Wireshark · Ethereal-dev: Re: [Ethereal-dev] how to parse a ethereal capture file

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Aug 10, 2004 at 06:31:24PM -0700, weijun jiang wrote:
> Can anyone point to me where I can find any document for the file format
> and if there is any library (libpcap?) I can use for my application?

The format is libpcap format, so libpcap/WinPcap can be used to read it
- use "pcap_open_offline()" to open it, and "pcap_loop()",
"pcap_next()", or, in newer versions of libpcap/WinPcap,
"pcap_next_ex()" to read the packet time stamp/length information and
raw packet data.