如何在数据包捕获中从每个数据包中剥离 n 个字节？
我有许多 pcap 格式的数据包捕获。每个数据包都包含一条消息，我有解析器，但每个数据包前面都有 4 个字节。这意味着解析器将无法理解该格式。
无论如何，我是否可以破坏这些捕获，使它们从另一端出来并剥离掉这 4 个字节？
I have a number of packet captures in pcap format. Each packet contains a message for which I have dissector however each packet has 4 bytes prepended to it. This means the dissector will not understand the format.
Is there anyway for me to mangle these captures such that they come out the other end with those 4 bytes stripped off?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您将需要编辑至少一个解剖器才能完成您想要的操作。最好的办法是编写一个解析器来处理 B 协议插入的标头，C 协议解析器需要注册该标头。这为您带来了额外的好处，即能够检查 B 协议标头中的信息并过滤其字段。
但是，如果您确实不想这样做，您可以修改 A 协议或 C 协议解析器以忽略这四个字节：在 A 中，您不会在给定的
tvb中包含这些字节到C；或者在 C 中，您将跳过 tvb 中的前四个字节。You will need to edit at least one dissector to do what you want. The best thing to do is to write a dissector that will handle the header inserted by your B protocol, against which the C protocol dissector would need to register. This gives you the added benefit of being able to examine information in the header of the B protocol and filter on its fields.
However, if you really don't want to do that, you could modify either the A protocol or C protocol dissector to ignore those four bytes: in A, you would not include those bytes in the
tvbgiven to C; or in C you would skip the first four bytes in thetvb.谷歌：“男人埃迪卡”
Google: "man edicap"