WIP wireshark dissector

3 files changed, 57 insertions, 0 deletions

diff --git a/experiments/pcap/.gitignore b/experiments/pcap/.gitignore
new file mode 100644
index 0000000..be0cff0
--- /dev/null
+++ b/experiments/pcap/.gitignore
@@ -0,0 +1,2 @@
+main
+*.pcap
diff --git a/experiments/pcap/main.c b/experiments/pcap/main.c
new file mode 100644
index 0000000..25fb0fc
--- /dev/null
+++ b/experiments/pcap/main.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <pcap/pcap.h>
+
+pcap_dumper_t* dumper;
+
+ssize_t test_write(uint8_t* buf, size_t count) {
+	struct pcap_pkthdr packet;
+	packet.len = count;
+	packet.caplen = count;
+	pcap_dump((u_char*) dumper, &packet, buf);
+
+	return count;
+}
+
+ssize_t test_read(uint8_t* buf, size_t count) {
+	strncpy((char*) buf, "i read hello world!", count);
+
+	struct pcap_pkthdr packet;
+	packet.len = count;
+	packet.caplen = count;
+	pcap_dump((u_char*) dumper, &packet, buf);
+
+	return count;
+}
+
+void test() {
+	ssize_t len;
+	const char* msg = "i write hello world!";
+
+	len = test_write((uint8_t*) msg, strlen(msg));
+	printf("wrote %lu bytes: \"%s\"\n", len, msg);
+
+	char buf[80] = { 0 };
+	len = test_read((uint8_t*) buf, 16);
+	buf[len] = '\0';
+	printf("read %lu bytes: \"%s\"\n", len, buf);
+}
+
+int main() {
+	// see also: <https://www.tcpdump.org/linktypes.html>
+	pcap_t* handle = pcap_open_dead(DLT_NULL, 1 << 16);
+  dumper = pcap_dump_open(handle, "dump.pcap");
+
+	test();
+
+	pcap_dump_close(dumper);
+
+	return 0;
+}
+
diff --git a/experiments/pcap/makefile b/experiments/pcap/makefile
new file mode 100644
index 0000000..53c3aea
--- /dev/null
+++ b/experiments/pcap/makefile
@@ -0,0 +1,2 @@
+CFLAGS += -lpcap
+main: main.c