Void process_packet(u_char *,const struct pcap_pkthdr *, const u_char *) The function find_retransmissions is where the packet is analyzed. This is an MRE that reads a pcap file and analyzes the TCP packets sent over IPv4. What I actually want to achieve is, to do on a basic level, what the filter does in wireshark. After searching extensively the web, I've concluded that in order to so, I need to track the traffic behaviour and this means also analyzing previously received packets. I want to be able to deduce whether a TCP packet I parsed is a TCP retransmission or not. I can parse the packets one by one and analyze them up to a point. I've written a simple source file that can read pcap files using the libpcap library in C.
0 kommentar(er)
