title: Extracting packet informations using C++
body: <p>I have been messing with Wireshark for a while, and I wonder if anyone could help me. I have recorded a random browsing with it, and I saved it to a pcap file. I would like to create a C/<strong>C++</strong> program (I know many exist, but I want to practise) that extracts every info from the packets, like source and target IP, port used, data, etc. My finish goal in learning is to extract an image or a Youtube video or anything from the stream (I know, I'll have to group the packets and sort them, etc.), but that's a later project I guess. :) </p>
  
  <p>I am using libpcap (on Linux), and my code so far can read the offline file packet by packet, and - since I know they are PPP packets in my case - if I load a self defined structure with the info from the 20th byte of the packet, I can view the mac addresses and the ip addresses.</p>
  
  <p>My problems:</p>
  
  <p>1) How do I know/determine without Wireshark that what kind of data link type, is used? (Ethernet, WiFi, PPP, etc)</p>
  
  <p>2) How do I read further data of packets? If I just read one byte, my program doesn't do <em>anything</em>, every variable gets empty.</p>
  
  <p>I have a ppphdr struct, which contains:</p>
  
  <pre><code>u_int16_t htype;
  u_int16_t ptype;
  u_char hplen;
  u_char plen;
  u_int16_t oper;
  u_char sha[6];
  u_char spa[4];
  u_char tha[6];
  u_char tpa[4];
  </code></pre>
  
  <p>And I call this for every packet:</p>
  
  <pre><code>pppheader = (struct ppphdr*)(packet+20);
  </code></pre>
  
  <p>Because the ppp frame starts from the 20th byte. It gives back sender and target mac and IP address.</p>
  
  <p>After I continue reading the next few bytes, with the same call just different struct, it comes back empty, and the program stops after 1 packet. I'm trying to use this guide: <a href="http://www.tcpipguide.com/free/t_PPPGeneralFrameFormat.htm" rel="nofollow">http://www.tcpipguide.com/free/t_PPPGeneralFrameFormat.htm</a></p>