Good day! The problem is this: there is a pcap_t * variable that points to the first byte of the piece of memory where the .pcap file was placed after it was opened. I want to process this traffic and install a filter on it, everything is successful. Only then it is impossible to return to the initial traffic in the program, because a filter is installed on it and in general it is already processed by a loop (the processing function did not drop). The question is how in the function (see readDnsPacket), where the filter itself is installed, throw a copy of the traffic, not the original. This is necessary in order to continue to have the opportunity to work with the original in the program. PS: close and reopen the pcap does not offer))) sorry that I explain so dreary! here is a partial code:

pcap_t* traffic; if ((traffic = pcap_open_offline(path, nullptr)) == nullptr) { std::cout << "Error open traffic file! \n"; system("pause"); return 0; } readDnsPacket(traffic); 

Function readDnsPacket:

 inline void readDnsPacket(pcap_t* traffic) { struct bpf_program fp; char *str = "udp and src port 53"; //filter for dns-response pcap_compile(traffic, &fp, str, 1, 0xffffff); pcap_setfilter(traffic, &fp); pcap_loop(traffic, 0, PacketHandler, nullptr); } 
  • I don't know what pcap is, but maybe you just need to make a copy of the data on this pointer into some other buffer? std :: copy, memcpy - StrangeOwl
  • It is unlikely that memcpy will help here. pcap_t is an alias for a struct pcap , and I have not found a description of this structure. You can, of course, copy this structure through memcpy, but there will most likely still be different pointers to other structures or arrays. We'll have to copy them all. Therefore, having no experience with pcap, I can only offer to re-read the file. - maestro
  • Again, I don’t understand the features of pcap at all, but maybe this link will help you a little, they are trying to solve a similar problem on stackoverflow.com/questions/15499206/… - StrangeOwl
  • Packages are copied there, pointers to them at least u_char. Yes, and it is possible to find out the packet size by header, and then how to find out how many bytes need to be copied? .. - Se.Pro

0