Getting header information from existing Pcap file (offline)

1 reply [Last post]
elisus
Offline
Joined: 05/20/2010

Hi,
I am new to jNetPcap and I am trying to read an existing Pcap file and do the following:

1) "Parse" the different protocol headers (IP, UDP, RTP) and extract the information to store it in another variable. I have seen the NextEx example and it has helped me with this. However, I still have some issues with the RTP header. Depending on the Pcap file I provide, the "packet.hasHeader(rtp)" will return false even if there really is an RTP header present. Any ideas of how I can fix this or bypass this error? The reason I need the RTP is because I want its payload (in fact I only want RTP packets from the Pcap file). If there's another way to get the payload from such a packet and store it as a string, that would be perfect for me.

2) I want to store the IP, UDP and RTP headers as a (hex) string in their original form. For example:
45b800c8660b00007e112d3ec00a58e7c00a62e7520c296800b443f98000497f000d32209b470000ffffffffff...

My problem is that the JHeader.toString() method gives this information with TOO MUCH detail. Is there a simpler method that I can use to only get the header as a simple string?

Thanks for your help

Mark Bednarczyk
Mark Bednarczyk's picture
Offline
Joined: 03/22/2008
1) UDP port#s alone do not

1) UDP port#s alone do not guarantee that a RTP header is within the packet. RTP packets are often fragmented into multiple UDP packets. So only the first UDP packet will contain the header, the other fragments have to be Ip4 reassembled.

jNetPcap analyzer which does reassemble fragments, is buggy and deprecated, and I would not advise you to use it at this time.

2) You can build your own string by using header's accessor methods and String.format("", ...).

Sly Technologies, Inc.
R&D

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.