

 

[Guest]

Archived from groups: comp.dcom.lans.ethernet (More info?)

Ethereal's format must be public.

>From your description any programmer could swiftly
knock something together to solve this problem.

You will just have to find one?