winpcap | Pull requests | Runtime Evironment library

In general, that information cannot be derived purely from the pcap file.

IP, TCP, and UDP headers have addresses and port numbers, but they don't have anything indicating the application from which they're sent or to which they're being received.

That information would have to be determined on the machine running the application; the way that's done depends on the operating system.

Do you know how to create empty file pcap with winpcap dll? I buffer filtered packets in program memory and want to save when user click to export to .pcap file.

...

So how to get pcap_t handle pointer for pcap_dump_open(pcap_t *p, const char *fname) this way?

pcap_dump_open() returns a pcap_dumper_t * handle for use when writing the file; a pcap_t * is used for capturing or reading, not writing.

What you need to do, if you want to write a pcap file, is use pcap_dump_open(). If you have a pcap_t * from which you're reading or capturing the filtered packets, you should use that pcap_t * in the call to pcap_dump_open().

Short answer: You can't.

The long answer comes from some old wisdom in a WinPcap mailing list:

There is a way to make packet.dll and wpcap.dll static: rebuild them as such. You just sacrifice the ability to do anything, since all the stuff in wpcap.dll requires packet.dll, and all the stuff in packet.dll requires the kernel driver. And the kernel driver won't exist without the full winpcap installation.

It includes (among other things) a kernel driver that cannot be transformed to a static library.

There is no way on Windows to make a kernel driver part of a static library. (Or a DLL, for that matter.) If the kernel driver is required, then it's hard to get anything done without it.

I was able to compile this by moving the SDK folders from C:\WdpPack to my C:\User folder. I am not so familiar with Windows, so I am not sure why this works, maybe something to do with permissions?

Update:

After running perl Makefile.PL, running gmake to compile the module fails with errors:

Your interface is not called eth0 if you are using Windows.

You can use ipconfig /all to see all your network interfaces, and you can use the description value of the Ethernet interface as the interface name for Scapy. So for example in my laptop it is: