yet another pcap question

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

my server has very old perl 5.005 (and upgrade is not an option). and I wish to go through number of pcap file. I tried to manually install Net::Pcap w/ no success.
Next thing I am wondering about is, is there way for me to peek into the individual *.cap file and see what it contains?

Here are my main problem
1)I have looked at cap file with wireshark but do not understand where each packet starts and end. Trying to see if I can just byte count(if i can tell where each packet starts and stops) till specifics of each payload(UDP for example).
2)Can you just read first 100k of cap file and save it to another name? meaning will it retain valid cap format and just less of it(say if original file was 1Mb).
3)can someone give me a good pointer or link where binary file is well explained?
thank you so much

Comment on yet another pcap question

Replies are listed 'Best First'.
Re: yet another pcap question by jethro (Monsignor) on Feb 09, 2010 at 11:56 UTC
I assume that you have at least libpcap installed, since wireshark works with it. You might use pcap_open_offline() and pcap_dispatch() in a small c program that dumps the packages one by one to stdout (and use BCD coding so you can read that line by line from perl). information about the pcap library can be found in wikipedia http://en.wikipedia.org/wiki/Pcap and from there in http://www.tcpdump.org/pcap3_man.html Just a guess: if you download the libpcap sources, you also might find information about the data format of the pcap files there	[reply]
Re: yet another pcap question by mykl (Monk) on Feb 09, 2010 at 14:06 UTC
I don't know whether this will be applicable to your case, but I've just been analysing some pcap files, and I found the easiest method to be to use Wireshark to export the files as PDML (XML packet detail) and use an XML module to read these. This has the benefit of including all the packet analysis data that Wireshark generates, although PSML may be better if you don't need this. -- "Any sufficiently analyzed magic is indistinguishable from science" - Agatha Heterodyne	[reply]
Re^2: yet another pcap question by Anonymous Monk on Feb 09, 2010 at 15:46 UTC
hi guys, thanks for the replies I will try your suggestions.. but i am guessing raw inspection of pcap file by just pure perl is not recommended(hard to do? stupid to do? impossible to do? counterproductive to do? all of the above?)	[reply]
Re^3: yet another pcap question by jethro (Monsignor) on Feb 09, 2010 at 22:35 UTC
None of the above. It is just more convenient to either use a library (that is already nice, shiny and debugged) or some already preprocessed data (which the PDML mykl talked about probably is. Also might be safer to parse because of added redundancy. And there are lots of XML parsers ready to use). Parsing binary data is not really hard, but the program tends to be a bit more unreadable and cryptic than a text parser because you have to use constants like '\x02'	[reply]