Has anyone properly interpreted HTTP request based on this demo of winpcap?
- by httpinterpret
The example is here, and I tried it by changing the filter to tcp and dst port 80 and the following:
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
....
ip_len = (ih->ver_ihl & 0xf) * 4;
tcp_len = (((u_char*)ih)[ip_len + 12] >> 4) * 4;
tcpPayload = (u_char*)ih + ip_len +…