How to write PCAP capture file header?

Question

Without using libpcap, I am trying to write a log file that adheres to the pcap ( format ) file format . This file must be readable through WireShark. So far I have written this in C ++:

struct pcapFileHeader { uint32_t magic_number; /* magic number */ uint16_t version_major; /* major version number */ uint16_t version_minor; /* minor version number */ int16_t thiszone; /* GMT to local correction */ uint32_t sigfigs; /* accuracy of timestamps */ uint32_t snaplen; /* max length of captured packets, in octets */ uint32_t network; /* data link type */ }; ofstream fileout; fileout.open("file.pcap", ios::trunc); pcapFileHeader fileHeader; fileHeader.magic_number = 0xa1b2c3d4; fileHeader.version_major = 2; fileHeader.version_minor = 4; fileHeader.thiszone = 0; fileHeader.sigfigs = 0; fileHeader.snaplen = 65535; //(2^16) fileHeader.network = 1; //Ethernet fileout << fileHeader.magic_number << fileHeader.version_major << fileHeader.version_minor << fileHeader.thiszone << fileHeader.sigfigs << fileHeader.snaplen << fileHeader.network; fileout.close(); 

So this should make the capture file empty, but when I open it in Wireshark, I am greeted:

The "hello.pcap" file seems to have been interrupted in the middle of the package or other data.

I tried to open the output file in binary mode, but that did not help. I would post this on the WireShark forum, but I think this is a user error, and not something wrong with WireShark.

Help would be greatly appreciated.

Answer 1

<< writes numbers formatted as text (for example, the five-character string "65535" instead of four bytes representing this number).

To display binary data, open the file using ios::binary and use write . This statement will write the entire header:

 fileout.write(reinterpret_cast<const char*>(&fileHeader), sizeof fileHeader); 

The context is detected by the reader, so it is carried over if there is no padding between the structure elements.

Note that thiszone must be int32_t .