C++ pcap_open函数代码示例

int main (void)
{
    int fd;

    /* Create PCAP file */
    assert((fd = pcap_create(test_path, LINKTYPE_EN10MB)) > 0);

    /* Write payload */
    assert(test_pcap_write(fd, icmp_dns, sizeof(icmp_dns)) == 0);

    assert(pcap_close(fd) == 0);

    assert((fd = pcap_open(test_path, O_RDONLY)) > 0);

    assert(pcap_has_packets(fd));

    assert(pcap_close(fd) == 0);

    assert((fd = pcap_open(test_path, O_RDWR | O_APPEND)) > 0);

    /* Write payload */
    assert(test_pcap_write(fd, icmp_dns, sizeof(icmp_dns)) == 0);

    assert(pcap_close(fd) == 0);

    pcap_destroy(fd, test_path);

    return (EXIT_SUCCESS);
}

void test_pcap(void)
{
	rdpPcap* pcap;
	pcap_record record;
	test_packet packets[3];

	packets[0].data = test_packet_1;
	packets[0].length = sizeof(test_packet_1);
	packets[1].data = test_packet_2;
	packets[1].length = sizeof(test_packet_2);
	packets[2].data = test_packet_3;
	packets[2].length = sizeof(test_packet_3);

	pcap = pcap_open("/tmp/test.pcap", true);
	pcap_add_record(pcap, test_packet_1, sizeof(test_packet_1));
	pcap_flush(pcap);
	pcap_add_record(pcap, test_packet_2, sizeof(test_packet_2));
	pcap_flush(pcap);
	pcap_add_record(pcap, test_packet_3, sizeof(test_packet_3));
	pcap_close(pcap);

	pcap = pcap_open("/tmp/test.pcap", false);

	int i = 0;
	while (pcap_has_next_record(pcap))
	{
		pcap_get_next_record(pcap, &record);
		CU_ASSERT(record.length == packets[i].length)
		i++;
	}

	CU_ASSERT(i == 3);

	pcap_close(pcap);
}

boolean freerdp_connect(freerdp* instance)
{
	rdpRdp* rdp;
	boolean status;

	rdp = instance->context->rdp;

	IFCALL(instance->PreConnect, instance);

	status = rdp_client_connect(rdp);

	if (status)
	{
		if (instance->settings->dump_rfx)
		{
			instance->update->pcap_rfx = pcap_open(instance->settings->dump_rfx_file, True);
			if (instance->update->pcap_rfx)
				instance->update->dump_rfx = True;
		}

		IFCALL(instance->PostConnect, instance);

		if (instance->settings->play_rfx)
		{
			STREAM* s;
			rdpUpdate* update;
			pcap_record record;

			s = stream_new(1024);
			instance->update->pcap_rfx = pcap_open(instance->settings->play_rfx_file, False);
			if (instance->update->pcap_rfx)
				instance->update->play_rfx = True;
			update = instance->update;

			while (instance->update->play_rfx && pcap_has_next_record(update->pcap_rfx))
			{
				pcap_get_next_record_header(update->pcap_rfx, &record);

				s->data = xrealloc(s->data, record.length);
				record.data = s->data;
				s->size = record.length;

				pcap_get_next_record_content(update->pcap_rfx, &record);
				stream_set_pos(s, 0);

				update->BeginPaint(update);
				update_recv_surfcmds(update, s->size, s);
				update->EndPaint(update);
			}

			xfree(s->data);
			return True;
		}
	}

	return status;
}

int openpcapfile(pcap_t **pcapout, char *filename) {
	pcap_t *pcap;
	char errbuf[PCAP_ERRBUF_SIZE];
	char source[PCAP_BUF_SIZE];

	/* Create the source string according to the new WinPcap syntax */
    if ( pcap_createsrcstr( source,         // variable that will keep the source string
                            PCAP_SRC_FILE,  // we want to open a file
                            NULL,           // remote host
                            NULL,           // port on the remote host
                            filename,        // name of the file we want to open
                            errbuf          // error buffer
                            ) != 0)
    {
        fprintf(stderr,"\nError creating a source string\n");
        return -1;
    }
    
