Java PcapBpfProgram类代码示例

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
/**
 * Open offline.
 * 
 * @param file
 *          the file
 * @param handler
 *          the handler
 * @param filter
 *          the filter
 */
public static void openOffline(String file,
		JPacketHandler<Pcap> handler,
		String filter) {
	StringBuilder errbuf = new StringBuilder();

	Pcap pcap;

	if ((pcap = Pcap.openOffline(file, errbuf)) == null) {
		fail(errbuf.toString());
	}

	if (filter != null) {
		PcapBpfProgram program = new PcapBpfProgram();
		if (pcap.compile(program, filter, 0, 0) != Pcap.OK) {
			System.err.printf("pcap filter err: %s\n", pcap.getErr());
		}

		pcap.setFilter(program);
	}

	pcap.loop(Pcap.LOOP_INFINATE, handler, pcap);

	pcap.close();
}
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
public synchronized void setFilter(String filter_str)throws PcapException {
  	
  	// pcap.compile to define packet filter operation
      final int optimize = 1;   // 1 = true  
      final int netmask = 0; 	// 0
      
  	// We setup the packet filter 
  	packet_filter_program = new PcapBpfProgram();
  	
  	// We compile the filter
  	if (pcap.compile(packet_filter_program, filter_str, optimize, netmask) != Pcap.OK) 
      {  
  		throw new PcapException("failed to compile filter: " + filter_str + pcap.getErr()); 
      }
  	
  	// We set the filter
if (pcap.setFilter(packet_filter_program) != Pcap.OK) 
{
	throw new PcapException("failed to set filter: " + filter_str + pcap.getErr()); 
}
  }
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
public static boolean compile(String interfaceName, String filter) {

        StringBuilder errBuf = new StringBuilder();
        Pcap pcap = Pcap.openLive(interfaceName,
                Pcap.DEFAULT_SNAPLEN,
                Pcap.DEFAULT_PROMISC,
                Pcap.DEFAULT_TIMEOUT,
                errBuf);

        if (pcap == null) {
            System.err.println("Error while open device interface:" + errBuf);
            return false;
        }

        PcapBpfProgram program = new PcapBpfProgram();
        int optimize = 0;
        int netmask = 0xFFFFFF00;
        if (pcap.compile(program, filter, optimize, netmask) != Pcap.OK) {
            return false;
        }

        pcap.close();
        return true;
//        int len = 64 * 1024;
//        int datalinkType = Ethernet.EthernetType.IP4.getId();
//        int optimize = 0;
//        int netmask = 0xFFFFFF00;
//        filterProgram = new PcapBpfProgram();
//        if (Pcap.compileNoPcap(len, datalinkType, filterProgram, filter, 0, netmask) != Pcap.OK) {
//            filterProgram = null;       // 如果编译失败将其置为null，避免错误使用
//            System.err.println("error");
//            return false;
//        }
//        return true;
    }
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
private static void setupFilter(Pcap pcap, String expression) throws Exception {
    PcapBpfProgram program = new PcapBpfProgram();
    final int netmask = (int)Long.parseLong(CaptureSettings.FILTER_NETWORK_MASK_HEX.toLowerCase(), 16);
    if (pcap.compile(program, expression, CaptureSettings.OPTIMIZE_FILTER ? 1 : 0, netmask) != Pcap.OK)
        throw new Exception("Error compiling LIBPCAP filter: " + pcap.getErr());

    if (pcap.setFilter(program) != Pcap.OK)
        throw new Exception("Error setting LIBPCAP filter: " + pcap.getErr());
}
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
/**
 * 
 * Sets a filter for a given {@link Pcap} instance. The filterExpression is
 * a String following the format as explained e.g. in PCAP-FILTER(7).
 * 
 * @param pcap
 * @param filterExpression
 */
public static void setFilter(Pcap pcap, String filterExpression) {
    PcapBpfProgram filter = new PcapBpfProgram();
    if (pcap.compile(filter, filterExpression, 1, 0) != Pcap.OK) {
    	log.error("Filter not compilable: " + pcap.getErr());
    	throw new RuntimeException("Failed to compile filter: "
                + pcap.getErr());
    }
    if (pcap.setFilter(filter) != Pcap.OK) {
    	log.error("Filter not settable: " + pcap.getErr());
        throw new RuntimeException("Failed to set filter: " + pcap.getErr());
    }
}
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
@Test
public void filterTcpSyn() throws InterruptedException {
    PcapBpfProgram filter = new PcapBpfProgram();
    if (pcap.compile(filter, "tcp[tcpflags] & tcp-syn != 0", 1, 0) != Pcap.OK) {
        throw new RuntimeException("Failed to compile filter: "
                + pcap.getErr());
    }

    if (pcap.setFilter(filter) != Pcap.OK) {
        throw new RuntimeException("Failed to set filter: " + pcap.getErr());
    }

    Client client = new Client();
    client.startClient(TestConstants.CAPTURE_DELAY);

    /*
     * Break the loop when we receive a TCP packet with the SYN flag set.
     */
    int ret = pcap.loop(Pcap.LOOP_INFINITE,
            new PcapPacketHandler<Object>() {
                @Override
                public void nextPacket(PcapPacket p, Object arg1) {
                    if (p.hasHeader(tcp)
                            && tcp.destination() == TestConstants.TCP_TEST_PORT
                            && tcp.flags_SYN()) {
                        pcap.breakloop();
                    }
                }
            }, null);

