It would be neat cause then you could wrap the decoding bits in a library that implement the libpcap interface. Then any existing tool like tcpdump/tshark/zeek would just work and it would effectively be a software defined network tap.
It would be neat cause then you could wrap the decoding bits in a library that implement the libpcap interface. Then any existing tool like tcpdump/tshark/zeek would just work and it would effectively be a software defined network tap.
> ... this means we should catch 1-3 UDP packets. > After hunting down a USB key, I ended up with a 191M .wfm file to process.
assuming 3 packets, that's about 64MB of raw data per ethernet frame. The tshark output shows a 82 byte frame. That works out to 818400:1 overhead. Close to 1MB of .wfm data per 1 byte of packet data.
I suppose you could do some processing or compression closer to the input, but then you're just building a nic at that point.
Surprisingly cool going from raw IQ/analog data to ethernet frames much like the op has written.