C++ pcap_lookupnet函数代码示例

void* begingrab(void *)
{
    char dev[10];
    strcpy(dev, "wlan0"); //本机测试使用无线网
    char errbuf[PCAP_ERRBUF_SIZE]; //出错信息
    cout << "DEV: " << dev << endl;
    bpf_u_int32 mask; //网络掩码
    bpf_u_int32 net; //网络号
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1)
    { //获取网卡的网络号和掩码
        cout << "can't get netmask for device" << dev << endl;
        strcpy(dev, "eth0");
        cout << "trying device eth0" << endl;
        cout << "DEV: " << dev << endl;
        if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1)
        {
            cout << "can't get netmask for device" << dev << endl;
            exit(0);
        }
    }
    pcap_t* handle;
    handle = pcap_open_live(dev, BUFSIZ, 0, -1, errbuf); //打开网络设备
    if (handle == NULL)
    {
        cout << "can't open device " << dev << endl;
        exit(0);
    }
    getLocal(dev); //获取本机ip
    char filter[100];
    sprintf(filter, "host %s", local_addrs->string); //构造过滤器，只考虑本机ip
    bpf_program fp;
    //    if (pcap_compile(handle, &fp, filter, 0, net) == -1)
    //    { //编译过滤器
    //        cout << "compile filter error ! " << endl;
    //        exit(0);
    //    }
    //    if (pcap_setfilter(handle, &fp) == -1)
    //    { //应用过滤器
    //        cout << "set filter error ! " << endl;
    //        exit(0);
    //    }
    while (1)
    {
        bool get_a_packet = false;
        int ret = pcap_dispatch(handle, -1, got_packet, NULL);
        if (ret == -1 || ret == -2)
        {
            cout << "error occur when grab a packet!" << endl;
        } else if (ret != 0)
            get_a_packet = true;
        if (!get_a_packet) //降低CPU利用率 >_<
            usleep(100);
    }
    pcap_close(handle);
    return NULL;
}

int
main (int argc, char *argv[])
{
  char               err[PCAP_ERRBUF_SIZE];
  pcap_t*            h;
  struct bpf_program fp;
  bpf_u_int32        maskp;
  bpf_u_int32        netp;
  char *             filter = "tcp[tcpflags] & (tcp-syn) != 0 and "
    "tcp[tcpflags] & (tcp-ack) == 0";

  if (argc != 2)
    {
      fprintf (stderr, "Usage: %s interface \n", argv[0]);
      exit (1);
    }
  
  if ((pcap_lookupnet (argv[1], &netp, &maskp, err)) < 0)
    {
      fprintf (stderr, "pcap:%s\n", err);
      exit (1);
    }
  if ((h = pcap_open_live (argv[1], BUFSIZ, 0, 0, err)) == NULL)
    {
      fprintf (stderr, "pcap:%s\n", err);
      exit (1);

    }

  pcap_compile (h, &fp, filter, 0, netp);
  pcap_setfilter (h, &fp);
  pcap_loop (h, -1, ip_cb, NULL);

  return 0;
}

static int l2_packet_init_libpcap(struct l2_packet_data *l2,
				  unsigned short protocol)
{
	bpf_u_int32 pcap_maskp, pcap_netp;
	char pcap_filter[200], pcap_err[PCAP_ERRBUF_SIZE];
	struct bpf_program pcap_fp;

	pcap_lookupnet(l2->ifname, &pcap_netp, &pcap_maskp, pcap_err);
	l2->pcap = pcap_open_live(l2->ifname, 2500, 0, 10, pcap_err);
	if (l2->pcap == NULL) {
		fprintf(stderr, "pcap_open_live: %s\n", pcap_err);
		fprintf(stderr, "ifname='%s'\n", l2->ifname);
		return -1;
	}
	if (pcap_datalink(l2->pcap) != DLT_EN10MB &&
	    pcap_set_datalink(l2->pcap, DLT_EN10MB) < 0) {
		fprintf(stderr, "pcap_set_datalink(DLT_EN10MB): %s\n",
			pcap_geterr(l2->pcap));
		return -1;
	}
	os_snprintf(pcap_filter, sizeof(pcap_filter),
		    "not ether src " MACSTR " and "
		    "( ether dst " MACSTR " or ether dst " MACSTR " ) and "
		    "ether proto 0x%x",
		    MAC2STR(l2->own_addr), /* do not receive own packets */
		    MAC2STR(l2->own_addr), MAC2STR(pae_group_addr),
		    protocol);
	if (pcap_compile(l2->pcap, &pcap_fp, pcap_filter, 1, pcap_netp) < 0) {
		fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(l2->pcap));
		return -1;
	}

