-5

Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.

closed as unclear what you're asking by Sven Oct 18 '18 at 19:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Built in to what? And 4 octets isn't even enough to store a single packet. You should be looking at larger sizes. – Michael Hampton Oct 18 '18 at 13:48
  • 1
    The application is relevant, because that's the most obvious place to actually slice the pcap data, while it's being generated. And you really do not want to slice the data into four byte chunks. – Michael Hampton Oct 18 '18 at 14:05
  • 2
    Can you improve your question or can't you? That's the only thing that matters ... – Sven Oct 18 '18 at 19:20
  • 2
    Closing this as you are unwilling or unable to clearly explain what your problem is, although multiple persons have made you aware that this isn't as obvious as you believe it to be. – Sven Oct 18 '18 at 19:46
  • 2
    The problem is that you have not clearly explained what you want, despite multiple people asking you to clarify it. Instead you have been exceptionally hostile to everyone who has attempted to understand your problem and help you solve it, and you have absolutely refused to explain what you are trying to do. There's nothing else we can do unless and until you decide to actually allow us to help you. – Michael Hampton Oct 18 '18 at 20:41
3

You can split a file into multiple files of whatever size you like using the split command. Here is an example where I split a previously created pcap file into 4 byte chunks:

/tmp/wat$ ls -l
total 4
-rw-r--r-- 1 kasperd kasperd 116 Oct 18 18:19 wat.pcap
/tmp/wat$ split -b4 wat.pcap
/tmp/wat$ ls -l
total 120
-rw-r--r-- 1 kasperd kasperd 116 Oct 18 18:19 wat.pcap
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaa
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xab
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xac
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xad
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xae
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaf
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xag
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xah
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xai
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaj
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xak
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xal
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xam
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xan
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xao
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xap
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaq
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xar
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xas
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xat
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xau
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xav
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaw
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xax
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xay
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaz
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xba
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xbb
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xbc
/tmp/wat$ cat x* | sha224sum - wat.pcap
14c450277299f320535d369fc5f1044f96725b0afcfec0b9840bb717  -
14c450277299f320535d369fc5f1044f96725b0afcfec0b9840bb717  wat.pcap
/tmp/wat$ 

As you can see even a tiny pcap file will produce a lot of files when split into such small chunks. So be careful when using this on a file system which isn't optimized for many small files.

  • -1. I'm not looking to generate more pcap files, rather I want to parse the pcap file in place – pcapmaniac Oct 18 '18 at 19:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.