Wireshark/PCAP：從已知十六進制封包資料手工構建 PCAP 檔案完整流程

應用場景

已知單一封包的原始十六進制/二進制資料（含乙太網頭到 Payload），需產生標準 `.pcap` 檔案供 Wireshark 分析。

PCAP 檔案結構速覽

Global Header (24 bytes)
Packet Header 1 (16 bytes)  →  ts_sec, ts_usec, caplen, len
Packet Data 1   (caplen bytes)
Packet Header 2 ...
Packet Data 2 ...

關鍵欄位設定

C/C++ 使用 libpcap 產生範例

#include 

int main() {
    const char *hex = "FFFFFFFFFFFF00112233445500AABBCCDDEEFF08004500..."; // 你的十六進制字串
    size_t hex_len = strlen(hex);
    size_t bin_len = hex_len / 2;
    u_char *bin = malloc(bin_len);
    for (size_t i = 0; i < bin_len; ++i) {
        sscanf(hex + 2*i, "%2hhx", &bin[i]);
    }

    // 1. 開啟離線儲存器
    pcap_t *pd = pcap_open_dead(DLT_EN10MB, 65535);
    pcap_dumper_t *dumper = pcap_dump_open(pd, "manual.pcap");

    // 2. 填寫封包頭
    struct pcap_pkthdr hdr = {0};
    hdr.ts.tv_sec = 0;
    hdr.ts.tv_usec = 0;
    hdr.caplen = bin_len;
    hdr.len = bin_len;

    // 3. 寫入封包
    pcap_dump((u_char*)dumper, &hdr, bin);

    // 4. 關閉
    pcap_dump_close(dumper);
    pcap_close(pd);
    free(bin);
    return 0;
}

Python 純標準庫實作（無需 libpcap）

import struct, binascii

hex_data = "FFFFFFFFFFFF00112233445500AABBCCDDEEFF08004500..."
bin_data = binascii.unhexlify(hex_data)

with open("manual.pcap", "wb") as f:
    # Global Header: little-endian
    f.write(struct.pack('