	if (pcap_setfilter(l2->pcap, &pcap_fp) < 0) {
		fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(l2->pcap));
		return -1;
	}

	pcap_freecode(&pcap_fp);
#ifndef __sun__
	/*
	 * When libpcap uses BPF we must enable "immediate mode" to
	 * receive frames right away; otherwise the system may
	 * buffer them for us.
	 */
	{
		unsigned int on = 1;
		if (ioctl(pcap_fileno(l2->pcap), BIOCIMMEDIATE, &on) < 0) {
			fprintf(stderr, "%s: cannot enable immediate mode on "
				"interface %s: %s\n",
				__func__, l2->ifname, strerror(errno));
			/* XXX should we fail? */
		}
	}
#endif /* __sun__ */

	eloop_register_read_sock(pcap_get_selectable_fd(l2->pcap),
				 l2_packet_receive, l2, l2->pcap);

	return 0;
}

int main(int argc, char *argv[])
{
    char* capture_device;		/* The selected capture device */
    pcap_t *handle;			/* Session handle */
    const char* filterExp;
    struct bpf_program fp;   /* The compiled filter expression */
    bpf_u_int32 mask;		/* Our netmask */
    bpf_u_int32 net;		/* Our IP */
    char errbuf[PCAP_ERRBUF_SIZE];	/* Error buffer */

    /* Check args */
    if (argc > 1) {
        capture_device = argv[1];
        filterExp = argv[2];
    }
    else {
        capture_device = ethernet_capture_device;
        filterExp = NULL;
    }

    /* Open the device for capture in promiscuos mode */
    pcap_lookupnet(capture_device, &net, &mask, errbuf);
    handle = pcap_open_live(capture_device, BUFSIZ, 1, 0, errbuf);
    if (pcap_compile(handle, &fp, filterExp, 0, net) == -1) {
        fprintf(stderr,"Filter compile failed.\n");
    }
    if (pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr,"Filter set failed.\n");
    }
    pcap_loop(handle, -1, got_packet, NULL);

    return 0;
}

int main(int argc, char** argv)
{      
        int i;
        char *dev;
        char errbuf[PCAP_ERRBUF_SIZE];
        pcap_t *descr;
        const u_char *packet;
        struct pcap_pkthdr hdr;
        struct ether_header *epthr;
        struct bpf_program fp;
        bpf_u_int32     maskp;
        bpf_u_int32     netp;
       
        dev = pcap_lookupdev(errbuf);

	printf("%s", dev);
	fflush(stdout);
        pcap_lookupnet(dev, &netp, &maskp, errbuf);
       
        descr = pcap_open_live(dev, 100, 0, -1, errbuf); //ok
        descr = pcap_open_live("any", 100, 0, -1, errbuf); //tcp header error
                                                                                                                              
        pcap_compile(descr, &fp, argv[1], 0, netp);
       
        pcap_setfilter(descr, &fp);
       
        pcap_loop(descr, -1, my_callback, "kkk");
       
        fprintf(stdout, "aoaoa");
        
        return 0;
}      

int main(int argc, char **argv){
   
   char *dev;
   char errbuf[PCAP_ERRBUF_SIZE];
   
   pcap_t* descr;
   char *filter_exp;

   int num_pkts_exp;

   if(argc < 4) {
      printf("error: number of arguments invalid. Expected: iface 'expression'\n");
      exit(-1);
   }  

   dev = argv[1]; //dev = pcap_lookupdev(errbuf);
   filter_exp = argv[2];   
   num_pkts_exp = atoi(argv[3]);

   if(dev == NULL){
      printf("error: %s\n",errbuf);
      exit(1);
   }

   printf("device: %s\n",dev);

   // IP and maks of sniffing device   
   bpf_u_int32 net, mask;
   if(pcap_lookupnet(dev,&net,&mask,errbuf) == -1){
      printf("Error: lookupnet\n");
      exit(-1);
   }

    // open for sniffing
   descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf);
     
   if(descr == NULL){
      printf("pcap_open_live(): %s\n",errbuf);
      exit(-1);
   }

   // the compiled filter expression
   struct bpf_program fp; 
   if(pcap_compile(descr,&fp,filter_exp,0,mask) == -1){
      printf("Couldn't parses the filter  %s\n",pcap_geterr(descr));
      exit(-1);
   }
   printf("filter expr\n");

   if(pcap_setfilter(descr,&fp) == -1){
      printf("Couldn't parses the filter  %s\n",pcap_geterr(descr));
      exit(-1);
   }

   pcap_loop(descr,num_pkts_exp,my_callback,NULL);

   pcap_close(descr);
   return 0;

