[Haskell-cafe] Reading pcap

mukesh tiwari mukeshtiwari.iiitm at gmail.com
Wed Oct 12 20:33:15 CEST 2011


Thank you all for your valuable comments.
@ MD no , i haven't tried but  i am looking forward .
@ Neil Davis It would be great if you can make this library
external .
@ Malcolm  Does this mean that pcap files don't have any EOF file
character.

One last question
The values which were not visible in wireshark
0xd4 0xc3 0xb2 0xa1 0x02 0x00 0x04 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0xff 0xff 0x00 0x00 0x01 0x00 0x00 0x00 0x0b 0xd4 0x9e 0x43
0x41
0x38 0x01 0x00 0x3c 0x00 0x00 0x00 0x3c 0x00 0x00 0x00

Are these hex bytes value of this pcap header ?
  struct pcap_pkthdr {
		struct timeval ts;	/* time stamp */
		bpf_u_int32 caplen;	/* length of portion present */
		bpf_u_int32 len;	/* length this packet (off wire) */
	};

If yes then how can i deduce ts , caplen and len from these hex
values.

Regards
Mukesh Tiwari
On Oct 12, 8:49 pm, "malcolm.wallace" <malcolm.wall... at me.com> wrote:
> On 12 Oct, 2011,at 04:39 PM, mukesh tiwari <mukeshtiwari.ii... at gmail.com> wrote:
>
> >  When i run this program . it does not produce any thing and when i press ^C ( CTRL - C ) it produce output.
>
> This is because you use hGetLine, which blocks until it sees either a newline character, or EOF.
>
> Regards,
>     Malcolm
>
> _______________________________________________
> Haskell-Cafe mailing list
> Haskell-C... at haskell.orghttp://www.haskell.org/mailman/listinfo/haskell-cafe



More information about the Haskell-Cafe mailing list