group__wpcapfunc.html

WinPcap V4.01技术手册

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">typedef void(*) <a class="el" href="group__wpcapfunc.html#gc429cf4f27205111259ff7b02a82eeab">pcap_handler</a>(u_char *user, const struct <a class="el" href="structpcap__pkthdr.html">pcap_pkthdr</a> *pkt_header, const u_char *pkt_data)          </td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Prototype of the callback function that receives the packets. 
<p>
When <a class="el" href="group__wpcapfunc.html#g60ce104cdf28420d3361cd36d15be44c">pcap_dispatch()</a> or <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de">pcap_loop()</a> are called by the user, the packets are passed to the application by means of this callback. user is a user-defined parameter that contains the state of the capture session, it corresponds to the <em>user</em> parameter of <a class="el" href="group__wpcapfunc.html#g60ce104cdf28420d3361cd36d15be44c">pcap_dispatch()</a> and <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de">pcap_loop()</a>. pkt_header is the header associated by the capture driver to the packet. It is NOT a protocol header. pkt_data points to the data of the packet, including the protocol headers. 
<p>
Definition at line <a class="el" href="funcs_2pcap_8h-source.html#l00027">27</a> of file <a class="el" href="funcs_2pcap_8h-source.html">funcs/pcap.h</a>.
</div>
</div><p>
<hr><h2>Function Documentation</h2>
<a class="anchor" name="ge0dc50910fabbd375fab8a1352a6cf33"></a><!-- doxytag: member="funcs/pcap.h::pcap_breakloop" ref="ge0dc50910fabbd375fab8a1352a6cf33" args="(pcap_t *)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">void pcap_breakloop           </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="group__wpcap__def.html#g4711d025f83503ce692efa5e45ec60a7">pcap_t</a> *&nbsp;</td>
          <td class="paramname">          </td>
          <td>&nbsp;)&nbsp;</td>
          <td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
set a flag that will force <a class="el" href="group__wpcapfunc.html#g60ce104cdf28420d3361cd36d15be44c">pcap_dispatch()</a> or <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de">pcap_loop()</a> to return rather than looping. 
<p>
They will return the number of packets that have been processed so far, or -2 if no packets have been processed so far. This routine is safe to use inside a signal handler on UNIX or a console control handler on Windows, as it merely sets a flag that is checked within the loop. The flag is checked in loops reading packets from the OS - a signal by itself will not necessarily terminate those loops - as well as in loops processing a set of packets returned by the OS. Note that if you are catching signals on UNIX systems that support restarting system calls after a signal, and calling <a class="el" href="group__wpcapfunc.html#ge0dc50910fabbd375fab8a1352a6cf33">pcap_breakloop()</a> in the signal handler, you must specify, when catching those signals, that system calls should NOT be restarted by that signal. Otherwise, if the signal interrupted a call reading packets in a live capture, when your signal handler returns after calling <a class="el" href="group__wpcapfunc.html#ge0dc50910fabbd375fab8a1352a6cf33">pcap_breakloop()</a>, the call will be restarted, and the loop will not terminate until more packets arrive and the call completes. <dl class="note" compact><dt><b>Note:</b></dt><dd><a class="el" href="group__wpcapfunc.html#gdf60257f650aaf869671e0a163611fc3">pcap_next()</a> will, on some platforms, loop reading packets from the OS; that loop will not necessarily be terminated by a signal, so <a class="el" href="group__wpcapfunc.html#ge0dc50910fabbd375fab8a1352a6cf33">pcap_breakloop()</a> should be used to terminate packet processing even if <a class="el" href="group__wpcapfunc.html#gdf60257f650aaf869671e0a163611fc3">pcap_next()</a> is being used. <a class="el" href="group__wpcapfunc.html#ge0dc50910fabbd375fab8a1352a6cf33">pcap_breakloop()</a> does not guarantee that no further packets will be processed by <a class="el" href="group__wpcapfunc.html#g60ce104cdf28420d3361cd36d15be44c">pcap_dispatch()</a> or <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de">pcap_loop()</a> after it is called; at most one more packet might be processed. If -2 is returned from <a class="el" href="group__wpcapfunc.html#g60ce104cdf28420d3361cd36d15be44c">pcap_dispatch()</a> or <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de">pcap_loop()</a>, the flag is cleared, so a subsequent call will resume reading packets. If a positive number is returned, the flag is not cleared, so a subsequent call will return -2 and clear the flag. </dd></dl>