}

void capture_package( char * dst_ip_str )
{
	pcap_t* pcap_handle;
	char error_content[PCAP_ERRBUF_SIZE];
	char *net_interface;
	struct bpf_program bpf_filter;
	/* "" indicates capture all packet*/
	char bpf_filter_string[] = "tcp";
	bpf_u_int32 net_mask;
	bpf_u_int32 net_ip;

	/* get network interface */
	net_interface = pcap_lookupdev( error_content );
	if(net_interface == NULL){
		fprintf(stderr, "Couldn't find default device: %s\n",
           error_content);
		exit(1);
	}
	printf("Device: %s\n", net_interface);

	/* get network addr, mask */
	if( pcap_lookupnet( net_interface, &net_ip,
                     &net_mask, error_content ) == -1){
		fprintf(stderr, "Couldn't get netmask for device %s\n",
            net_interface);
		exit(1);
	}

	/* open network interface */
	pcap_handle = pcap_open_live( net_interface, BUFSIZ,
                               1, 0, error_content );
	if(pcap_handle == NULL){
		fprintf(stderr, "Couldn't open device %s: %s\n",
           net_interface, error_content);
		exit(1);
	}

	//sprintf(bpf_filter_string, "src %s and dst %s tcp", net_ip, dst_ip_str);
	/* compile the filter */
	if( pcap_compile( pcap_handle, &bpf_filter,
                   bpf_filter_string, 0, net_ip ) == -1){
		fprintf(stderr, "couldn't parse filter: %s: %s\n",
           bpf_filter_string, pcap_geterr(pcap_handle));
		exit(1);
	}
	/* set the filter */
	if( pcap_setfilter( pcap_handle, &bpf_filter ) == -1 ){
		fprintf(stderr, "couldn't install filter: %s: %s\n",
          bpf_filter_string, pcap_geterr(pcap_handle));
		exit(1);
	}

	//if( pcap_datalink( pcap_handle ) != DLT_EN10MB ) //return link layer type
	//	return;
	/* register the call back function, capture the packet in loop
	   then, callback function analysis the packet */
	pcap_loop( pcap_handle, -1, tcp_protocol_packet_callback, NULL );
	pcap_close( pcap_handle );

}

int main(){
  //Daemon();
  flows,packets = 0;
  char *devname = "eth2";
  char errBuf[PCAP_ERRBUF_SIZE];
  pcap_t * device = pcap_open_live(devname, 65535, 1, 0, errBuf);

  char net[20],mask[20];
  struct in_addr addr;
  int ret;
  ret = pcap_lookupnet(devname, &netp, &maskp, errBuf);
  addr.s_addr = netp;
  strcpy(net,inet_ntoa(addr));
  addr.s_addr = maskp;
  strcpy(mask,inet_ntoa(addr));
  printf("net %s ,mask %s\n",net,mask);
  printf("------------------------------------\n");

  handler();
  pcap_loop(device, -1, callPacket, NULL);
  pcap_close(device);
  int forint=0;
  for (;;){
    forint++; sleep(60);
  }
  return 0;
}

char * fill_device_net(dhcp_device_t * device)
{
	static char errbuf[PCAP_ERRBUF_SIZE];
	if(pcap_lookupnet(device->str_name, &device->network, &device->netmask, errbuf) == -1)
		return errbuf;
	return NULL;
}

/** Apply capture filter to an interface
 *
 * @param pcap handle to apply filter to.
 * @param expression PCAP expression to use as a filter.
 * @return 0 on success, 1 wrong interface type, -1 on error.
 */
int fr_pcap_apply_filter(fr_pcap_t *pcap, char *expression)
{
	bpf_u_int32 mask;				/* Our netmask */
	bpf_u_int32 net = 0;				/* Our IP */
	struct bpf_program fp;

	/*
	 *	We can only apply filters to live interfaces
	 */
	if (pcap->type != PCAP_INTERFACE_IN) {
		return 1;
	}

	if (pcap_lookupnet(pcap->name, &net, &mask, pcap->errbuf) < 0) {
		DEBUG("Failed getting IP for interface \"%s\", using defaults: %s",
		      pcap->name, pcap->errbuf);
	}

	if (pcap_compile(pcap->handle, &fp, expression, 0, net) < 0) {
		fr_strerror_printf("%s", pcap_geterr(pcap->handle));

		return -1;
	}

	if (pcap_setfilter(pcap->handle, &fp) < 0) {
		fr_strerror_printf("%s", pcap_geterr(pcap->handle));

		return -1;
	}

	return 0;
}

/* Find and prepare ethernet device for capturing */
pcap_t *prepare_capture(char *interface, int promisc, char *capfilter) {
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *pcap_hnd;
    char *dev = NULL;
    bpf_u_int32 net, mask;
    struct bpf_program filter;


