[Winpcap-users] Is there any way to get packet size in bytes from.pcap files

[Gianluca Varenni]

After reading the message again, I think I misinterpreted your mail...

You want a table like

TCP size=102
UDP size=213
.....

You can probably do that by using windump (and some level of verbose 
output, -v -vv -vvv), and some awk scripting (or another scripting language) 
to parse each line of output and strip only the protocol type and packet 
size. Otherwise, I'm pretty sure you can have the same result with tethereal 
(command line version of ethereal), in this case I suggest you to ask the 
ethereal-users mailing list. Finally, you can create a small winpcap based 
app to read the capture file and print the information you want.

Hope it helps
GV




----- Original Message ----- 
From: <jaykishan_garach at yahoo.com>
To: <winpcap-users at winpcap.org>
Sent: Thursday, May 25, 2006 5:23 AM
Subject: [Winpcap-users] Is there any way to get packet size in bytes 
from.pcap files


> Hello all,
>
>     For each packet of .pcap file, I need to know the
> size in bytes. Is there a way to find it out.
>
>     I knew of this Windump tool, but I want to give a
> .pcap file as input to this windump.exe and the output
> desired is packet type (UDP, RTP) and size of each
> packet.
>
>     Any suggestions which results into this output
> will be helpful.
>
> Regards,
> Jaykishan.
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users