C++ pcap_dump_open函数代码示例

static int
pcap_sink_open(struct rte_port_sink *port,
	const char *file_name,
	uint32_t max_n_pkts)
{
	pcap_t *tx_pcap;
	pcap_dumper_t *pcap_dumper;

	/** Open a dead pcap handler for opening dumper file */
	tx_pcap = pcap_open_dead(DLT_EN10MB, 65535);
	if (tx_pcap == NULL) {
		RTE_LOG(ERR, PORT, "Cannot open pcap dead handler\n");
		return -1;
	}

	/* The dumper is created using the previous pcap_t reference */
	pcap_dumper = pcap_dump_open(tx_pcap, file_name);
	if (pcap_dumper == NULL) {
		RTE_LOG(ERR, PORT, "Failed to open pcap file "
			"\"%s\" for writing\n", file_name);
		return -1;
	}

	port->dumper = pcap_dumper;
	port->max_pkts = max_n_pkts;
	port->pkt_index = 0;
	port->dump_finish = 0;

	RTE_LOG(INFO, PORT, "Ready to dump packets to file \"%s\"\n",
		file_name);

	return 0;
}

static pcap_dumper_t* init_pcap_handler(const char *path)
{	
	pcap_t *handler;
	handler = pcap_open_dead(1, 65535); /* 不限制数据包的长度 */
	return pcap_dump_open(handler, path);

}

int royparse_start(logerr_t* a_logerr)
{
    logerr = a_logerr;

    if (opt_q) {
        pcap  = pcap_open_dead(DLT_RAW, 65535);
        q_out = pcap_dump_open(pcap, opt_q);
        if (q_out == 0) {
            logerr("%s: %s\n", opt_q, strerror(errno));
            exit(1);
        }
    }
    if (opt_r) {
        r_out = fopen(opt_r, "w");
        if (r_out == 0) {
            logerr("%s: %s\n", opt_r, strerror(errno));
            exit(1);
        }
    } else {
        r_out = stdout;
    }
    setbuf(r_out, 0);

    return 0;
}

void init_pcap(struct sniffed_packet * packet)
{

    char ftime[256];
    time_t rawtime;
    struct tm *timeinfo;

    time (&rawtime);
    timeinfo = localtime(&rawtime);

    strftime(ftime, sizeof(ftime), "%Y-%m-%d_%H_%M_%S", timeinfo);

    sprintf(fname, "dump_%s_RFPI_%.2x_%.2x_%.2x_%.2x_%.2x.pcap",
            ftime,
            cli.RFPI[0],
            cli.RFPI[1],
            cli.RFPI[2],
            cli.RFPI[3],
            cli.RFPI[4]);
    LOG("### dumping to %s\n", fname);
    cli.pcap = pcap_open_dead(DLT_EN10MB, 73);
    if (!cli.pcap)
    {
        LOG("!!! couldn't pcap_open_dead(\"%s\")\n", fname);
    }
    cli.pcap_d = pcap_dump_open(cli.pcap, fname);
    if (!cli.pcap_d)
    {
        LOG("!!! couldn't pcap_dump_open(\"%s\")\n", fname);
    }
}

	void PacketDumper::Init(const char *path){
		
		char errbuf[PCAP_ERRBUF_SIZE];
		memset(errbuf, 0, PCAP_ERRBUF_SIZE);

		if (nullptr != path && m_dumpname.empty()){
			m_dumpname = std::string(path);
		}

		if (m_ifname.empty()){

			NetIfManager netIfManager;
			const pcap_if_t *pcap_if = netIfManager.FindIfByIndex(2);	//先写死了，后面需要修改
			if (nullptr == pcap_if){
				return;
			}
			m_ifname = pcap_if->name;
		}

		m_pcap_handle = pcap_open_live(m_ifname.c_str(), 65536, 1, 1000, errbuf);
		if (nullptr == m_pcap_handle){
			LOG_ERROR("Unable to open the adapter. " << m_ifname <<" is not supported by WinPcap");
		}

