winpcap抓包�q�用回调函数处理�?

bluemonster — Sat, 21 Aug 2010 10:18:00 GMT

#include "pcap.h"

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

int main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];


    if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
    {
        fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
        exit(1);
    }


    for(d=alldevs; d; d=d->next)
    {
        printf("%d. %s", ++i, d->name);
        if (d->description)
            printf(" (%s)\n", d->description);
        else
            printf(" (No description available)\n");
    }

    if(i==0)
    {
        printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
        return -1;
    }

    printf("Enter the interface number (1-%d):",i);
    scanf_s("%d", &inum);

    if(inum < 1 || inum > i)
    {
        printf("\nInterface number out of range.\n");

        pcap_freealldevs(alldevs);
        return -1;
    }


    for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);


    if ( (adhandle= pcap_open(d->name,          // name of the device
                              65536,            // portion of the packet to capture
                                                // 65536 guarantees that the whole packet will be captured on all the link layers
                              PCAP_OPENFLAG_PROMISCUOUS,    // promiscuous mode
                              1000,             // read timeout
                              NULL,             // authentication on the remote machine
                              errbuf            // error buffer
                              ) ) == NULL)
    {
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);

        pcap_freealldevs(alldevs);
        return -1;
    }

    printf("\nlistening on %s\n", d->description);


    pcap_freealldevs(alldevs);


    pcap_loop(adhandle, 0, packet_handler, NULL);

    return 0;
}

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    struct tm ltime;
    char timestr[16];
    time_t local_tv_sec;


    (VOID)(param);
    (VOID)(pkt_data);


    local_tv_sec = header->ts.tv_sec;
    localtime_s(&ltime, &local_tv_sec);
    strftime( timestr, sizeof timestr, "%H:%M:%S", &ltime);

    printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);

}

�q�里主要是想说明下回调函数的各个参数�Q�顺便讲下pcap_loop

int pcap_loop (

pcap_t * p,

int cnt,

pcap_handler callback,

u_char * user

)

pcap_t�l�构对开发者是不透明的，一般是由pcap_open�q�回�Q�可以认为是抓包的句柄。cnt表示抓到cnt个包后loop�l�束�Q�callback��是处理包的回调函数了。user只是用来描述�q�次抓包�Q�可以置为NULL�Q�如果觉得需要，也可以把抓包的目的啊什么的写上厅R�?/p>

-1 is returned on an error; 0 is returned if cnt is exhausted; -2 is returned if the loop terminated due to a call to pcap_breakloop() before any packets were processed. If your application uses pcap_breakloop(), make sure that you explicitly check for -1 and -2, rather than just checking for a return value < 0.

出错�q�回-1�Q�抓完了cnt个包�q�回0�Q�在处理包之前就调用pcap_breakloop()�l�结loop则返�?2.所有如果调用了pcap_breakloop() �Q�必��L��查返回值是-1�q�是-2�Q�不能来�W�统��查是否小�?.

int pcap_dispatch (

pcap_t * p,

int cnt,

pcap_handler callback,

u_char * user

)

pcap_dispatch和pcap_loop的唯一区别是pcap_dispatch�?x��)因��时而结束（�q�个旉��是在pcap_open里面讄��的）�Q�pcap_loop则不��，一定要抓玩cnt个包

pcap_t* pcap_open  ( const char *  source,
  int  snaplen,
  int  flags,
  int  read_timeout,  //��是�q�个讄��时了，单位是毫�U?br />  struct pcap_rmtauth *  auth,
  char *  errbuf
)

typedef void(* pcap_handler)(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data)

user��是pcap_loop里的u_char*user

pkt_header是winpcap�l�抓到的包附上的��_(d��)��不是IP报文头部、UDP报文头部�{�等协议头部�?/p>

struct pcap_pkthdr {
struct timeval ts;
bpf_u_int32 caplen;
bpf_u_int32 len;
};

pkt_data是抓到的包数据，�q�里包括了协议的头部�?/p>

bluemonster 2010-08-21 18:18 发表评论

欧美日韩国产综合新一区,亚洲三级性片,亚洲欧洲久久

winpcap抓包�q�用回调函数处理�?