I have been looking at generation pcap-files myself, from application log-files. (I figured that Wireshark would be a good tool for analyzing how network traffic has bounced around in the system.)
However, the believed simple task seems hard. I have the network data (SIP-data in my case). I should then wrap this data with IP+UDP header and also the pcap-headers. This seemed easy, but somehow I just fail. When I open the pcap in Wireshark all headers are just mushed.
If I give up, is there a library I can use to do the writing of pcap files?
(All libraries I have find seem to focus on captioning from device to file. I dont have a device here…)
There is a managed library called SharpPcap, which is a wrapper around libpcap, to interface with pcap files. Using that library you should be cable of both reading and ‘capturing’ packets. The classes/functions of interest would be
CaptureFileWriterDevice and perform SendPacket or alternatively Write operations for each packet you want to record.