group__wpcap__tut7.html

Winpcap是一个强大的网络开发库

{
<a class="code" href="group__wpcap__def.html#g4711d025f83503ce692efa5e45ec60a7" title="Descriptor of an open capture instance. This structure is opaque to the user, that...">pcap_t</a> *fp;
<span class="keywordtype">char</span> errbuf[<a class="code" href="group__wpcap__def.html#gcd448353957d92c98fccc29e1fc8d927" title="Size to use when allocating the buffer that contains the libpcap errors.">PCAP_ERRBUF_SIZE</a>];
<span class="keywordtype">char</span> source[<a class="code" href="group__remote__struct.html#gcacb155b596f7511f714de129ae32c97" title="Defines the maximum buffer size in which address, port, interface names are kept...">PCAP_BUF_SIZE</a>];

    <span class="keywordflow">if</span>(argc != 2){

        printf(<span class="stringliteral">"usage: %s filename"</span>, argv[0]);
        <span class="keywordflow">return</span> -1;

    }

    <span class="comment">/* Create the source string according to the new WinPcap syntax */</span>
    <span class="keywordflow">if</span> ( <a class="code" href="group__wpcapfunc.html#ga3111e10f930a9772a32a922b26948b0" title="Accept a set of strings (host name, port, ...), and it returns the complete source...">pcap_createsrcstr</a>( source,         <span class="comment">// variable that will keep the source string</span>
                            <a class="code" href="group__remote__source__ID.html#g9188ad0fc0d12fc51d1e9f5e78bf9440" title="Internal representation of the type of source in use (file, remote/local interface)...">PCAP_SRC_FILE</a>,  <span class="comment">// we want to open a file</span>
                            NULL,           <span class="comment">// remote host</span>
                            NULL,           <span class="comment">// port on the remote host</span>
                            argv[1],        <span class="comment">// name of the file we want to open</span>
                            errbuf          <span class="comment">// error buffer</span>
                            ) != 0)
    {
        fprintf(stderr,<span class="stringliteral">"\nError creating a source string\n"</span>);
        <span class="keywordflow">return</span> -1;
    }
    
    <span class="comment">/* Open the capture file */</span>
    <span class="keywordflow">if</span> ( (fp= <a class="code" href="group__wpcapfunc.html#g2b64c7b6490090d1d37088794f1f1791" title="Open a generic source in order to capture / send (WinPcap only) traffic.">pcap_open</a>(source,         <span class="comment">// name of the device</span>
                        65536,          <span class="comment">// portion of the packet to capture</span>
                                        <span class="comment">// 65536 guarantees that the whole packet will be captured on all the link layers</span>
                         <a class="code" href="group__remote__open__flags.html#g9134ce51a9a6a7d497c3dee5affdc3b9" title="Defines if the adapter has to go in promiscuous mode.">PCAP_OPENFLAG_PROMISCUOUS</a>,     <span class="comment">// promiscuous mode</span>
                         1000,              <span class="comment">// read timeout</span>
                         NULL,              <span class="comment">// authentication on the remote machine</span>
                         errbuf         <span class="comment">// error buffer</span>
                         ) ) == NULL)
    {
        fprintf(stderr,<span class="stringliteral">"\nUnable to open the file %s.\n"</span>, source);
        <span class="keywordflow">return</span> -1;
    }

    <span class="comment">// read and dispatch packets until EOF is reached</span>
    <a class="code" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop</a>(fp, 0, dispatcher_handler, NULL);

    <span class="keywordflow">return</span> 0;
}



<span class="keywordtype">void</span> dispatcher_handler(u_char *temp1, 
                        <span class="keyword">const</span> <span class="keyword">struct</span> <a class="code" href="structpcap__pkthdr.html" title="Header of a packet in the dump file.">pcap_pkthdr</a> *header, <span class="keyword">const</span> u_char *pkt_data)
{
    u_int i=0;

    <span class="comment">/*</span>
<span class="comment">     * Unused variable</span>
<span class="comment">     */</span>
    (VOID)temp1;

    <span class="comment">/* print pkt timestamp and pkt len */</span>
    printf(<span class="stringliteral">"%ld:%ld (%ld)\n"</span>, header-&gt;<a class="code" href="structpcap__pkthdr.html#21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_sec, header-&gt;<a class="code" href="structpcap__pkthdr.html#21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_usec, header-&gt;<a class="code" href="structpcap__pkthdr.html#728f264db4f5cc304742565a2bcdbeea" title="length this packet (off wire)">len</a>);          
    
    <span class="comment">/* Print the packet */</span>
    <span class="keywordflow">for</span> (i=1; (i &lt; header-&gt;<a class="code" href="structpcap__pkthdr.html#ac5771ed2efd92508bb4fe650f2ce7d7" title="length of portion present">caplen</a> + 1 ) ; i++)
    {
        printf(<span class="stringliteral">"%.2x "</span>, pkt_data[i-1]);
        <span class="keywordflow">if</span> ( (i % LINE_LEN) == 0) printf(<span class="stringliteral">"\n"</span>);
    }
    
    printf(<span class="stringliteral">"\n\n"</span>);     
    
}
</pre></div><p>
The following example has the same purpose of the last one, but <a class="el" href="group__wpcapfunc.html#g439439c2eae61161dc1efb1e03a81133" title="Read a packet from an interface or from an offline capture.">pcap_next_ex()</a> is used instead of the <a class="el" href="group__wpcapfunc.html#g6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop()</a> callback method.<p>
<div class="fragment"><pre class="fragment"><span class="preprocessor">#include &lt;stdio.h&gt;</span>
<span class="preprocessor">#include &lt;pcap.h&gt;</span>