    /*
     * As we break the loop we check the return value if this was correctly
     * done.
     */
    assertEquals(Pcap.ERROR_BREAK, ret);
}
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
@Test
public void filterTcpFin() throws InterruptedException {
    PcapBpfProgram filter = new PcapBpfProgram();
    if (pcap.compile(filter, "tcp[tcpflags] & tcp-fin != 0", 1, 0) != Pcap.OK) {
        throw new RuntimeException("Failed to compile filter: "
                + pcap.getErr());
    }

    if (pcap.setFilter(filter) != Pcap.OK) {
        throw new RuntimeException("Failed to set filter: " + pcap.getErr());
    }

    Client client = new Client();
    client.startClient(TestConstants.CAPTURE_DELAY);

    /*
     * Break the loop when we receive a TCP packet with the FIN flag set.
     */
    int ret = pcap.loop(Pcap.LOOP_INFINITE,
            new PcapPacketHandler<Object>() {
                @Override
                public void nextPacket(PcapPacket p, Object arg1) {
                    if (p.hasHeader(tcp)
                            && tcp.destination() == TestConstants.TCP_TEST_PORT
                            && tcp.flags_FIN()) {
                        pcap.breakloop();
                    }
                }
            }, null);

    /*
     * As we break the loop we check the return value if this was correctly
     * done.
     */
    assertEquals(Pcap.ERROR_BREAK, ret);
}
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
public void captureLive(OnCapturePacketListener listener) {
        if (networkAdapter == null || networkAdapter.getPcapIf() == null) {
            System.err.println("Network adapter is null");
            return ;
        }
        stopCapture();

        PcapIf pcapIf = networkAdapter.getPcapIf();
        StringBuilder errBuf = new StringBuilder();
        pcap = Pcap.openLive(pcapIf.getName(),
                Pcap.DEFAULT_SNAPLEN,
                Pcap.DEFAULT_PROMISC,
                Pcap.DEFAULT_TIMEOUT,
                errBuf);
        if (pcap == null) {
            System.err.println("Error while open device interface:" + errBuf);
            return ;
        }

        if (filterExp != null && !filterExp.isEmpty()) {
            int optimize = 1;
            int netmask = 0xFFFFFF00;
            PcapBpfProgram program = new PcapBpfProgram();
            if (pcap.compile(program, filterExp, optimize, netmask) != Pcap.OK) {
                System.err.println("Invalid capture filter expression!");
            } else {
                pcap.setFilter(program);
            }
        }

        task = new Task<Void>() {

            @Override
            protected Void call() throws Exception {

                PcapPacketHandler<Void> handler = new PcapPacketHandler<Void>() {

                    @Override
                    public void nextPacket(PcapPacket pcapPacket, Void aVoid) {
//                        if (Config.getTimestamp() <= Config.DEFAULT_TIMESTAMP) {
//                            Config.setTimestamp(pcapPacket.getCaptureHeader().timestampInMicros());
//                        }
//                        packetInfos.add(new PacketInfo(pcapPacket));
//                        // 通知更新
//                        updateProgress(packetInfos.size(), Long.MAX_VALUE);
                        if (listener != null) {
                            listener.onCapture(pcapPacket);
                        }
                    }
                };
                pcap.loop(-1, handler, null);

                return null;
            }

        };

        Thread thread = new Thread(task);
        thread.setDaemon(true);
        thread.start();
    }
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
/**
 * Returns if a given filter applies to an offline packet. This function is
 * used to apply a filter to a packet that is currently in memory. This
 * process does not need to open an adapter; we need just to create the proper
 * filter (by settings parameters like the snapshot length, or the link-layer
 * type) by means of the pcap_compile_nopcap(). The current API of libpcap
 * does not allow to receive a packet and to filter the packet after it has
 * been received. However, this can be useful in case you want to filter
 * packets in the application, instead of into the receiving process. This
 * function allows you to do the job.
 * 
 * @param program
 *          bpf filter
 * @param caplen
 *          length of the captured packet
 * @param len
 *          length of the packet on the wire
 * @param buf
 *          buffer containing packet data
 * @return snaplen of the packet or 0 if packet should be rejected
 */
@LibraryMember("pcap_findalldevs_ex")
public static native int offlineFilter(PcapBpfProgram program,
		int caplen,
		int len,
		ByteBuffer buf);
 

import org.jnetpcap.PcapBpfProgram; //导入依赖的package包/类
/**
 * Returns if a given filter applies to an offline packet. This function is
 * used to apply a filter to a packet that is currently in memory. This
 * process does not need to open an adapter; we need just to create the proper
 * filter (by settings parameters like the snapshot length, or the link-layer
 * type) by means of the pcap_compile_nopcap(). The current API of libpcap
 * does not allow to receive a packet and to filter the packet after it has
 * been received. However, this can be useful in case you want to filter
 * packets in the application, instead of into the receiving process. This
 * function allows you to do the job.
 * 
 * @param program
 *          bpf filter
 * @param caplen
 *          length of the captured packet
 * @param len
 *          length of the packet on the wire
 * @param buf
 *          buffer containing packet data
 * @return snaplen of the packet or 0 if packet should be rejected
 */
public static native int offlineFilter(PcapBpfProgram program,
		int caplen,
		int len,
		ByteBuffer buf);