C++ pcap_create函数代码示例

int main(int argc, char **argv) {
    char errbuf[PCAP_ERRBUF_SIZE];
    struct pcap_pkthdr *pkthdr;
    const u_char *pkt_data;

    Options options;

    parse_args(argc, argv, &options);

    if(options.list_devices) {
        show_devices();
        exit(0);
    }

    // Create Handles for in and out
    pcap_t *in_handle = pcap_create(argv[1], errbuf);
    pcap_t *out_handle = pcap_create(argv[1], errbuf);

    if(!in_handle | !out_handle )
        exit_error(errbuf, -1);
    
    int result = 0;

    // Set timeout
    result = pcap_set_timeout(in_handle, 1); // Header size up to window size
    result = pcap_set_timeout(out_handle, 1); // Header size up to window size
    handle_pcap_errors(in_handle, result, "set_timeout");
    handle_pcap_errors(out_handle, result, "set_timeout");



    // Activate!
    result = pcap_activate(out_handle);
    result = pcap_activate(in_handle);
    handle_pcap_errors(out_handle, result, "pcap_activate");
    handle_pcap_errors(in_handle, result, "pcap_activate");
    // Set Filter
    filter_on_port(out_handle, "src port ", options.port_str);
    filter_on_port(in_handle, "dst port ", options.port_str);


    // Count packet lenghts on port
    int out_byte_count = 0;
    int in_byte_count = 0;

    for(int i = 0; i < 100; i++) {
        pcap_next_ex(out_handle, &pkthdr, &pkt_data);
        out_byte_count += pkthdr->len;

        pcap_next_ex(in_handle, &pkthdr, &pkt_data);
        in_byte_count += pkthdr->len;
    }

    printf("In Bytes: %d\n", in_byte_count);
    printf("Out Bytes: %d\n", out_byte_count);

    return 0;
}

/* Initializes pcap capture settings and returns a pcap handle on success, NULL on error */
pcap_t *capture_init(char *capture_source) {
    pcap_t *handle = NULL;
    char errbuf[PCAP_ERRBUF_SIZE] = {0};

#ifdef __APPLE__
    // must disassociate from any current AP.  This is the only way.
    pid_t pid = fork();
    if (!pid) {
        char* argv[] = {"/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport", "-z", NULL};
        execve("/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport", argv, NULL);
    }
    int status;
    waitpid(pid, &status, 0);


    handle = pcap_create(capture_source, errbuf);
    if (handle) {
        pcap_set_snaplen(handle, BUFSIZ);
        pcap_set_timeout(handle, 50);
        pcap_set_rfmon(handle, 1);
        pcap_set_promisc(handle, 1);
        int status = pcap_activate(handle);
        if (status)
            cprintf(CRITICAL, "pcap_activate status %d\n", status);
    }
#else
    handle = pcap_open_live(capture_source, BUFSIZ, 1, 0, errbuf);
#endif
    if (!handle) {
        handle = pcap_open_offline(capture_source, errbuf);
    }

    return handle;
}

Sniffer::Sniffer(const string& device, 
                 promisc_type promisc,
                 const string& filter,
                 bool rfmon) {
    SnifferConfiguration configuration;
    configuration.set_promisc_mode(promisc == PROMISC);
    configuration.set_filter(filter);
    configuration.set_rfmon(rfmon);

    char error[PCAP_ERRBUF_SIZE];
    pcap_t* phandle = pcap_create(TINS_PREFIX_INTERFACE(device).c_str(), error);
    if (!phandle) {
        throw runtime_error(error);
    }
    set_pcap_handle(phandle);

    // Set the netmask if we are able to find it.
    bpf_u_int32 ip, if_mask;
    if (pcap_lookupnet(TINS_PREFIX_INTERFACE(device).c_str(), &ip, &if_mask, error) == 0) {
        set_if_mask(if_mask);
    }

    // Configure the sniffer's attributes prior to activation.
    configuration.configure_sniffer_pre_activation(*this);

    // Finally, activate the pcap. In case of error throw runtime_error
    if (pcap_activate(get_pcap_handle()) < 0) {
        throw pcap_error(pcap_geterr(get_pcap_handle()));
    }

    // Configure the sniffer's attributes after activation.
    configuration.configure_sniffer_post_activation(*this);
}

int main (void)
{
    int fd;

    /* Create PCAP file */
    assert((fd = pcap_create(test_path, LINKTYPE_EN10MB)) > 0);