    /* Open the capture file */
    if ( (pcap = pcap_open(source,         // name of the device
                        65536,          // portion of the packet to capture
                                        // 65536 guarantees that the whole packet will be captured on all the link layers
                         PCAP_OPENFLAG_PROMISCUOUS,     // promiscuous mode
                         1000,              // read timeout
                         NULL,              // authentication on the remote machine
                         errbuf         // error buffer
                         ) ) == NULL)
    {
		fprintf(stderr,"\nUnable to open %s: %s\n", filename, errbuf);
        return -1;
    }

	*pcapout = pcap;
	return 0;
}

static void prvOpenInterface( const char *pucName )
{
static char pucInterfaceName[ 256 ];

	if( pucName != NULL )
	{
		strncpy( pucInterfaceName, pucName, sizeof( pucInterfaceName ) );
	}

	pxOpenedInterfaceHandle = pcap_open(	pucInterfaceName,          	/* The name of the selected interface. */
											ipTOTAL_ETHERNET_FRAME_SIZE, /* The size of the packet to capture. */
											PCAP_OPENFLAG_PROMISCUOUS,	/* Open in promiscuous mode as the MAC and
																		IP address is going to be "simulated", and
																		not be the real MAC and IP address.  This allows
																		traffic to the simulated IP address to be routed
																		to uIP, and traffic to the real IP address to be
																		routed to the Windows TCP/IP stack. */
											100,
											NULL,             			/* No authentication is required as this is
																		not a remote capture session. */
											cErrorBuffer
									   );

	if ( pxOpenedInterfaceHandle == NULL )
	{
		printf( "\n%s is not supported by WinPcap and cannot be opened\n", pucInterfaceName );
	}
	else
	{
		/* Configure the capture filter to allow blocking reads, and to filter
		out packets that are not of interest to this demo. */
		prvConfigureCaptureBehaviour();
	}
}

/**
    @brief
    This will sniff incoming packets for an ICMP ECHO reply
    libpcap version
*/
bool turbotrace::start_sniffer()
{
	log("Sniffer initialising...\n");

    char errbuf[1000];
	//Open the device
    adapter = pcap_open(adapter_info.name , 65536 , PCAP_OPENFLAG_PROMISCUOUS , 20 , NULL ,errbuf);

    if (adapter == NULL)
	{
		log(_("pcap_open_live failed") + wxString(errbuf , wxConvUTF8));
		return false;
	}

	log(_("pcap_open successful"));

    sniffer_ready = true;

	//Send the syn packets
    send_syn();

    //Put the device in sniff loop
	pcap_loop(adapter , -1 , process_packet2 , (u_char*)this);

	return true;
}

void main(int argc, char **argv)
{
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
struct timeval st_ts;
u_int netmask;
struct bpf_program fcode;
  
	/* Check the validity of the command line */
	if (argc != 2)
	{
		usage();
		return;
	}
		
	/* Open the output adapter */
	if ( (fp= pcap_open(argv[1], 100, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf) ) == NULL)
	{
		fprintf(stderr,"\nUnable to open adapter %s.\n", errbuf);
		return;
	}

    /* Don't care about netmask, it won't be used for this filter */
    netmask=0xffffff; 

    //compile the filter
    if (pcap_compile(fp, &fcode, "tcp", 1, netmask) <0 )
	{
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        return;
    }
    
    //set the filter
    if (pcap_setfilter(fp, &fcode)<0)
	{
        fprintf(stderr,"\nError setting the filter.\n");
		pcap_close(fp);
        /* Free the device list */
        return;
    }

	/* Put the interface in statstics mode */
	if (pcap_setmode(fp, MODE_STAT)<0)
	{
        fprintf(stderr,"\nError setting the mode.\n");
		pcap_close(fp);
        /* Free the device list */
        return;
    }


	printf("TCP traffic summary:\n");

	/* Start the main loop */
	pcap_loop(fp, 0, dispatcher_handler, (PUCHAR)&st_ts);

	pcap_close(fp);
	return;
}

/*
 * Tries to open the given interface on promiscuous
 * Parameters:
 * 		none
 * Returns: true if the interface is open, false otherwise
*/
bool Interface::open() {
#ifdef _WIN32
	return (handle = pcap_open(dev, BUFSIZ, PCAP_OPENFLAG_PROMISCUOUS | PCAP_OPENFLAG_NOCAPTURE_LOCAL | PCAP_OPENFLAG_MAX_RESPONSIVENESS, 500, NULL, errbuf)) != NULL;
#else
	return (handle = pcap_open_live(dev, BUFSIZ, 1, 500, errbuf)) != NULL;
#endif
}

int main(int argc, char **argv)
{
    pcap_t *fp;
    char errbuf[PCAP_ERRBUF_SIZE];
    struct timeval st_ts;
    u_int netmask;
    struct bpf_program fcode;

