SlideShare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our User Agreement and Privacy Policy.
SlideShare uses cookies to improve functionality and performance, and to provide you with relevant advertising. If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.
Successfully reported this slideshow.
Activate your 14 day free trial to unlock unlimited reading.
7.
pcap ファイルの構造
2015/3/27 ネットワーク パケットを読む会 (仮) 7
pcap_file_header
pcap_pkthdr
packet data
pcap_pkthdr
packet data
pcap_pkthdr
packet data
………
~
8.
pcap_file_header
bpf_u_int32 magic
u_short
version_major
Libpcap major version.
u_short
version_minor
Libpcap minor version.
bpf_int32
thiszone
gmt to local correction
bpf_u_int32
sigfigs
accuracy of timestamps
bpf_u_int32
snaplen
max length saved portion of each pkt
bpf_u_int32
linktype
data link type (LINKTYPE_*)
2015/3/27 ネットワーク パケットを読む会 (仮) 8
9.
pcap_pkthdr
2015/3/27 ネットワーク パケットを読む会 (仮) 9
struct timeval
ts
time stamp
bpf_u_int32
caplen
length of portion present
bpf_u_int32
len
length this packet (off wire)