    /* Write payload */
    assert(test_pcap_write(fd, icmp_dns, sizeof(icmp_dns)) == 0);

    assert(pcap_close(fd) == 0);

    assert((fd = pcap_open(test_path, O_RDONLY)) > 0);

    assert(pcap_has_packets(fd));

    assert(pcap_close(fd) == 0);

    assert((fd = pcap_open(test_path, O_RDWR | O_APPEND)) > 0);

    /* Write payload */
    assert(test_pcap_write(fd, icmp_dns, sizeof(icmp_dns)) == 0);

    assert(pcap_close(fd) == 0);

    pcap_destroy(fd, test_path);

    return (EXIT_SUCCESS);
}

static void print_timestamp_types(const char *dev) {
    int i, ntstypes;
    char junk[PCAP_ERRBUF_SIZE];
    int *tstypes;
    pcap_t *handle;

    handle = pcap_create(dev, junk);
    if(!handle)
        return;

    ntstypes = pcap_list_tstamp_types(handle, &tstypes);
    if(ntstypes > 0)
        printf("     Timestamp types:%s", options.verbose > 1 ? "\n" : " ");
    if(options.verbose > 1)
        for(i = 0; i < ntstypes; ++i)
            printf("       %-20s %s\n", pcap_tstamp_type_val_to_name(tstypes[i]),
                   pcap_tstamp_type_val_to_description(tstypes[i]));
    else
        for(i = 0; i < ntstypes; ++i)
            printf("%s%s", pcap_tstamp_type_val_to_name(tstypes[i])
                   , i + 1 > ntstypes ? ", " : "\n");

    pcap_free_tstamp_types(tstypes);
    pcap_close(handle);
}

static pcap_t* open_pcap_dev(const char* ifname, int frameSize, char* errbuf)
{
	pcap_t* handle = pcap_create(ifname, errbuf);
	if (handle) {
		int err;
		err = pcap_set_snaplen(handle, frameSize);
		if (err) AVB_LOGF_WARNING("Cannot set snap len %d", err);

		err = pcap_set_promisc(handle, 1);
		if (err) AVB_LOGF_WARNING("Cannot set promisc %d", err);

		err = pcap_set_immediate_mode(handle, 1);
		if (err) AVB_LOGF_WARNING("Cannot set immediate mode %d", err);

		// we need timeout (here 100ms) otherwise we could block for ever
		err = pcap_set_timeout(handle, 100);
		if (err) AVB_LOGF_WARNING("Cannot set timeout %d", err);

		err = pcap_set_tstamp_precision(handle, PCAP_TSTAMP_PRECISION_NANO);
		if (err) AVB_LOGF_WARNING("Cannot set tstamp nano precision %d", err);

		err = pcap_set_tstamp_type(handle, PCAP_TSTAMP_ADAPTER_UNSYNCED);
		if (err) AVB_LOGF_WARNING("Cannot set tstamp adapter unsynced %d", err);

		err = pcap_activate(handle);
		if (err) AVB_LOGF_WARNING("Cannot activate pcap %d", err);
	}
	return handle;
}

static bool check_promisc(const char *dev) {
    char junk[PCAP_ERRBUF_SIZE];
    int err;
    pcap_t *handle;

    handle = pcap_create(dev, junk);
    if(!handle)
        goto fail;

    err = pcap_set_promisc(handle, 1);
    if(err)
        /* Should never error: pcap_set_promisc() only errors if handle is active. */
        die(0, "DEBUG: Reached unreachable condition at %s:%lu\n", __FILE__, __LINE__);

    err = pcap_activate(handle);
    if(err && err != PCAP_WARNING)
        goto fail;

    pcap_close(handle);
    return true;

fail:
    pcap_close(handle);
    return false;
}

pcap_t *
pcap_open_live_extended(const char *source, int snaplen, int promisc, int to_ms, int rfmon, char *errbuf)
{
    pcap_t *p;
    int status;
    
    p = pcap_create(source, errbuf);
    if (p == NULL)
        return (NULL);
    status = pcap_set_snaplen(p, snaplen);
    if (status < 0)
        goto fail;
    status = pcap_set_promisc(p, promisc);
    if (status < 0)
        goto fail;
    status = pcap_set_timeout(p, to_ms);
    if (status < 0)
        goto fail;
    if(pcap_can_set_rfmon(p) == 1) {
        status = pcap_set_rfmon(p, rfmon);
        if (status < 0)
            goto fail;
    }
    status = pcap_activate(p);
    if (status < 0)
        goto fail;
    return (p);
    