    /* 检查命令行参数的合法性 */
    if (argc != 2)
    {
        usage();
        return -1;
    }

    /* 打开输出适配器 */
    if ( (fp= pcap_open(argv[1], 100, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf) ) == NULL)
    {
        fprintf(stderr,"\nUnable to open adapter %s.\n", errbuf);
        return -1;
    }

    /* 不用关心掩码，在这个过滤器中，它不会被使用 */
    netmask=0xffffff;

    // 编译过滤器
    if (pcap_compile(fp, &fcode, "tcp", 1, netmask) <0 )
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* 释放设备列表 */
        return -1;
    }

    //设置过滤器
    if (pcap_setfilter(fp, &fcode)<0)
    {
        fprintf(stderr,"\nError setting the filter.\n");
        pcap_close(fp);
        /* 释放设备列表 */
        return -1;
    }

    /* 将接口设置为统计模式 */
    if (pcap_setmode(fp, MODE_STAT)<0)
    {
        fprintf(stderr,"\nError setting the mode.\n");
        pcap_close(fp);
        /* 释放设备列表 */
        return -1;
    }


    printf("TCP traffic summary:\n");

    /* 开始主循环 */
    pcap_loop(fp, 0, dispatcher_handler, (PUCHAR)&st_ts);

    pcap_close(fp);
    return 0;
}

pcap_t *nr_open_current_device_adapter(int snaplen, pcap_addr_t ** sockaddr) {
    pcap_if_t *devices;
    pcap_if_t *device;
    char errbuf[PCAP_ERRBUF_SIZE];

    if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &devices, errbuf) == -1) {
        fprintf(stderr, "Error in pcap_findalldevs_ex: %s\n", errbuf);
        return 0;
    }

    // Return first interface with an address
    for (device = devices; device; device = device->next) {
        if (device->description) {
            pcap_addr_t *addr;
            for (addr = device->addresses; addr; addr = addr->next) {
                if (addr->addr->sa_family == AF_INET) { // IPv4 addr
                    if (addr->addr) {
                        (*sockaddr) = nr_get_device_ip_interface(device);
                        pcap_t *handle;
                        handle = pcap_open(device->name, snaplen, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf);
                        return handle;
                    }
                }
            }
        }
    }
    return 0;
}

/* Open an Ethernet interface using PCAP */
static pcap_t *nio_ethernet_open(char *device)
{
   char pcap_errbuf[PCAP_ERRBUF_SIZE];
   pcap_t *p;

#ifndef CYGWIN
   /* Timeout is 10ms */
   if (!(p = pcap_open_live(device, 65535, TRUE, 10, pcap_errbuf)))
      goto pcap_error;

   pcap_setdirection(p, PCAP_D_INOUT);
#ifdef BIOCFEEDBACK
   {
     int on = 1;
     ioctl(pcap_fileno(p), BIOCFEEDBACK, &on);
   }
#endif
#else
   p = pcap_open(device, 65535,
       PCAP_OPENFLAG_PROMISCUOUS |
       PCAP_OPENFLAG_NOCAPTURE_LOCAL |
	   PCAP_OPENFLAG_MAX_RESPONSIVENESS |
	   PCAP_OPENFLAG_NOCAPTURE_RPCAP,
	   10, NULL, pcap_errbuf);

   if (!p)
      goto pcap_error;
#endif

   return p;

 pcap_error:
   fprintf(stderr, "nio_ethernet_open: unable to open device '%s' ""with PCAP (%s)\n", device, pcap_errbuf);
   return NULL;
}

int add_stream_from_pcap(char *file_path)
{
    pcap_t *fp;
    char errbuf[PCAP_ERRBUF_SIZE];
    char source[PCAP_BUF_SIZE];
    struct pcap_pkthdr *header;
    const u_char *pkt_data;
    t_stream t_stream_tmp;
    
