C++ pcap_open_offline函数代码示例

int main(int argc, char **argv) {

    pcap_t *handle;
    char errbuf[PCAP_ERRBUF_SIZE];
    struct pcap_pkthdr header;
    const uint8_t *packet;

    handle = pcap_open_offline(FILENAME, errbuf);
    if (handle == NULL) {
        printf("Could not open file %s: %s\n", FILENAME, errbuf);
        exit(-1);
    }

    while(packet = pcap_next(handle, &header)) {
        printf("got one packet\n");
    }

    pcap_close(handle);

    return 0;
}

void read_from_pcapfile(char *filename) {
    struct pcap_pkthdr header; // The header that pcap gives us 
    u_char *packet; // The actual packet 

    //open the pcap file 
    pcap_t *handle; 
    char errbuf[PCAP_ERRBUF_SIZE]; //not sure what to do with this, oh well 
    handle = pcap_open_offline(filename, errbuf);   //call pcap library function 
 
    if (handle == NULL) { 
        fprintf(stderr,"Couldn't open pcap file %s: %s\n", filename, errbuf); 
        exit(1); 
    }
    
   while ((packet = (u_char *)pcap_next(handle,&header))) { 
        uint8_t size;

        // header contains information about the packet (e.g. timestamp) 
        u_char *pkt_ptr;

        /* check if packet looks like USB comms to watch */
        /* USBPcap in windows captures 91 byte packets, 
         * must check Linux */
        if (header.caplen == 91 &&
            // usbpcap magic bytes
            packet[0] == 0x1b && 
            packet[1] == 0x00 &&
            // watch i/o endpoints:
            (packet[21] == 0x05 || packet[21] == 0x84)) {

            pkt_ptr = &packet[27]; // start of usb data
            size = packet[28] + 2;

            print_packet(pkt_ptr, size);
        }
    } 

    pcap_close(handle);  //close the pcap file 

}

int handle_pcap_file(char* filename){

	initialize_default_interface();

	struct pcap_pkthdr* header = (struct pcap_pkthdr*)malloc(sizeof(struct pcap_pkthdr));
	const u_char *packet; // The actual packet
	pcap_t *handle;
	char errbuf[PCAP_ERRBUF_SIZE];
	handle = pcap_open_offline(filename, errbuf);   //call pcap library function

	if (handle == NULL) {
		printf("Couldn't open pcap file %s: \n", filename);
		return 0;
	}

	struct network_interface* interface =
			get_network_interface("wlan0","6c:71:d9:6a:74:45");
	struct pcap_handler_argument arg;
	arg.source = interface;
	arg.dest = NULL;
	arg.is_pcap = 1; //setting pcap mode on

	char* ofilename = (char*)malloc(256);
	strcpy(ofilename, "outdump");

	//pcap_t* pd = pcap_open_dead(DLT_EN10MB, 65535);
	if (ofilename != NULL){
		dumpfile=pcap_dump_open(handle, ofilename);
		if(dumpfile==NULL){
			printf("\nError opening output file\n");
			return 0;
		}
	}
	while (packet = pcap_next(handle,header)) {
		disassemble_packet((u_char*)&arg, header, packet);
	}
	pcap_close(handle);
	return 1;

}

int main(int argc, char *argv[])
{
	pcap_t *pcap;
	const u_char *packet;
	struct pcap_pkthdr header;
	struct bpf_program fp;
	bpf_u_int32 devnet=0, devmask;

	signal(SIGINT, intHandler);

	parse_options(argc, argv);

	if (live_pcap) {
		 if (pcap_lookupnet(capdev, &devnet, &devmask, errbuf) == -1) {
			 fprintf(stderr, "WARNING: Can't get netmask for device %s\n", capdev);
			 devnet = 0;
			 devmask = 0;
		 }

		pcap = pcap_open_live(capdev, BUFSIZ, 1, 1000, errbuf);

