Search code examples
network-programmingwinpcap

extracting packet from frame winpcap


I am using winpcap in order to sniff network traffic.

Is there a way to extract the packet from the frame (ie getting layer 3 and up without layer 2) if I don't know which layer 2 protocol is used on the network?


Solution

  • No. WinPcap delivers layer 2 (data link layer) packets, so you have to look at the layer 2 header, if necessary, to determine what layer 3 (network layer) protocol is being used, and then extract the layer 3 packet.

    However, pcap_datalink() will tell you what layer 2 protocol is being used, so there will not be a case where you don't know which layer 2 protocol is being used on the network. See the list of pcap link-layer type values; compare the the value returned by pcap_datalink() with the DLT_ values mentioned in that page.