Pcat is a utility which concatenates several libpcap (tcpdump) files into one.
f933c3a300b9e61426387c45f2ebabcc1ef48caf708a04bb6ff007d1343dfc30
/* inspired by delta-sys
* written by maetrics
* moral support by deathcubek and wigginx
* GomiSquad (c) 2001
*
* gcc -O -Wall -o pcat pcat.c -lpcap
*
* basically this concatonates pcap files
* pcat pcap_file1 pcap_file2 pcap_file3 ... pcap_fileN > pcap_newfile
*
* warning: if not redirected, output will be displayed on the terminal
* in raw binary. This can corrupt the display in the same way the
* "cat /dev/urandom" will.
*/
#include <stdio.h>
#include <pcap.h>
#include <stdlib.h>
#include <net/bpf.h>
int pcap_io(char *, char *);
/* main()
* visibility: public
* arguments: <int> number of arguments, <char **> pointer array of arguments
* calls:
* pcap.h: pcap_dump_close(), pcap_dump_open(), pcap_file(),
* pcap_open_dead()
* stdio.h: fflush(), fprintf()
* stdlib.h: exit()
* returns: <int> exit status: (0) success, (-1) argument failure,
* (-2) file error, (-3) other
*
* outline:
* open a dummy device to create an important pointer
* open standard out as the save file
* loop through arguments
* -pass each argument to a helper function
* close all files and exit
*/
int main(int argc, char **argv) {
int i=0;
int linktype=DLT_EN10MB;
int snaplen=1514;
char *fname="-";
char *user=NULL;
pcap_t *p=NULL;
pcap_dumper_t *pd=NULL;
if(argc < 2) {
fprintf(stderr, "args\n");
exit(-1);
}
p=pcap_open_dead(linktype, snaplen);
if(p == NULL) {
fprintf(stderr, "open dead\n");
exit(-2);
}
pd=pcap_dump_open(p, fname);
user=(char *)pd;
if(pd == NULL) {
fprintf(stderr, "dump open\n");
exit(-2);
}
fflush(pcap_file(p));
for(i=1; i < argc; i++) {
if(!pcap_io(argv[i], user)) {
exit(-3);
}
fflush(pcap_file(p));
}
pcap_dump_close(pd);
pcap_close(p);
exit(0);
}
/* pcap_io()
* visibility: private
* arguments: <char> input file name, <char> output FILE pointer (pcap kludge)
* calls:
* pcap.h: pcap_close(), pcap_dump(), pcap_loop(), pcap_open_offline()
* stdio.h: fprintf()
* returns: <int> boolean exit status: (0) failure, (1) success
*
* outline:
* open input file
* read each packet from input file
* write each packet to output file
* close input file
*/
int pcap_io(char *fname, char *user) {
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *p=NULL;
int cnt=-1;
pcap_handler callback=pcap_dump;
p=pcap_open_offline(fname, errbuf);
if(p == NULL) {
fprintf(stderr, "open_offline: %s\n", fname);
fprintf(stderr, "errbuf: %s\n", errbuf);
return 0;
}
pcap_loop(p, cnt, callback, user);
pcap_close(p);
return 1;
}