-5

Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
pcapmaniac
  • 1
  • 3
  • 4
    Built in to what? And 4 octets isn't even enough to store a single packet. You should be looking at larger sizes. – Michael Hampton Oct 18 '18 at 13:48
  • The application is not relevant. I want to slice raw pcap data into 4B chunks. Is there a simple way to do that through the pcap/libpcap/similar libraries? – pcapmaniac Oct 18 '18 at 14:03
  • 1
    The application is relevant, because that's the most obvious place to actually slice the pcap data, while it's being generated. And you really do not want to slice the data into four byte chunks. – Michael Hampton Oct 18 '18 at 14:05
  • 1
    Other people would say you don't want to capture the data into four byte chunks. Please update your question with a more realistic value like 4KB chunks, you will be more likely to get an answer :). – bgtvfr Oct 18 '18 at 14:28
  • 1
    I didn't say "capture" in 4B. I said, given a pcap file, I want to serialize the data into 4B chunks. – pcapmaniac Oct 18 '18 at 15:34
  • What do you mean with “serialize” then? – Tommiie Oct 18 '18 at 16:51
  • 2
    Can you improve your question or can't you? That's the only thing that matters ... – Sven Oct 18 '18 at 19:20
  • 2
    Closing this as you are unwilling or unable to clearly explain what your problem is, although multiple persons have made you aware that this isn't as obvious as you believe it to be. – Sven Oct 18 '18 at 19:46
  • Look at the latest comment. Do your research. – pcapmaniac Oct 18 '18 at 20:17
  • 2
    The problem is that you have not clearly explained what you want, despite multiple people asking you to clarify it. Instead you have been exceptionally hostile to everyone who has attempted to understand your problem and help you solve it, and you have absolutely refused to explain what you are trying to do. There's nothing else we can do unless and until you decide to actually allow us to help you. – Michael Hampton Oct 18 '18 at 20:41

1 Answers1

3

You can split a file into multiple files of whatever size you like using the split command. Here is an example where I split a previously created pcap file into 4 byte chunks:

/tmp/wat$ ls -l
total 4
-rw-r--r-- 1 kasperd kasperd 116 Oct 18 18:19 wat.pcap
/tmp/wat$ split -b4 wat.pcap
/tmp/wat$ ls -l
total 120
-rw-r--r-- 1 kasperd kasperd 116 Oct 18 18:19 wat.pcap
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaa
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xab
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xac
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xad
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xae
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaf
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xag
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xah
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xai
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaj
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xak
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xal
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xam
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xan
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xao
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xap
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaq
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xar
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xas
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xat
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xau
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xav
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaw
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xax
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xay
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xaz
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xba
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xbb
-rw-rw-r-- 1 kasperd kasperd   4 Oct 18 18:20 xbc
/tmp/wat$ cat x* | sha224sum - wat.pcap
14c450277299f320535d369fc5f1044f96725b0afcfec0b9840bb717  -
14c450277299f320535d369fc5f1044f96725b0afcfec0b9840bb717  wat.pcap
/tmp/wat$

As you can see even a tiny pcap file will produce a lot of files when split into such small chunks. So be careful when using this on a file system which isn't optimized for many small files.

kasperd
  • 29,894
  • 16
  • 72
  • 122