    /* Create the source string according to the new WinPcap syntax */
    if ( pcap_createsrcstr( source,         // variable that will keep the source string
                            PCAP_SRC_FILE,  // we want to open a file
                            NULL,           // remote host
                            NULL,           // port on the remote host
                            file_path,        // name of the file we want to open
                            errbuf          // error buffer
                            ) != 0)
    {
        WinPrintf(hwnd_frame, "Error creating a source string");
        return -1;
    }
    
    /* Open the capture file */
    if ( (fp= pcap_open(source,         // name of the device
                        65536,          // portion of the packet to capture
                                        // 65536 guarantees that the whole packet will be captured on all the link layers
                         PCAP_OPENFLAG_PROMISCUOUS,     // promiscuous mode
                         1000,              // read timeout
                         NULL,              // authentication on the remote machine
                         errbuf         // error buffer
                         ) ) == NULL)
    {
        WinPrintf(hwnd_frame, "打开文件失败:\n%s\n可能是抓包存档文件损坏或格式不支持", source);
        return -1;
    }

    while (pcap_next_ex(fp, &header, &pkt_data)>0)
    {
        if (nr_cur_stream>=MAX_STREAM_NUM)
        {
             err_msg_box("已达最大流数目 %d", MAX_STREAM_NUM);
             break;
        }


        init_stream(&t_stream_tmp);
        t_stream_tmp.len=header->caplen;
        memcpy(t_stream_tmp.data, pkt_data, t_stream_tmp.len);
        t_stream_tmp.err_flags = build_err_flags((void *)(t_stream_tmp.data), t_stream_tmp.len);
        add_stream(&t_stream_tmp);


    }

    pcap_close(fp);	
    re_populate_items();
    return 0;
}

/*
 * 初始化缓存区，生成接口句柄
 * skfd: 被初始化的接口句柄
 * @return: 0: 成功
 *          -1: 初始化接口句柄失败
 */
static int eapol_init(pcap_t **skfd)
{
    pcap_if_t *alldevs, *d;
    char errbuf[PCAP_ERRBUF_SIZE];
    char ifbuff[8+IFNAMSIZ] = "rpcap://";

    sendethii = (ethII_t*)sendbuff;
    sendeapol = (eapol_t*)((uchar*)sendethii+sizeof(ethII_t));
    sendeap = (eap_t*)((uchar*)sendeapol+sizeof(eapol_t));
    sendeapbody = (eapbody_t*)((uchar*)sendeap+sizeof(eap_t));

    if (-1 == pcap_findalldevs(&alldevs, errbuf)) {
        _M("Get interface: %s\n", errbuf);
        return -1;
    }

    for (d = alldevs; NULL != d; d = d->next)
        if (0 == strcmp(ifname, d->name))
            break;
    if (NULL == d) return -1;
    /* 获取mac */
    LPADAPTER lpAdapter = PacketOpenAdapter(d->name);
    if (!lpAdapter || (lpAdapter->hFile == INVALID_HANDLE_VALUE))
        return -1;

    PPACKET_OID_DATA oidData = malloc(ETH_ALEN + sizeof(PACKET_OID_DATA));
    if (NULL == oidData) {
        PacketCloseAdapter(lpAdapter);
        return -1;
    }
    oidData->Oid = OID_802_3_CURRENT_ADDRESS;
    oidData->Length = ETH_ALEN;
    memset(oidData->Data, 0, ETH_ALEN);
    if (0 == PacketRequest(lpAdapter, FALSE, oidData)) {
        free(oidData);
        return -1;
    }
    memcpy(client_mac, oidData->Data, ETH_ALEN);
    PacketCloseAdapter(lpAdapter);
    _D("%s's MAC: %02X-%02X-%02X-%02X-%02X-%02X\n", ifname,
            client_mac[0],client_mac[1],client_mac[2],
            client_mac[3],client_mac[4],client_mac[5]);

