title: Manual packet generation using <pcap.h>
body: <p>Lets say we have an XML file with packet information</p>
  
  <pre><code>&lt;packet&gt; 
      &lt;frame_type&gt;Ethernet&lt;/frame_type&gt; 
      &lt;local_mac_address&gt;00-21-85-11-29-1b&lt;/local_mac_address&gt; 
      &lt;remote_mac_address&gt;ff-ff-ff-ff-ff&lt;/remote_mac_address&gt; 
      &lt;protocol&gt;IP&lt;/protocol&gt; 
      &lt;version&gt;4&lt;/version&gt; 
      &lt;local_address&gt;147.175.106.141&lt;/local_address&gt; 
      &lt;remote_address&gt;255.255.255.255&lt;/remote_address&gt; 
      &lt;protocol_type&gt;UDP&lt;/protocol_type&gt; 
      &lt;protocol&gt;UDP&lt;/protocol&gt; 
      &lt;local_port&gt;17500&lt;/local_port&gt; 
      &lt;remote_port&gt;17500&lt;/remote_port&gt; 
      &lt;service_name&gt;&lt;/service_name&gt; 
      &lt;packets&gt;8&lt;/packets&gt; 
  &lt;/packet&gt;
  </code></pre>
  
  <p>I can parse this easy with pugiXML or some other XML parser.</p>
  
  <p>What is the approach to generate such packet using pure C++ (get the packet information in the right order) and save it in to a file that is readable by wireshark using function declared in pcap.h?</p>
  
  <pre><code>pcap_dump(dumpfile, header, pkt_data);
  </code></pre>
  
  <p><code>u_char *dumpfile, const struct pcap_pkthdr *header, const u_char *pkt_data;</code></p>
  
  <p>How am I suppose to <strong>fill <code>pkt_data</code> and <code>header</code> using pure C++?</strong></p>
  
  <pre><code>struct pcap_pkthdr {
      struct timeval ts;  /* time stamp */
      bpf_u_int32 caplen; /* length of portion present */
      bpf_u_int32 len;    /* length this packet (off wire) */
  };
  </code></pre>
  
  <p>Is there an example of data I am supposed to set in to <code>ts</code>, <code>caplen</code>, <code>len</code>?</p>
  
  <hr>
  
  <p><strong>EDIT</strong></p>
  
  <p>So after a while of googling I found out this <a href="https://stackoverflow.com/questions/7309773/c-writing-structs-to-a-file-pcap">thread</a> on SO.</p>
  
  <p>So I am using those structs to fill my Ethernet -> IP -> TCP packet as following</p>
  
  <p>I am not familiar with types like uint16_t, uint8_t etc.</p>
  
  <pre><code>pcap_hdr_t pcaphdr;
  
  pcaphdr.magic_number = 0xd4c3b2a1; //0xa1b2c3d4 || 0xd4c3b2a1 &lt;- i am on winwows (Little endian)
  pcaphdr.sigfigs = 0;
  pcaphdr.version_major = 2;
  pcaphdr.version_minor = 4;
  pcaphdr.snaplen = 65536;
  pcaphdr.thiszone = 0;
  pcaphdr.network = DLT_EN10MB;
  
  ethernet_hdr_t ethernethdr;
  
  ethernethdr.dst = ??; // I have no clue how to fill this either ...dst[0] = 0xFF? type is uint8_t.
  ethernethdr.src = ??;//same as above
  ethernethdr.type = 2048; //? //(I want to use IP = 0x800), it is uint16_t
  
  //and for IP
  
  ip_hdr_t ipp;
  
  ipp.ip_dst = parseIPV4string(ipAddressString); //this function converts string into uint32_t 
  ipp.ip_src = parseIPV4string(ipAddressString);
  ipp.ip_v = 4; //version
  ipp.ip_hl = 20; //header length
  ipp.ip_id = 12758; //id whatever id
  ipp.ip_ttl = 125; //time to live
  ipp.ip_p = 6; //protocol 6 = TCP 
  ipp.ip_off = 0; 
  ipp.ip_tos = 0;
  
  //and save all this by 
  
  FILE *ptr_myfile;
  ptr_myfile=fopen("test.pcap", "wb");
  if (!ptr_myfile)
  {
      printf("Unable to open file!");
      return 1;
  }
  
  fwrite(&amp;pcaphdr, 1, sizeof(pcap_hdr_t), ptr_myfile);
  fwrite(&amp;ethernethdr, 1, sizeof(ethernet_hdr_t), ptr_myfile);
  fwrite(&amp;ipp, 1, sizeof(ip_hdr_t), ptr_myfile);
  fclose(ptr_myfile);
  </code></pre>
  
  <p>I am not looking to create packet with payload (data), I am trying to approach pure packet without its data + inspect this packet in wireshark.</p>