We can read destination, port and other header data once we receive a packet, can we read payload in hex too, or do we have methods that can return payload in string or byte[] too?
With jNetPcap you can slice and dice any part of the packet. You can get the data as a byte[] if you'd like and use FormatUtils to convert that byte[] to hex string, if you'd like. You can work directly with JBuffer, ByteBuffer or byte[].
There is a special builtin header type called "Payload". You use it just like anyother header. Its always the last header in the packet and it contains all of the remainder of the packet's data. The part that wasn't decoded.
Payload payload = new Payload(); Packet packet = //... packet from somewhere payload = packet.getPayload(payload); byte[] ba = payload.getByteArray(0, payload.size());
Hope that helps.
Just wanted to post an update to this, in the next dev release, every header has a method JHeader.getPayload():byte[] which returns the payload. You also have JHeader.getPayloadOffset():int and JHeader.getPayloadLength() which can be used to read the payload data directly out of the packet buffer. Remember PcapPacket extends JBuffer. So for example to read the an integer out the payload of a tcp packet you could also do the following:
PcapPacket packet = ...; // From somewhere
Tcp tcp = new Tcp():
if (packet.hasHeader(tcp)) {
int first = packet.getInt(tcp.getPayloadOffset()); // This is actually a JBuffer method
}