    /* 获取网络接口句柄 */
    strncat(ifbuff, ifname, IFNAMSIZ);
    if (NULL == (*skfd = pcap_open(d->name, MTU_MAX,
                    PCAP_OPENFLAG_PROMISCUOUS, TIMEOUT*1000, NULL, errbuf))) {
        _M("Get interface handler:%s\n", errbuf);
        pcap_freealldevs(alldevs);
        return -1;
    }
    pcap_freealldevs(alldevs);

    return 0;
}

/* Opens a port with the given name and uid. */
struct pcap_port * MALLOC_ATTR
pcap_port_open(struct pcap_drv *pcap_drv, size_t id, const char *name) {

    struct linux_port *linux_port;
    HASH_FIND_STR(pcap_drv->linux_ports_map, name, linux_port);
    if(linux_port == NULL) {
        logger_log(pcap_drv->logger, LOG_ERR, "Unable to get interface flags");
        logger_log(pcap_drv->logger, LOG_ERR, "There is no linux port for %s", name);
        return NULL;
    }

    struct linux_port_flags *flags = &linux_port->flags;
    if (flags == NULL) {
        logger_log(pcap_drv->logger, LOG_ERR, "Unable to get interface flags %s", name);
        return NULL;
    }

    struct pcap_port *pcap_port = malloc(sizeof(struct pcap_port));
    pcap_port->drv     = pcap_drv;
    pcap_port->id      = id;
    pcap_port->name    = strdup(name);
    pcap_port->logger  = logger_mgr_get(LOGGER_NAME_PORT_DRV_PCAP_PORT, id);


    pcap_port->dp_uid = 0; // invalidity marked by port_no
    pcap_port->dp_port_no = OF_NO_PORT;
    pcap_port->pkt_mbox = NULL;
    pcap_port->rwlock = malloc(sizeof(pthread_rwlock_t));
    pthread_rwlock_init(pcap_port->rwlock, NULL);

    pcap_port->of_port = malloc(sizeof(struct ofl_port));
    memset(pcap_port->of_port, '\0', sizeof(struct ofl_port));
    pcap_port->of_stats = malloc(sizeof(struct ofl_port_stats));
    memset(pcap_port->of_stats, '\0', sizeof(struct ofl_port_stats));
    pcap_port->of_port->name = strdup(name);

    pcap_port->stats_mutex = malloc(sizeof(pthread_mutex_t));
    pthread_mutex_init(pcap_port->stats_mutex, NULL);

    if(flags->UP && flags->RUNNING) {
        return pcap_open(pcap_port);
    } else {
        pcap_port->pcap = NULL;
        pcap_port->fd   = -1;

        pcap_port->watcher = NULL;
    }

    return pcap_port;
}

int CapturePacketThread::RunCapture()
{
	Releaseinfo("RunCapture  input");
    pcap_t *adhandle;
    char errbuf[PCAP_ERRBUF_SIZE];
    u_int netmask=0xffffff;
    struct bpf_program fp;
    
    if((adhandle= pcap_open(devname.c_str(),          // name of the device
                              65536,            // portion of the packet to capture
                                                // 65536 guarantees that the whole packet will be captured on all the link layers
                              PCAP_OPENFLAG_PROMISCUOUS,    // promiscuous mode
                              1000,             // read timeout
                              NULL,             // authentication on the remote machine
                              errbuf            // error buffer
                              ) ) == NULL)
    {
		Releaseinfo("pcap_open fails");
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", devname.c_str());
        return -1;
    }
	string filter("");
	string host_str("");
	host_str = AppConfig::SharedInstance()->GetHostIp();
	filter+="host ";
	filter+=ipstr;
	filter+=" and (tcp or udp) and (not host ";
	filter+=host_str;
	filter+=")";
	//char test_filter[100]={0};
	//strcpy(test_filter,filter.c_str());
	//Releaseinfo(test_filter);
    if(pcap_compile(adhandle, &fp, filter.c_str(), 0, netmask) == -1) {
		Releaseinfo("pcap_compile fails");
        fprintf(stderr, "Error calling pcap_compile\n");
        return -1;
    }
 
    if(pcap_setfilter(adhandle, &fp) == -1) {
		Releaseinfo("pcap_setfilter fails");
        fprintf(stderr, "Error setting filter\n");
        return -1;
    }
	char user_ip[20]={0};
	strcpy(user_ip,ipstr.c_str());
    pcap_loop(adhandle, 0, PacketHandler, (u_char*)user_ip);
    return 0;
}