Winpcap示例,Libpcap示例
换下头文件就可以在winpcap和libpcap之间通用了，且有详细注释
#include <stdio.h>
#include <string.h>
#include <pcap.h>
#include <winsock.h>
struct ether_header
{
u_int8_t ether_dhost[6];
u_int8_t ether_shost[6];
u_int16_t ether_type;
};
struct my_ip
{
u_int8_t ip_vhl;/* header length, version */
#define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4)
#define IP_HL(ip) ((ip)->ip_vhl & 0x0f)
u_int8_t ip_tos;/* type of service */
u_int16_t ip_len;/* total length */
u_int16_t ip_id;/* identification */
u_int16_t ip_off;/* fragment offset field */
#define IP_DF 0x4000/* dont fragment flag */
#define IP_MF 0x2000/* more fragments flag */
#define IP_OFFMASK 0x1fff/* mask for fragmenting bits */
u_int8_t ip_ttl;/* time to live */
u_int8_t ip_p;/* protocol */
u_int16_t ip_sum;/* checksum */
struct in_addr ip_src,ip_dst;/* source and dest address */
};
struct tcphdr
{
u_int16_t source;
u_int16_t dest;
u_int32_t tcp_sequence_num;
u_int32_t ack_seq;
#ifdef WORDS_BIGENDIAN
u_int8_t tcp_offset:4,tcp_offset:4;
#else
u_int8_t tcp_reserved:4,tcp_offset:4;
#endif
u_int8_t tcp_flags;
u_int16_t tcp_windows;
u_int16_t tcp_checksum;
u_int16_t tcp_urent_pointer;
};
void work(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet)
{
const struct my_ip* ip;
u_int length = pkthdr->len;
u_int hlen,off,version;
struct tcphdr *tcpptr;
char buf[25];
u_int len;
/* jump pass the ethernet header */
ip = (struct my_ip*)(packet + sizeof(struct ether_header));
length -= sizeof(struct ether_header);
/* check to see we have a packet of valid length */
if (length < sizeof(struct my_ip))
{
printf("truncated ip %d",length);
}
len = ntohs(ip->ip_len);
hlen = IP_HL(ip); /* header length */
version = IP_V(ip);/* ip version */
/* check version */
if(version != 4)
{
fprintf(stdout,"Unknown version %d/n",version);
}
if(hlen < 5 )
{
fprintf(stdout,"bad-hlen %d /n",hlen);
}
/* see if we have as much packet as we should */
if(length < len)
printf("/ntruncated IP - %d bytes missing/n",len - length);
/* Check to see if we have the first fragment */
off = ntohs(ip->ip_off);
tcpptr = (struct tcphdr*)(packet+sizeof(struct ether_header)+sizeof(struct my_ip));
if((off& 0x1fff) == 0 && strstr(inet_ntoa(ip->ip_src),"192.168.13.")==NULL)/* aka no 1's in first 13 bits */
{/* print SOURCE DESTINATION hlen version len offset */
//strftime(buf,24,"%Y-%m-%d %H:%M:%S",localtime(&(pkthdr->ts.tv_sec)));
fprintf(stdout,"IP: ",buf);
fprintf(stdout,"%s ",
inet_ntoa(ip->ip_src));
fprintf(stdout,"%s %d %d %d %d %d",
inet_ntoa(ip->ip_dst),
hlen,version,len,off,ip->ip_p);
fprintf(stdout," %d %d/n",ntohs(tcpptr->source),ntohs(tcpptr->dest));
}
}
int main(void)
{
char *dev;
char errbuf[PCAP_ERRBUF_SIZE];
pcap_if_t *alldevs;
struct in_addr addr;
pcap_t* descr;
struct bpf_program fp; /* hold compiled program */
bpf_u_int32 maskp; /* subnet mask */
bpf_u_int32 netp; /* ip */
pcap_findalldevs(&alldevs, errbuf);
dev=alldevs->next->next->name;
printf("%s/n",dev);
pcap_lookupnet(dev,&netp,&maskp,errbuf);
addr.s_addr=netp;
printf("%s/n",inet_ntoa(addr));
descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf);
pcap_compile(descr,&fp,"ip and dst host 192.168.13.177 and port 80",0,netp);
pcap_setfilter(descr,&fp);
pcap_loop(descr,-1,work,NULL);
}