cybersecurity · intermediate · ~15 min · safe pentest lab

pcap captured length

Read a little-endian field at a fixed offset.

Challenge

A pcap record header is four little-endian 32-bit fields: ts_sec, ts_usec, incl_len, orig_len. Implement unsigned pcap_incl_len(const unsigned char *rec) returning incl_len (the LE32 at offset 8).

Starter code

unsigned pcap_incl_len(const unsigned char *rec) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.