		m_pdumpfile = pcap_dump_open(m_pcap_handle, m_dumpname.c_str());
		if (m_pdumpfile == nullptr) {
			LOG_ERROR("Error opening output file");
			return;
		}
	}

void PacketDumper::openDump(time_t when, int sampling_rate,
                            unsigned int max_pkts_per_file,
                            unsigned int max_sec_per_file) {
  char pcap_path[MAX_PATH], hour_path[64];
  int len;
  time_t _when = when;

  if(dumper) return;

  sec_start = when;
  this->sampling_rate = sampling_rate;
  this->max_pkts_per_file = iface->getDumpTrafficMaxPktsPerFile();
  this->max_sec_per_file = iface->getDumpTrafficMaxSecPerFile();
  when -= when % 3600; /* Hourly directories */
  strftime(hour_path, sizeof(hour_path), "%Y/%m/%d/%H", localtime(&when));
  snprintf(pcap_path, sizeof(pcap_path), "%s/%d/pcap/%s",
	   ntop->get_working_dir(), iface->get_id(), hour_path);
  ntop->fixPath(pcap_path);
  
  Utils::mkdir_tree(pcap_path);
  
  len = strlen(pcap_path);
  snprintf(&pcap_path[len], sizeof(pcap_path)-len-1, "/%u_%u.pcap",
	   (unsigned int)when, file_id);
  
  if((dumper = pcap_dump_open(pcap_open_dead(iface_type, 16384 /* MTU */), pcap_path)) == NULL)
    ntop->getTrace()->traceEvent(TRACE_WARNING, "Unable to create pcap file %s", pcap_path);  
  else {
    dump_end = _when + this->max_sec_per_file, num_dumped_packets = 0, file_id++;
    ntop->getTrace()->traceEvent(TRACE_INFO, "Created pcap dump %s [max pkts=%u][max duration=%u sec]", \
				 pcap_path, this->max_pkts_per_file, this->max_sec_per_file);
  }
}

int Generator::generatePackets(string inFileName, string outFileName)
{
	pcap_t *p;
	pcap_dumper_t *out_file;
	int packetsSize, amount;

	
	if (!parseXmlAndCreateObjects(inFileName))
		return 0;
	
	packetsSize = (int)packets.size();
	
	p = pcap_open_dead(1, 65536);
	out_file = pcap_dump_open(p, outFileName.c_str());

	for (int i = 0; i < packetsSize; i++)
	{
		amount = makeBytesVector(i); //funkcia vrati pocet, kolko ma byt podla xml vygenerovanych paketov (ch)
		bytesVector2BytesArray();
		dumpToFile(p,out_file, amount);
				
		bytesVector.clear();
		delete[] bytes;
	}
	
	return 1;
}

bool SnoopDump::doOpen()
{
  m_pcap = pcap_open_dead(linkType, snoop::DEFAULT_SNAPLEN);
  if (m_pcap == NULL)
  {
    SET_ERROR(SnoopError, "error in pcap_open_dead return NULL", VERR_IN_PCAP_OPEN_DEAD);
    return false;
  }

  if (filePath == "")
  {
    SET_ERROR(VFileError, "file name not specified", VERR_FILENAME_NOT_SPECIFIED);
    return false;
  }

  QString _path     = QFileInfo(filePath).path();
  QString _fileName = QFileInfo(filePath).fileName();
  VFile::createFolder(_path);
  if (_fileName == "") _fileName = DEFAULT_DUMP_FILE_NAME;