	} else {
		pcap = pcap_open_offline(capfile, errbuf);
	}

	if (has_expression) {
		if (pcap_compile(pcap, &fp, capture_expression, 0, devnet) == -1) error(pcap_geterr(pcap));
		if (pcap_setfilter(pcap, &fp) == -1) error(pcap_geterr(pcap)); 
	}

	if (pcap == NULL) error(errbuf);

	pcap_loop(pcap, -1, &process_packet, NULL);

	pcap_close(pcap);

	print_stat();

	exit(0);
}

char*  determine_server_ip() {
  int count = 0;
  pcap_t *handle;
  handle = pcap_open_offline(file, errbuff);
  const u_char *packet;
  struct pcap_pkthdr header;

  const struct ip *ip;              /* The IP header */

  while(count<3){
    packet = pcap_next(handle, &header);

    ip = (struct ip*)(packet + SIZE_ETHERNET);
    
    if(ip->ip_p==IPPROTO_TCP) {
      return inet_ntoa(ip->ip_dst);
    }
    count++;
  }  
  
  return 0;
}

 int main(int argc, char *argv[]) {
               char *dev;
               char errbuf[PCAP_ERRBUF_SIZE];
               bpf_u_int32 net;
               bpf_u_int32 netmask;
               struct in_addr net_addr, mask_addr;
               pcap_t *pd;
       
               if(!(dev = pcap_lookupdev(errbuf))) {
                       perror(errbuf);
                       exit(1);
               }
       
               if(pcap_lookupnet(dev, &net, &netmask, errbuf) < 0) {
                       perror(errbuf);
                       exit(1);
               }
       
               net_addr.s_addr = net;
               mask_addr.s_addr = netmask;
       
               printf("Device : %s\n", dev);
               printf("Net Address : %s\n", inet_ntoa(net_addr));
               printf("Netmask : %s\n", inet_ntoa(mask_addr));
       
               if((pd = pcap_open_offline("icmp2.pcap", errbuf)) == NULL) {
                       perror(errbuf);
                       exit(1);
               }
       
               if(pcap_loop(pd, PCAP_CNT_MAX, packet_view, 0) < 0) {
                       perror(pcap_geterr(pd));
                       exit(1);
               }
       
               pcap_close(pd);
       
               return 1;
       }

int
tc_offline_init(tc_event_loop_t *event_loop, char *pcap_file)
{
#if (!TCPCOPY_PCAP_SEND)
    int  fd;
#endif
    char ebuf[PCAP_ERRBUF_SIZE];

#if (!TCPCOPY_PCAP_SEND)
    /* init the raw socket to send */
    if ((fd = tc_raw_socket_out_init()) == TC_INVALID_SOCKET) {
        return TC_ERROR;
    } else {
        tc_raw_socket_out = fd;
    }
#else
    tc_pcap_send_init(clt_settings.output_if_name, clt_settings.mtu);
#endif

    if (pcap_file == NULL) {
        return TC_ERROR;
    }

    if ((clt_settings.pcap = pcap_open_offline(pcap_file, ebuf)) == NULL) {
        tc_log_info(LOG_ERR, 0, "open %s" , ebuf);
        fprintf(stderr, "open %s\n", ebuf);
        return TC_ERROR;
    }

    gettimeofday(&base_time, NULL);
    tc_log_info(LOG_NOTICE, 0, "open pcap success:%s", pcap_file);
    tc_log_info(LOG_NOTICE, 0, "send the first packets here");
    send_packets_from_pcap(1);

    /* register a timer for offline */
    tc_event_timer_add(event_loop, 0, tc_process_offline_packet);

    return TC_OK;
}

unsigned int* read_rtp_seq(const char *fpcap, int dport, int n)
{
    pcap_t *fp;
    char errbuf[PCAP_ERRBUF_SIZE];
    struct pcap_pkthdr *header;
    const u_char *pkt_data;

    unsigned int seq;
    int res, i = 0;

    ip_header *ih;
    udp_header *uh;
    u_int ip_len;


    unsigned int* tseq = (unsigned int*)malloc(n*sizeof(unsigned int));

    fp = pcap_open_offline(fpcap, errbuf);

