Any way of reading from existing .pcap file?

[rafaelsilva81]

The following doesn't work:

import fs from 'fs';
import * as pcap from 'pcap';

// get the file test.pcap in a buffer
var raw_packet = fs.readFileSync('./src/test.pcap');

var packet = pcap.decode.packet(raw_packet);

console.log(packet);

Since some typings are incomplete, I assumed pcap.decode.packet() received a Buffer object, but it apparently expects something else. I don't have enough knowledge of working with binaries in node, so if anyone can help find a solution it would be appreciated.

[TincaTibo]

Hi

The process is quite simple, as described in documentation

1. Open an offline session: pcap.createOfflineSession('/path/to/capture.pcap', options);
2. Listen for 'packet' events and decode them: Listening for packets
3. 'complete' event is sent when file is finished parsing

No need to bother with binary parsing, decode.packet does it for you :)

Thibaut

[rafaelsilva81]

That is awesome, thank you for the quick response and I apologize for not reading through the documentation. I ended up not noticing this part.

Thanks again 👍