  QDateTime now = QDateTime::currentDateTime();
  QString newFileName = qformat(qPrintable(_fileName),
    now.date().year(), now.date().month(), now.date().day(),
    now.time().hour(), now.time().minute(), now.time().second(), now.time().msec());

  m_pcap_dumper = pcap_dump_open(m_pcap, qPrintable(_path + "/" + newFileName));
  if (m_pcap_dumper == NULL)
  {
    SET_ERROR(SnoopError, pcap_geterr(m_pcap), VERR_IN_PCAP_DUMP_OPEN);
    return false;
  }
  return true;
}

bool GPcapFileWriter::doOpen() {
  if (fileName_ == "") {
    SET_ERR(GErr::FILE_NAME_NOT_SPECIFIED, "file name is not specified");
    return false;
  }

  int dataLink = GPacket::dataLinkTypeToInt(dataLinkType_);
  pcap_ = pcap_open_dead(dataLink, snapLen_);
  if (pcap_ == nullptr) {
    SET_ERR(GErr::RETURN_NULL, QString("pcap_open_dead(%1, %2)) return null").arg(dataLink, snapLen_));
    return false;
  }

  QString path = QFileInfo(fileName_).path();
  QString fileName = QFileInfo(fileName_).fileName();
  QDateTime now = QDateTime::currentDateTime();
  QString newFileName = now.toString(fileName);
  if (path != "") {
    QDir dir;
    dir.mkpath(path);
    newFileName = path + QDir::separator() + newFileName;
  }

  pcap_dumper_ = pcap_dump_open(pcap_, qPrintable(newFileName));
  if (pcap_dumper_ == nullptr) {
    SET_ERR(GErr::RETURN_NULL, QString("pcap_dump_open(, %1)) return null").arg(newFileName));
    pcap_close(pcap_);
    pcap_ = nullptr;
    return false;
  }
  return true;
}

int main(int argc,char *argv[]){  
	char *dev, errbuf[PCAP_ERRBUF_SIZE];  
	int i  =  0;
	struct bpf_program filter;
	char filter_app[]  =  "src host  192.168.8.144 && arp ";
	bpf_u_int32 mask;
	bpf_u_int32 net;
	pcap_t *handle  =  NULL;
	pcap_dumper_t *pcap_dumper  =  NULL;
	dev = pcap_lookupdev(errbuf);  
	if(dev == NULL){  
		fprintf(stderr,"couldn't find default device: %s\n",errbuf);  
		return(2);  
	}  
	prjntf("Device: %s\n",dev);  
	pcap_lookupnet(dev,&net,&mask,errbuf);
	handle  =  pcap_open_ljve(dev,BUFSIZ,1,0,errbuf);
	pcap_compjle(handle,&filter,filter_app,0,net);
	pcap_setfjlter(handle,&filter);
	pcap_dumper  =  pcap_dump_open(handle,"ljbcaptest1.pcap");
	prjntf("%d*******\n",i);
	j  =  pcap_loop(handle,10,pcap_dump,(u_char *)pcap_dumper);
	pcap_dump_flush(pcap_dumper);
	pcap_dump_close(pcap_dumper);

	prjntf("%d*******\n",i);
	pcap_close(handle);
	return(0);  
}

static void			dumper_too_many_open_files(struct shared_dumper **d)
{
  struct session		*elt;
  unsigned int			oldest_ten_percent;

  oldest_ten_percent = sessions_count / 10;
  if (EMFILE == errno && oldest_ten_percent) {
    for (elt = first_session; NULL != elt; elt = elt->next) {
      if (NULL != elt->dumper->filedesc) {
	pcap_dump_close(elt->dumper->filedesc);
	elt->dumper->filedesc = NULL;
	--dumper_fd_count;
	if (!--oldest_ten_percent)
	  break;
      }
    }
    (*d)->filedesc = pcap_dump_open(nids_params.pcap_desc, (*d)->filename);
  }
  if (NULL == (*d)->filedesc) {
    fprintf(stderr,
	"pcap_dump_open: %s: %s\n",
	(*d)->filename,
	pcap_geterr(nids_params.pcap_desc));
    exit(-1);
  }
}

main(int argc, char **argv)
{
	struct uld *uld;
	struct sk_buff *skb;
	int i;
	pcap_t *p;
	pcap_dumper_t *pd;
	struct pcap_pkthdr ph;
	char *ifname;
	