    /* Retrieve the packets from the file */
    while((res = pcap_next_ex(fp, &header, &pkt_data)) >= 0)
    {
        /* retireve the position of the ip header */
        ih = (ip_header *) (pkt_data +  14); //length of ethernet header

        /* retireve the position of the udp header */
        ip_len = (ih->ver_ihl & 0xf) * 4;
        uh = (udp_header *) ((u_char*)ih + ip_len);

        if( ntohs(uh->dport) ==	dport) {
            memcpy (&seq, pkt_data + 44, 2);
            tseq[i] = ntohs(seq);
            i++;
        }
    }
    pcap_close(fp);

    return tseq;
}

    int
epcap_open(EPCAP_STATE *ep)
{
    char errbuf[PCAP_ERRBUF_SIZE];

    if (ep->file) {
        PCAP_ERRBUF(ep->p = pcap_open_offline(ep->file, errbuf));
    } else {
        if (ep->dev == NULL)
            PCAP_ERRBUF(ep->dev = pcap_lookupdev(errbuf));

        PCAP_ERRBUF(ep->p = pcap_open_live(ep->dev, ep->snaplen, ep->promisc, ep->timeout, errbuf));

        /* monitor mode */
#ifdef PCAP_ERROR_RFMON_NOTSUP
        if (pcap_can_set_rfmon(ep->p) == 1)
            (void)pcap_set_rfmon(ep->p, ep->rfmon);
#endif
    }

    return (0);
}

static void openPcapFileOrDevice(void)
{
  u_int snaplen = 1514;
  int promisc = 1;
  char errbuf[PCAP_ERRBUF_SIZE];
  
  if((_pcap_handle = pcap_open_live(_pcap_file, snaplen, promisc, 500, errbuf)) == NULL) {
    _pcap_handle = pcap_open_offline(_pcap_file, _pcap_error_buffer);
    capture_until = 0;

    if (_pcap_handle == NULL) {
      printf("ERROR: could not open pcap file: %s\n", _pcap_error_buffer);
      exit(-1);
    } else
      printf("Reading packets from pcap file %s...\n", _pcap_file);
  } else
    printf("Capturing live traffic from device %s...\n", _pcap_file);

  _pcap_datalink_type = pcap_datalink(_pcap_handle);

  if(_bpf_filter != NULL) {
    struct bpf_program fcode;

    if(pcap_compile(_pcap_handle, &fcode, _bpf_filter, 1, 0xFFFFFF00) < 0) {
      printf("pcap_compile error: '%s'\n", pcap_geterr(_pcap_handle));
    } else {
      if(pcap_setfilter(_pcap_handle, &fcode) < 0) {
	printf("pcap_setfilter error: '%s'\n", pcap_geterr(_pcap_handle));
      } else
	printf("Succesfully set BPF filter to '%s'\n", _bpf_filter);
    }
  }

  if(capture_until > 0) {
    printf("Capturing traffic up to %u seconds\n", (unsigned int)capture_until);
    capture_until += time(NULL);
  }
}

TmEcode InitPcapFile(PcapFileFileVars *pfv)
{
    char errbuf[PCAP_ERRBUF_SIZE] = "";

    if(unlikely(pfv->filename == NULL)) {
        SCLogError(SC_ERR_INVALID_ARGUMENT, "Filename was null");
        SCReturnInt(TM_ECODE_FAILED);
    }

    pfv->pcap_handle = pcap_open_offline(pfv->filename, errbuf);
    if (pfv->pcap_handle == NULL) {
        SCLogError(SC_ERR_FOPEN, "%s", errbuf);
        SCReturnInt(TM_ECODE_FAILED);
    }

    if (pfv->shared != NULL && pfv->shared->bpf_string != NULL) {
        SCLogInfo("using bpf-filter \"%s\"", pfv->shared->bpf_string);

        if (pcap_compile(pfv->pcap_handle, &pfv->filter, pfv->shared->bpf_string, 1, 0) < 0) {
            SCLogError(SC_ERR_BPF, "bpf compilation error %s for %s",
                       pcap_geterr(pfv->pcap_handle), pfv->filename);
            SCReturnInt(TM_ECODE_FAILED);
        }

        if (pcap_setfilter(pfv->pcap_handle, &pfv->filter) < 0) {
            SCLogError(SC_ERR_BPF,"could not set bpf filter %s for %s",
                       pcap_geterr(pfv->pcap_handle), pfv->filename);
            SCReturnInt(TM_ECODE_FAILED);
        }
    }

    pfv->datalink = pcap_datalink(pfv->pcap_handle);
    SCLogDebug("datalink %" PRId32 "", pfv->datalink);

