[Winpcap-users] modify and save packets

[Guy Harris]

sebastien wrote:

> But to  open the output file, the function pcap_open_offline needs a 
> parameter of type   pcap_t *
> So is it the result of the pcap_open_offline() used to open the input 
> file?

It would be, in your case, the result of the pcap_open_offline() used to 
open the input file.

It could also be the result of pcap_open_live() or pcap_open_dead() or 
pcap_open().

> It is strange to use the input file to open the output file!

Yes.  The link-layer type and snapshot length of the output file are 
normally the same as those of the input file; the way those are supplied 
when opening an output file is through the pcap_t * of the input file.

It is not one of the better-designed parts of the libpcap/WinPcap API.