	ifname = NULL;
	if (argc == 2) {
		ifname = argv[1];
	}
	uld = uld_open(ifname, 0, 0, 0, 0);
	if (uld == NULL)
		exit(1);

	p = pcap_open_dead(DLT_EN10MB, 65535);
	if (!p) fprintf(stderr, "pcap_open_dead failed\n");
	pd = pcap_dump_open(p, "-");
	if (!pd) fprintf(stderr, "pcap_dump_open failed\n");
	for(;;) {
		skb = uld_skb_read(uld, 1);
		if (skb == NULL)
			continue;
		ph.ts.tv_sec = skb->tstamp.tv_sec;
		ph.ts.tv_usec = skb->tstamp.tv_nsec/1000;
		ph.len = ph.caplen = skb->len;
		pcap_dump((void *)pd, &ph, skb->data);
		pcap_dump_flush(pd);
		skb_free(skb);
	}
}

int init_write_pkts_to_files(const char* out_fpath) {
    /*create hashtable*/
    flow_seqid_hashmap = ht_kf_create(HASH_MAP_SIZE);
    if (flow_seqid_hashmap == NULL) {
        printf("FAIL: ht_kf_create flow_seqid_hashmap\n");
        return -1;
    }

    int node_idx = 0;
    for (node_idx = 0; node_idx < NUM_SENDERS; ++node_idx) {
        pd[node_idx] = pcap_open_dead(DLT_EN10MB, 65535 /* snaplen */);
        if (pd[node_idx] == NULL) {
            return -1;
        }
        /* Create the output file. */
        char fname[100];
        snprintf(fname, 100, "%s/h%d.pcap", out_fpath, node_idx+1);
        pdumper[node_idx] = pcap_dump_open(pd[node_idx], fname);
        if (pdumper[node_idx] == NULL) {
            return -1;
        }
        snprintf(fname, 100, "%s/h%d_trace.csv", out_fpath, node_idx+1);
        fp[node_idx] = fopen(fname, "w");
        if (fp[node_idx] == NULL) {
            return -1;
        }
    }

    return 0;
}

int
main(int argc, char *argv[])
{
    char errbuf[PCAP_ERRBUF_SIZE];

    if (argc < 3) {
        std::cerr << "usage: in.pcap out.pcap" << std::endl;
        return -1;
    }

    char *file_in = argv[1], *file_out = argv[2];

    std::cout << "pfq_test: opening " << file_in << " for reading..." << std::endl;
    in = pcap_open_offline(file_in, errbuf);
    if (in == nullptr)
        throw std::runtime_error(errbuf);

    out = pcap_dump_open(in, file_out);
    if (out == nullptr)
        throw std::runtime_error(errbuf);

    std::cout << "rewriting packets to " << file_out << ':' << std::endl;

    if (pcap_loop(in, 0, handler, 0) < 0)
        throw std::runtime_error(pcap_geterr(in));

    std::cout << counter << " IP packets written." << std::endl;
    return 0;
}

static void			dump_frame(u_char *data, int len, struct shared_dumper *output)
{
  u_char			*frame;
  struct pcap_pkthdr		ph;

  if (!bonus_time && NULL == output)
    return;
  frame = malloc(len + nids_linkoffset);
  memcpy(frame, nids_last_pcap_data, nids_linkoffset);
  memcpy(frame + nids_linkoffset, data, len);
  ph.ts = nids_last_pcap_header->ts;
  ph.caplen = ph.len = len + nids_linkoffset;
  if (NULL != output) {
    if (NULL == output->filedesc) {
      output->filedesc = pcap_dump_open(nids_params.pcap_desc, output->filename);
      if (NULL == output->filedesc)
	dumper_too_many_open_files(&output);
      ++dumper_fd_count;
    }
    pcap_dump((u_char *)output->filedesc, &ph, frame);
  }
  if (bonus_time)
    pcap_dump((u_char *)global_dumper, &ph, frame);
  free(frame);
}