    Decoder temp;
    TmEcode validated = ValidateLinkType(pfv->datalink, &temp);
    SCReturnInt(validated);
}

int main(int argc, char **argv)
{
	char errbuf[PCAP_ERRBUF_SIZE];
	pcap_t *pcap_src = NULL;

	opt_register_table(opts, NULL);

	if (!opt_parse(&argc, argv, opt_log_stderr))
		return 1;

	if (!g_ifc_name && !g_file_name)
		return err_ret("No packet source specified\n");
	if (g_ifc_name && g_file_name)
		return err_ret("Both file and interface source specified\n");

	if (g_ifc_name)
		pcap_src = pcap_open_live(g_ifc_name, PCAP_SNAPLEN_ALL,
					  1, -1, errbuf);
	else if (g_file_name)
		pcap_src = pcap_open_offline(g_file_name, errbuf);

	if (!pcap_src) {
		fprintf(stderr, "Couldn't open packet source: %s\n", errbuf);
		return 1;
	}

	pcap_loop(pcap_src, PCAP_CNT_INF, packet_cb, NULL);

	pcap_close(pcap_src);

	if (g_dump)
		dist_dump(dist1, dist2, dist_min);

	if (g_hm)
		hm_dump();

	return 0;
}

int main(int argc, char *argv[])
{
  char *f;
  char errbuf[PCAP_ERRBUF_SIZE];
  pcap_t *pc;
  FILE *out = stdout;

  while(--argc>0) {
    f = *++argv;

    pc = pcap_open_offline(f, errbuf);
    if(pc == NULL) {
      fprintf(stderr, "pcap_open_offline(%s): %s\n",
	      f, errbuf);
      exit(10);
    }

    pcap_dispatch(pc, -1, pcap_skbuff, (u_char *)out);
    pcap_close(pc);
  }

  exit(0);
}

/*
 * Class:     disy_jnipcap_Pcap
 * Method:    openOffline
 * Signature: (Ljava/lang/String;Ljava/lang/StringBuilder;)J
 */
JNIEXPORT jlong JNICALL
Java_disy_jnipcap_Pcap_openOffline (JNIEnv *env, jclass jcls, jstring jfname, jobject jerrbuf)
{
	if (jfname == NULL || jerrbuf == NULL) {
		throwException (env, "Ljava/lang/NullPointerException;", NULL);
		return (jlong) NULL;
	}
	char errbuf[PCAP_ERRBUF_SIZE];
	errbuf[0] = '\0';
	const char *fname = (*env)->GetStringUTFChars (env, jfname, 0);
	
	pcap_t *p = pcap_open_offline(fname, errbuf);
	(*env)->ReleaseStringUTFChars (env, jfname, fname);
	buildString (env, jerrbuf, 0, errbuf);
	
	if (p == NULL) return (jlong) NULL;
	if (mid_Pcap_init == NULL) {
		pcap_close (p);
		return (jlong) NULL;
	}
	
	return (jlong) p;
}

static captureObject *
newcaptureObjectFile(char *filename)
{
    char errbuf[PCAP_ERRBUF_SIZE];
    captureObject *self;

    self = PyObject_New(captureObject, &capture_Type);
    if (self == NULL)
        return NULL;

    self->device = NULL;
    self->filename = PyMem_New(char, strlen(filename));
    strcpy(self->filename, filename);
    self->pcap = pcap_open_offline(filename, errbuf);

    if (! self->pcap)
    {
        PyMem_Free(self->device);
        PyErr_SetString(ErrorObject, errbuf);
        return NULL;
    }
    return self;
}