fail:
    snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source, pcap_geterr(p));
    pcap_close(p);
    return (NULL);
}

void capture(char *dev) {
  pcap_t *pcap;
  char errbuf[PCAP_ERRBUF_SIZE];
  struct pcap_pkthdr header;	/* The header that pcap gives us */
  const u_char *packet;		/* The actual packet */

  if(NULL == dev) {
    dev = pcap_lookupdev(errbuf);
    if (dev == NULL) {
      fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
      exit(1);
    }
  }

  pcap = pcap_create(dev, errbuf);
  pcap_set_rfmon(pcap, 1);
  pcap_set_promisc(pcap, 1);
  pcap_set_buffer_size(pcap, 1 * 1024 * 1024);
  pcap_set_timeout(pcap, 1);
  pcap_set_snaplen(pcap, 16384);
  pcap_activate(pcap);    
  if(DLT_IEEE802_11_RADIO == pcap_datalink(pcap)) {
    pcap_loop(pcap, 0, got_packet, 0);
  } else {
    fprintf(stderr, "Could not initialize a IEEE802_11_RADIO packet capture for interface %s\n", dev);
  }
}

static void print_datalinks(const char *dev) {
    int *linktypes;
    int err, i, nlinktypes;
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *handle;

    handle = pcap_create(dev, errbuf);
    if(!handle)
        return;

    err = pcap_activate(handle);
    if(err)
        return;

    nlinktypes = pcap_list_datalinks(handle, &linktypes);
    if(nlinktypes > 0)
        printf("     Linktypes:%s", options.verbose > 1 ? "\n" : " ");
    if(options.verbose > 1)
        for(i = 0; i < nlinktypes; ++i)
            printf("       %-20s %s\n"
                   , pcap_datalink_val_to_name(linktypes[i])
                   , pcap_datalink_val_to_description(linktypes[i]));
    else
        for(i = 0; i < nlinktypes; ++i)
            printf("%s%s", pcap_datalink_val_to_name(linktypes[i])
                   , i + 1 > nlinktypes ? ", " : "\n");

    pcap_free_datalinks(linktypes);
    pcap_close(handle);
}

inline unique_pcap_t create(const std::string &device_name) {
  auto buf = error_buffer{};
  auto device = pcap_create(device_name.data(), buf.data());
  if (!device) {
    throw error{"Couldn't create device " + device_name + "\n" +
                error_string(buf)};
  }
  return unique_pcap_t{device, &pcap_close};
}

static int
tc_pcap_open(pcap_t **pd, char *device, int snap_len, int buf_size)
{
    int    status;
    char   ebuf[PCAP_ERRBUF_SIZE]; 

    *ebuf = '\0';

    *pd = pcap_create(device, ebuf);
    if (*pd == NULL) {
        tc_log_info(LOG_ERR, 0, "pcap create error:%s", ebuf);
        return TC_ERROR;
    }

    status = pcap_set_snaplen(*pd, snap_len);
    if (status != 0) {
        tc_log_info(LOG_ERR, 0, "pcap_set_snaplen error:%s",
                pcap_statustostr(status));
        return TC_ERROR;
    }

    status = pcap_set_promisc(*pd, 0);
    if (status != 0) {
        tc_log_info(LOG_ERR, 0, "pcap_set_promisc error:%s",
                pcap_statustostr(status));
        return TC_ERROR;
    }

    status = pcap_set_timeout(*pd, 1000);
    if (status != 0) {
        tc_log_info(LOG_ERR, 0, "pcap_set_timeout error:%s",
                pcap_statustostr(status));
        return TC_ERROR;
    }

    status = pcap_set_buffer_size(*pd, buf_size);
    if (status != 0) {
        tc_log_info(LOG_ERR, 0, "pcap_set_buffer_size error:%s",
                pcap_statustostr(status));
        return TC_ERROR;
    }

    tc_log_info(LOG_NOTICE, 0, "pcap_set_buffer_size:%d", buf_size);

    status = pcap_activate(*pd);
    if (status < 0) {
        tc_log_info(LOG_ERR, 0, "pcap_activate error:%s",
                pcap_statustostr(status));
        return TC_ERROR;

