<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">pcap-ng-format folks,<div class=""><br class=""></div><div class="">I’m pleased to announce two open source Swift resources related to .pcapng files.</div><div class=""><br class=""></div><div class="">PackageSwiftPcapng parses .pcap and .pcapng files. <a href="https://github.com/darrellroot/PackageSwiftPcapng" class="">https://github.com/darrellroot/PackageSwiftPcapng</a> It successfully handles all test cases at <a href="https://github.com/hadrielk/pcapng-test-generator" class="">https://github.com/hadrielk/pcapng-test-generator</a> except test202 (which I think has an error, I opened an issue).</div><div class=""><br class=""></div><div class="">PcapngPrint uses PackageSwiftPcapng to print out .pcapng file structures for diagnostic purposes. <a href="https://github.com/darrellroot/PcapngPrint" class="">https://github.com/darrellroot/PcapngPrint</a> (sample output below)</div><div class=""><br class=""></div><div class="">I’ve updated <a href="https://github.com/pcapng/pcapng/wiki/Implementations" class="">https://github.com/pcapng/pcapng/wiki/Implementations</a> to show the new Swift library.</div><div class=""><br class=""></div><div class="">PackageSwiftPcapng is used by “Etherdump”, “Etherdump Lite”, and “etherdump-CLI”, which are my new Swift/SwiftUI packet capture and analysis applications (admission: these applications output in .pcap format, not .pcapng format, but can import in either format).</div><div class=""><br class=""></div><div class="">Darrell Root</div><div class=""><a href="mailto:feedback@networkmom.net" class="">feedback@networkmom.net</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">% ./PcapngPrint ~/test/e.pcapng</div><div class="">File /Users/droot/test/e.pcapng Format: pcapng</div><div class="">PcapngPrint: info PcapngShb options data count 100</div><div class="">PcapngPrint: info code 1 length 21 startIndex 24</div><div class="">PcapngPrint: info PcapngOption.init code 1 length 21 data 21 bytes</div><div class="">PcapngPrint: info code 2 length 7 startIndex 0</div><div class="">PcapngPrint: info PcapngOption.init code 2 length 7 data 7 bytes</div><div class="">PcapngPrint: info code 3 length 14 startIndex 0</div><div class="">PcapngPrint: info PcapngOption.init code 3 length 14 data 14 bytes</div><div class="">PcapngPrint: info code 4 length 32 startIndex 0</div><div class="">PcapngPrint: info PcapngOption.init code 4 length 32 data 32 bytes</div><div class="">PcapngPrint: info code 0 length 0 startIndex 0</div><div class="">PcapngPrint: info PcapngOption.init code 0 length 0 data 0 bytes</div><div class="">PcapngPrint: info PcapngShg blockType 0xa0d0d0a blockTotalLength 128 byteOrderMagic 0x1a2b3c4d majorVersion 1 minorVersion 0 sectionLength -1 options.count 5</div><div class=""> interfaces.count 0 interfaceStatistics 0 nameResolutions 0 packetBlocks.count 0 customBlocks 0 comment section header block</div><div class=""> hardware x86_64</div><div class=""> os Darwin 19.3.0</div><div class=""> userappl tcpdump (libpcap version 1.9.1)</div><div class=""> endofopt</div><div class=""><br class=""></div><div class="">PcapngPrint: info PcapngIdb options data count 12</div><div class="">PcapngPrint: info code 2 length 4 startIndex 16</div><div class="">PcapngPrint: info PcapngOption.init code 2 length 4 data 4 bytes</div><div class="">PcapngPrint: info code 0 length 0 startIndex 0</div><div class="">PcapngPrint: info PcapngOption.init code 0 length 0 data 0 bytes</div><div class="">PcapngPrint: info PcapngIdb blockType 0x1 blockLength 32 linkType 1 snaplen 40000 options.count 2</div><div class=""> name en0</div><div class="">) endofopt</div><div class="">)</div><div class="">PcapngPrint: info PcapngEpb options data count 20</div><div class="">PcapngPrint: info code 2 length 4 startIndex 204</div><div class="">PcapngPrint: info PcapngOption.init code 2 length 4 data 4 bytes</div><div class=""><br class=""></div>(output continues…)</div><div class=""><br class="Apple-interchange-newline"><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>