Question

I am trying to write a tcp reconstruction program in c# , by using SharpPcap. So far I am doing a pretty good job, and the reconstruction is working fine. My only problem is, that in order to reconstruct big Pcap files by myself, I need to load them by parts/chunks to the memory, because sharppcap only let’s me load the whole file( I think). Any suggestions?

Thanks

Answer 1

The pcap file format is really simple, see here: http://wiki.wireshark.org/FileFormatReference/libpcap

Why not load the file yourself, possibly a packet at a time, and then you can do what you want as you go along rather than having a library dictate your memory usage patterns?