Accessing pcap file header - c

Is there any function for retrieving the pcap file header or is it done manually(type casting)?

What information are you trying to retrieve from the file header?
You can get the major and minor version with pcap_major_version() and pcap_minor_version(), the snapshot length with pcap_snapshot(), and the link-layer type with pcap_datalink(). There is no guarantee that the time zone offset and time stamp accuracy are valid (libpcap sets both to 0). Note also that libpcap 1.1.0 and later can read pcap-ng files, which don't have a pcap file header.
Libpcap provides no routines to directly hand you the file header, and does not supply anything that you could typecast to be a file header, so you can't do this with libpcap. If you want to read the file header, you will have to write your own code to replace libpcap, and that code will not be able to handle, for example, pcap-ng files (which will be the default file type in the next release of Wireshark), unlike code that uses libpcap (which can read pcap-ng files, as long as all the network interfaces in the pcap-ng file have the same link-layer header type and snapshot length, when they're using libpcap 1.1.0 or later).

The pcap file header is handled by libpcap internally. You shouldn't have to manipulate it manually.
You can open a pcap file for writing using pcap_dump_open.
You can open a pcap file for reading using pcap_open_offline.

Related

Supporting multiple MIME types in a simple HTTP server

I'm programming a simple HTTP server in C. So far, my server only supports text/html. I'm trying to add more functionalities to it by supporting additional MIME types (more precisely: text /css, text/javascript, image/jpg, image/png, font/woff2). For html files, I simply used fseek() and ftell() to determine the size of the file and read(), write() to read the file into a buffer and send it to the client. Now, I have the following questions:
1.Can I treat js, css, and woff2 files the exact same as html files (figuring size, reading, and sending)?
2.For binary files (images), what differences am I expected to make? Can I still use fseek() and ftell() to determine the size? Let's say I used fread(), can I use the return value as the file length? Is fwrite() really better than write() for binary files? Do I have to encode the image file before sending (I checked the RFC but I can't find any definite answer)? Should I include the "Content-Transfer-Encoding", or is it optional?
Do I have to encode the image file before sending (I checked the RFC but I can't find any definite answer)? Should I include the "Content-Transfer-Encoding", or is it optional?
No you don't need any encoding, and, FWIW, there is no Content-Transfer-Encoding field in HTTP.

Is dnotify obsolete in kernel 4.x?

Im reading the fcntl manual page and came across thw dnotify:
File and directory change notification (dnotify)
It is suggested that new application should use inotify instead, but I think they are not the same since inotify works with char * paths making it suffering from file renaming (or cathing MOVED_FROM/MOVED_TO events) but dnotify works with file descriptors which is different:
int fcntl(int fd, int cmd, ... /* arg */ );
So as far as I can tell dnotify is not a subset of inotify neither vice versa.
Is it discouraged to use dnotify in newer kernel even if I want to subscribe on events by file descriptor, not by a file path as inotify allows?
If you read the manual page for inotify_add_watch closer, then yes it takes a path but it returns a "watch descriptor"
for the filesystem object (inode) that corresponds to pathname
So the path is only used to locate the inode. Once that's done you have a reference to the inode and the name of the file can be changed without problems.

Decompressing Snappy Files Missing Stream Identifier Chunk and CRC-32C Checksum

The iWork 2013 file format includes .iwa (iWork Archive) files stored within a .zip file. "IWA files are stored in Snappy's framing format, though they do not adhere rigorously to the spec. In particular, they do not include the required Stream Identifier chunk, and compressed chunks do not include a CRC-32C checksum." https://github.com/obriensp/iWorkFileFormat/blob/master/Docs/index.md#iwa
Is there an implementation of Snappy that can decompress files missing these components? If so, is there example code?
Examples of iWork files may be found at the bottom of this page: http://fileformats.archiveteam.org/wiki/IWA. For instance, unzipping file TestReport.pages.zip shows that it contains Index.zip, which contains .iwa files.
I tried decompressing the .iwa files using the Snappy for Windows command line tool here: http://snappy.angeloflogic.com/downloads/ . However, I received the error: "Found invalid data while decoding."
I do not yet have sample code because I do not know which implementation of Snappy I should base my code on.

Audio file format that can be written without seeking

I want to write audio data to stdout, preferably using libsndfile. When I output WAV to /dev/stdout I manage to write the header, but then I get an error
Error : could not open file : /dev/stdout
System error : Illegal seek.
I assume this is related to http://www.mega-nerd.com/libsndfile/FAQ.html#Q017, some file formats cannot be written without seeks. However, when I try to output SF_FORMAT_AU | SF_FORMAT_PCM_16 instead, I still get the same Illegal seek error.
Are there any audio file formats that can be written completely without seeking?
I'm using Linux.
EDIT: It might be obvious, but RAW format works (without seeking). Unfortunately I need a format that has meta information like sample rate.
You should finish reading that FAQ... the link you give us has all the answers.
However, there is at least one file format (AU) which is specifically designed to be written to a pipe.
So use AU instead of WAV.
Also make sure that you open the SNDFILE object with sf_open_fd, and not sf_open_virtual (or sf_open):
SNDFILE* sf_open_fd (int fd, int mode, SF_INFO *sfinfo, int close_desc) ;
SNDFILE* sf_open_virtual (SF_VIRTUAL_IO *sfvirtual, int mode, SF_INFO *sfinfo,
void *user_data) ;
If you use sf_open_fd, then libsndfile will use fstat to determine whether the file descriptor is a pipe or a regular file. If you use sf_open_virtual or sf_open, it will assume that the file is seekable. This appears to be a flaw in libsndfile, but you should be using sf_open_fd anyway.
Footnote: Don't open /dev/stdout to get standard output; it is already open and there is no need to open it again. Use file descriptor STDOUT_FILENO.
Ended outputting an "infinite" wav header, and then writing raw PCM data for as long as the audio lasts. Not really valid, but most players seem to understand anyway.
The wav header is here, in case anyone wants it: https://gist.github.com/1428176
You could write to a temp file (perhaps in /tmp), let the libsnd seek to modify the .wav(RIFF) header of the temp file, and then, after libsnd has closed the file, stream the temp file out to stdout.

In gzip library, what's the difference between 'uncompress' and 'gzopen'?

There are some functions to decompress in zlib library (zlib version 1.2.3)
I want to decompress my source zip (.gz) file using uncompress function.
It is not working (error code -3) but gzopen is. It is still not working when I input payload pointer (passing gzip header) to uncompress.
So the question is:
What's the valid arguments for uncompress function?
If it needs different format, how can I make it?
You have to use some poorly documented features of the zlib library. See my answer to this question for more information: How can I decompress a gzip stream with zlib?

Resources