</div>
</div><p>
<a class="anchor" name="ga45a5e1a4ba9925bb3586dcbeec78560"></a><!-- doxytag: member="funcs/pcap.h::pcap_close" ref="ga45a5e1a4ba9925bb3586dcbeec78560" args="(pcap_t *p)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">void pcap_close           </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="group__wpcap__def.html#g4711d025f83503ce692efa5e45ec60a7">pcap_t</a> *&nbsp;</td>
          <td class="paramname"> <em>p</em>          </td>
          <td>&nbsp;)&nbsp;</td>
          <td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
close the files associated with p and deallocates resources. 
<p>
<dl class="see" compact><dt><b>See also:</b></dt><dd><a class="el" href="group__wpcapfunc.html#gae6abe06e15c87b803f69773822beca8">pcap_open_live()</a>, <a class="el" href="group__wpcapfunc.html#g91078168a13de8848df2b7b83d1f5b69">pcap_open_offline()</a>, <a class="el" href="group__wpcapfunc.html#g6445eeb76f2757b9fa088b276eea2845">pcap_open_dead()</a> </dd></dl>

</div>
</div><p>
<a class="anchor" name="g363bdc6f6b39b4979ddcf15ecb830c5c"></a><!-- doxytag: member="funcs/pcap.h::pcap_compile" ref="g363bdc6f6b39b4979ddcf15ecb830c5c" args="(pcap_t *p, struct bpf_program *fp, char *str, int optimize, bpf_u_int32 netmask)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">int pcap_compile           </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="group__wpcap__def.html#g4711d025f83503ce692efa5e45ec60a7">pcap_t</a> *&nbsp;</td>
          <td class="paramname"> <em>p</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">struct bpf_program *&nbsp;</td>
          <td class="paramname"> <em>fp</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">char *&nbsp;</td>
          <td class="paramname"> <em>str</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">int&nbsp;</td>
          <td class="paramname"> <em>optimize</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="group__wpcap__def.html#g37fdbc8313e90fb2041203a2e40cd482">bpf_u_int32</a>&nbsp;</td>
          <td class="paramname"> <em>netmask</em></td><td>&nbsp;</td>
        </tr>
        <tr>
          <td></td>
          <td>)</td>
          <td></td><td></td><td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Compile a packet filter, converting an high level filtering expression (see <a class="el" href="group__language.html">Filtering expression syntax</a>) in a program that can be interpreted by the kernel-level filtering engine. 
<p>
<a class="el" href="group__wpcapfunc.html#g363bdc6f6b39b4979ddcf15ecb830c5c">pcap_compile()</a> is used to compile the string str into a filter program. program is a pointer to a bpf_program struct and is filled in by <a class="el" href="group__wpcapfunc.html#g363bdc6f6b39b4979ddcf15ecb830c5c">pcap_compile()</a>. optimize controls whether optimization on the resulting code is performed. netmask specifies the IPv4 netmask of the network on which packets are being captured; it is used only when checking for IPv4 broadcast addresses in the filter program. If the netmask of the network on which packets are being captured isn't known to the program, or if packets are being captured on the Linux "any" pseudo-interface that can capture on more than one network, a value of 0 can be supplied; tests for IPv4 broadcast addreses won't be done correctly, but all other tests in the filter program will be OK. A return of -1 indicates an error in which case <a class="el" href="group__wpcapfunc.html#g81305cb154e4497e95bbb9b708631a3a">pcap_geterr()</a> may be used to display the error text.<p>