PCAP-NG File Reader

Reads PCAP Next Generation files and generates CLR objects from its data. Implemented according to the draft specification at http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html.

  

Usage

using (var reader = new Reader("myfile.pcapng"))
{
   BlockBase block;
   while ((block = reader.ReadBlock()) != null)
   {
      // Act on received block. It's cast will be BlockBase 
      // but its true underlying type will be any of BlockBase's
      // children.
   }

   reader.Reset();

   // Which is equivalent to.
   foreach (var readBlock in reader.AllBlocks)
   {
      // ...
   }
}

Or if you just want a particular block type.

using (var reader = new Reader("myfile.pcapng"))
{
   foreach (var block in reader.EnhancedPacketBlocks)
   {
      // Act on received block of type EnhancedPacketBlock.
   }
}

Install NuGet Package

PM> Install-Package PcapngFile 

Additional Information

See my blog post for more information.