    /* Starting live capture, so find and open network device */
    if (!interface) {
        dev = pcap_lookupdev(errbuf);
        if (dev == NULL)
            LOG_DIE("Cannot find a valid capture device: %s", errbuf);
    } else {
        dev = interface;
    }

    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) net = 0;

    pcap_hnd = pcap_open_live(dev, BUFSIZ, promisc, 0, errbuf);
    if (pcap_hnd == NULL)
        LOG_DIE("Cannot open live capture on '%s': %s", dev, errbuf);

    set_link_header_offset(pcap_datalink(pcap_hnd));

    /* Compile capture filter and apply to handle */
    if (pcap_compile(pcap_hnd, &filter, capfilter, 0, net) == -1)
        LOG_DIE("Cannot compile capture filter '%s': %s", capfilter, pcap_geterr(pcap_hnd));

    if (pcap_setfilter(pcap_hnd, &filter) == -1)
        LOG_DIE("Cannot apply capture filter: %s", pcap_geterr(pcap_hnd));

    pcap_freecode(&filter);
    return pcap_hnd;
}

int main()
{
    char *dev,errbuf[PCAP_ERRBUF_SIZE];
    pcap_t * handle;
    struct pcap_pkthdr header;
    const u_char *packet;

    struct bpf_program fp;
    char filter_exp[]="dst host www.google.com";
    bpf_u_int32 mask,net;

    dev=pcap_lookupdev(errbuf);

    pcap_lookupnet(dev,&net,&mask,errbuf);

    handle=pcap_open_live(dev,BUFSIZ,0,-1,errbuf);

    //pcap_compile(handle,&fp,filter_exp,0,net);

    //pcap_setfilter(handle,&fp);

    packet=pcap_next(handle,&header);
    printf("%d\n",header.len);

    pcap_loop(handle,-1,callback,NULL);
    pcap_close(handle);

    return 0;
}

/*
 * PCap initialize
 */
int pcap_initialize(char *pcap_errbuf, u_int32_t *net, u_int32_t *mask)
{
    char *dev;

    // find a device if not specified
    if(!progopt.device_set()) {
        dev = pcap_lookupdev(pcap_errbuf);
        if (dev == NULL) {
            return 0;
        }
    }
    else {
        dev = progopt.device;
    }

    // get network number and mask associated with capture device
    if(pcap_lookupnet(dev, net, mask, pcap_errbuf) == -1) {
        return 0;
    }

    // open capture device
    handle = pcap_open_live(dev, PKT_LEN, 1, progopt.time, pcap_errbuf);
    if (handle == NULL) {
        return 0;
    }

    return 1;
}

int main(){
    char *dev; 
    int ret; 
    char errbuf[PCAP_ERRBUF_SIZE];
    bpf_u_int32 netp; 
    bpf_u_int32 maskp;
    pcap_t* descr;

    dev = pcap_lookupdev(errbuf);
    if(dev == NULL){
        printf("%s\n",errbuf);
        exit(1);
    }
    
    ret = pcap_lookupnet(dev,&netp,&maskp,errbuf);
    if(ret == -1){
        printf("%s\n",errbuf);
        exit(1);
    }
    
    descr = pcap_open_live(dev,BUFSIZ,1,1,errbuf);
    if(descr == NULL){
	printf("%s\n",errbuf);
	exit(1);
    }
    pcap_loop(descr,-1,find,NULL);
    return 0;
}

int main(int argc, char **argv) {
    char dev[] = "eth0";
    pcap_t *handle;
    char error_buffer[PCAP_ERRBUF_SIZE];
    struct bpf_program filter;
    char filter_exp[] = "port 80";
    bpf_u_int32 subnet_mask, ip;

    if (pcap_lookupnet(dev, &ip, &subnet_mask, error_buffer) == -1) {
        printf("Could not get information for device: %s\n", dev);
        ip = 0;
        subnet_mask = 0;
    }
    handle = pcap_open_live(dev, BUFSIZ, 1, 1000, error_buffer);
    if (handle == NULL) {
        printf("Could not open %s - %s\n", dev, error_buffer);
        return 2;
    }
    if (pcap_compile(handle, &filter, filter_exp, 0, ip) == -1) {
        printf("Bad filter - %s\n", pcap_geterr(handle));
        return 2;
    }
    if (pcap_setfilter(handle, &filter) == -1) {
        printf("Error setting filter - %s\n", pcap_geterr(handle));
        return 2;
    }

    /* pcap_next() or pcap_loop() to get packets from device now */
    /* Only packets over port 80 will be returned. */

    return 0;
}