/* inspired by delta-sys * written by maetrics * moral support by deathcubek and wigginx * GomiSquad (c) 2001 * * gcc -O -Wall -o pcat pcat.c -lpcap * * basically this concatonates pcap files * pcat pcap_file1 pcap_file2 pcap_file3 ... pcap_fileN > pcap_newfile * * warning: if not redirected, output will be displayed on the terminal * in raw binary. This can corrupt the display in the same way the * "cat /dev/urandom" will. */ #include #include #include #include int pcap_io(char *, char *); /* main() * visibility: public * arguments: number of arguments, pointer array of arguments * calls: * pcap.h: pcap_dump_close(), pcap_dump_open(), pcap_file(), * pcap_open_dead() * stdio.h: fflush(), fprintf() * stdlib.h: exit() * returns: exit status: (0) success, (-1) argument failure, * (-2) file error, (-3) other * * outline: * open a dummy device to create an important pointer * open standard out as the save file * loop through arguments * -pass each argument to a helper function * close all files and exit */ int main(int argc, char **argv) { int i=0; int linktype=DLT_EN10MB; int snaplen=1514; char *fname="-"; char *user=NULL; pcap_t *p=NULL; pcap_dumper_t *pd=NULL; if(argc < 2) { fprintf(stderr, "args\n"); exit(-1); } p=pcap_open_dead(linktype, snaplen); if(p == NULL) { fprintf(stderr, "open dead\n"); exit(-2); } pd=pcap_dump_open(p, fname); user=(char *)pd; if(pd == NULL) { fprintf(stderr, "dump open\n"); exit(-2); } fflush(pcap_file(p)); for(i=1; i < argc; i++) { if(!pcap_io(argv[i], user)) { exit(-3); } fflush(pcap_file(p)); } pcap_dump_close(pd); pcap_close(p); exit(0); } /* pcap_io() * visibility: private * arguments: input file name, output FILE pointer (pcap kludge) * calls: * pcap.h: pcap_close(), pcap_dump(), pcap_loop(), pcap_open_offline() * stdio.h: fprintf() * returns: boolean exit status: (0) failure, (1) success * * outline: * open input file * read each packet from input file * write each packet to output file * close input file */ int pcap_io(char *fname, char *user) { char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *p=NULL; int cnt=-1; pcap_handler callback=pcap_dump; p=pcap_open_offline(fname, errbuf); if(p == NULL) { fprintf(stderr, "open_offline: %s\n", fname); fprintf(stderr, "errbuf: %s\n", errbuf); return 0; } pcap_loop(p, cnt, callback, user); pcap_close(p); return 1; }