    } else if (status > 0) {
        tc_log_info(LOG_WARN, 0, "pcap activate warn:%s", 
                pcap_statustostr(status));
    }

    return TC_OK;
}

NetworkInterface::NetworkInterface(const std::string& interface)
  : m_pHandler(NULL), m_pFilter(NULL), m_pThread(NULL), m_sInterface(interface)
{
  m_pHandler = pcap_create(interface.c_str(), m_sLastError);
  if(!m_pHandler) {
    std::cerr << "Can't create pcap handler on " << interface <<
                 " interface! Details: " << m_sLastError << std::endl;
  }
}

void pcap_main_loop(const char* dev) {
    char errbuf[PCAP_ERRBUF_SIZE];
    /* open device for reading in promiscuous mode */
    int promisc = 1;

    bpf_u_int32 maskp; /* subnet mask */
    bpf_u_int32 netp;  /* ip */ 

    logger<< log4cpp::Priority::INFO<<"Start listening on "<<dev;

    /* Get the network address and mask */
    pcap_lookupnet(dev, &netp, &maskp, errbuf);

    descr = pcap_create(dev, errbuf);

    if (descr == NULL) {
        logger<< log4cpp::Priority::ERROR<<"pcap_create was failed with error: "<<errbuf;
        exit(0);
    }

    // Setting up 1MB buffer
    int set_buffer_size_res = pcap_set_buffer_size(descr, pcap_buffer_size_mbytes * 1024 * 1024);
    if (set_buffer_size_res != 0 ) {
        if (set_buffer_size_res == PCAP_ERROR_ACTIVATED) {
            logger<< log4cpp::Priority::ERROR<<"Can't set buffer size because pcap already activated\n";
            exit(1);
        } else {
            logger<< log4cpp::Priority::ERROR<<"Can't set buffer size due to error: "<<set_buffer_size_res;
            exit(1);
        }   
    } 

    if (pcap_set_promisc(descr, promisc) != 0) {
        logger<< log4cpp::Priority::ERROR<<"Can't activate promisc mode for interface: "<<dev;
        exit(1);
    }

    if (pcap_activate(descr) != 0) {
        logger<< log4cpp::Priority::ERROR<<"Call pcap_activate was failed: "<<pcap_geterr(descr);
        exit(1);
    }

    // man pcap-linktype
    int link_layer_header_type = pcap_datalink(descr);

    if (link_layer_header_type == DLT_EN10MB) {
        DATA_SHIFT_VALUE = 14;
    } else if (link_layer_header_type == DLT_LINUX_SLL) {
        DATA_SHIFT_VALUE = 16;
    } else {
        logger<< log4cpp::Priority::INFO<<"We did not support link type:"<<link_layer_header_type;
        exit(0);
    }
   
    pcap_loop(descr, -1, (pcap_handler)parse_packet, NULL);
}

int myPcapCatchAndAnaly() {
    int status=0;
    int header_type;
    char errbuf[PCAP_ERRBUF_SIZE];
    /* openwrt && linux */
    char *dev=(char *)"wlan0";
    /* mac os */
    //test
    // char* dev=(char *)"en0";
    handle=pcap_create(dev,errbuf); //为抓取器打开一个句柄

    if (handle == NULL)  {
        fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
        return 0;
    }

    // 由于在该路由器测试时，发现在该openwrt系统上不支持libpcap设置monitor模式，在激活的时候会产生错误
    // 将采用手动设置并检测网卡是否为monitor模式

    // if(pcap_can_set_rfmon(handle)) {
    //      //查看是否能设置为监控模式
    //     printf("Device %s can be opened in monitor mode\n",dev);
    // }
    // else {
    //     printf("Device %s can't be opened in monitor mode!!!\n",dev);
    // }

    // 若是mac os系统，则可以支持
    // test
    if(pcap_set_rfmon(handle,1)!=0) {
        fprintf(stderr, "Device %s couldn't be opened in monitor mode\n", dev);
        return 0;
    } else {
        printf("Device %s has been opened in monitor mode\n", dev);
    }

    pcap_set_promisc(handle,0);   //不设置混杂模式
    pcap_set_snaplen(handle,65535);   //设置最大捕获包的长度
    status=pcap_activate(handle);   //激活

    if(status!=0) {
        pcap_perror(handle,(char*)"pcap error: ");
        return 0;
    }

    header_type=pcap_datalink(handle);  //返回链路层的类型
    if(header_type!=DLT_IEEE802_11_RADIO) {
        printf("Error: incorrect header type - %d\n",header_type);
        return 0;
    }

    int id = 0;
    pcap_loop(handle, -1, getPacket, (u_char*)&id);

    return 1;
}