<span class="preprocessor">#define LINE_LEN 16</span>
<span class="preprocessor"></span>
<span class="keywordtype">int</span> main(<span class="keywordtype">int</span> argc, <span class="keywordtype">char</span> **argv)
{
<a class="code" href="group__wpcap__def.html#g4711d025f83503ce692efa5e45ec60a7" title="Descriptor of an open capture instance. This structure is opaque to the user, that...">pcap_t</a> *fp;
<span class="keywordtype">char</span> errbuf[<a class="code" href="group__wpcap__def.html#gcd448353957d92c98fccc29e1fc8d927" title="Size to use when allocating the buffer that contains the libpcap errors.">PCAP_ERRBUF_SIZE</a>];
<span class="keywordtype">char</span> source[<a class="code" href="group__remote__struct.html#gcacb155b596f7511f714de129ae32c97" title="Defines the maximum buffer size in which address, port, interface names are kept...">PCAP_BUF_SIZE</a>];
<span class="keyword">struct </span><a class="code" href="structpcap__pkthdr.html" title="Header of a packet in the dump file.">pcap_pkthdr</a> *header;
<span class="keyword">const</span> u_char *pkt_data;
u_int i=0;
<span class="keywordtype">int</span> res;

    <span class="keywordflow">if</span>(argc != 2)
    {
        printf(<span class="stringliteral">"usage: %s filename"</span>, argv[0]);
        <span class="keywordflow">return</span> -1;
    }
    
    <span class="comment">/* Create the source string according to the new WinPcap syntax */</span>
    <span class="keywordflow">if</span> ( <a class="code" href="group__wpcapfunc.html#ga3111e10f930a9772a32a922b26948b0" title="Accept a set of strings (host name, port, ...), and it returns the complete source...">pcap_createsrcstr</a>( source,         <span class="comment">// variable that will keep the source string</span>
                            <a class="code" href="group__remote__source__ID.html#g9188ad0fc0d12fc51d1e9f5e78bf9440" title="Internal representation of the type of source in use (file, remote/local interface)...">PCAP_SRC_FILE</a>,  <span class="comment">// we want to open a file</span>
                            NULL,           <span class="comment">// remote host</span>
                            NULL,           <span class="comment">// port on the remote host</span>
                            argv[1],        <span class="comment">// name of the file we want to open</span>
                            errbuf          <span class="comment">// error buffer</span>
                            ) != 0)
    {
        fprintf(stderr,<span class="stringliteral">"\nError creating a source string\n"</span>);
        <span class="keywordflow">return</span> -1;
    }
    
    <span class="comment">/* Open the capture file */</span>
    <span class="keywordflow">if</span> ( (fp= <a class="code" href="group__wpcapfunc.html#g2b64c7b6490090d1d37088794f1f1791" title="Open a generic source in order to capture / send (WinPcap only) traffic.">pcap_open</a>(source,         <span class="comment">// name of the device</span>
                        65536,          <span class="comment">// portion of the packet to capture</span>
                                        <span class="comment">// 65536 guarantees that the whole packet will be captured on all the link layers</span>
                         <a class="code" href="group__remote__open__flags.html#g9134ce51a9a6a7d497c3dee5affdc3b9" title="Defines if the adapter has to go in promiscuous mode.">PCAP_OPENFLAG_PROMISCUOUS</a>,     <span class="comment">// promiscuous mode</span>
                         1000,              <span class="comment">// read timeout</span>
                         NULL,              <span class="comment">// authentication on the remote machine</span>
                         errbuf         <span class="comment">// error buffer</span>
                         ) ) == NULL)
    {
        fprintf(stderr,<span class="stringliteral">"\nUnable to open the file %s.\n"</span>, source);
        <span class="keywordflow">return</span> -1;
    }
    
    <span class="comment">/* Retrieve the packets from the file */</span>
    <span class="keywordflow">while</span>((res = <a class="code" href="group__wpcapfunc.html#g439439c2eae61161dc1efb1e03a81133" title="Read a packet from an interface or from an offline capture.">pcap_next_ex</a>( fp, &amp;header, &amp;pkt_data)) &gt;= 0)
    {
        <span class="comment">/* print pkt timestamp and pkt len */</span>
        printf(<span class="stringliteral">"%ld:%ld (%ld)\n"</span>, header-&gt;<a class="code" href="structpcap__pkthdr.html#21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_sec, header-&gt;<a class="code" href="structpcap__pkthdr.html#21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_usec, header-&gt;<a class="code" href="structpcap__pkthdr.html#728f264db4f5cc304742565a2bcdbeea" title="length this packet (off wire)">len</a>);          
        
        <span class="comment">/* Print the packet */</span>
        <span class="keywordflow">for</span> (i=1; (i &lt; header-&gt;<a class="code" href="structpcap__pkthdr.html#ac5771ed2efd92508bb4fe650f2ce7d7" title="length of portion present">caplen</a> + 1 ) ; i++)
        {
            printf(<span class="stringliteral">"%.2x "</span>, pkt_data[i-1]);
            <span class="keywordflow">if</span> ( (i % LINE_LEN) == 0) printf(<span class="stringliteral">"\n"</span>);
        }
        
        printf(<span class="stringliteral">"\n\n"</span>);     
    }
    
    
    <span class="keywordflow">if</span> (res == -1)
    {
        printf(<span class="stringliteral">"Error reading the packets: %s\n"</span>, <a class="code" href="group__wpcapfunc.html#g81305cb154e4497e95bbb9b708631a3a" title="return the error text pertaining to the last pcap library error.">pcap_geterr</a>(fp));
    }
    
    <span class="keywordflow">return</span> 0;
}

</pre></div><p>