PcapDotNet and Datalink type

Question

I'm trying to manipulate some network captures (pcap format) using Pcap.net. I'm opening the pcap file and creating the dumper with:

OfflinePacketDevice selectedDevice = new OfflinePacketDevice(pcapInFile);
using (PacketCommunicator PcapReader = selectedDevice.Open(655360, PacketDeviceOpenAttributes.Promiscuous, 1000))
{
    PacketDumpFile PcapWriter = PcapReader.OpenDump(pcapOutFile);
    PcapReader.ReceivePackets(count, PacketDispatcher);
}

And the PacketDispatcher would be something like:

private void PacketDispatcher(Packet packet)
{
    // Manipulate the packet
    PcapWriter.Dump(packet);
}

Everything is ok as far as the pcapInFile Datalink is ethernet type. But i have several captures without ethernet layer (rawip) and i have to build a new ethernet layer. In this kind of caps the datalink type is the same as the pcapInFile (raw ip) and i want to change it to ethernet...

If i store all the manipulated packets in a ienumerable and dump them with:

PacketDumpFile.Dump(pcapOutFile, new PcapDataLink(1), Packets.Count(), Packets);

It works fine... But, this is not very useful if you are dealing with files of several gigas...

Any idea? Thanks!

Answer 1

Well, despite this is not an answer but a workaround, and since nobody wrote a better solution this is how a fixed it:

Use SharPcap instead of PcapDotNet, then you can declare a reader and a writer this way:

public CaptureFileReaderDevice PcapReader;
public CaptureFileWriterDevice PcapWriter;

PcapReader = new CaptureFileReaderDevice(fileIn);
PcapReader.OnPacketArrival += packetDispatcher;
PcapReader.Capture();

In the packetDispatcher function:

RawCapture raw = new RawCapture(LinkLayers.Ethernet, e.Packet.Timeval,RebuildNullLinkLayer(e, offset));
CaptureHandler.PcapWriter.Write(raw);

And in the RebuildNullLinkLayer function you can add the ethernet layer, modify whatever you want, etc...

Note that when you call the RawCapture Constructor you can choose the Link Layer (mi original issue with Pcap.Net...), so if you are parsing a RawIp capture, you can convert the packets to Ethernet.