Winpcap示例,Libpcap示例

换下头文件就可以在winpcap和libpcap之间通用了，且有详细注释

#include <stdio.h> 

#include <string.h>

#include <pcap.h>

#include <winsock.h>

 

struct ether_header

{

 u_int8_t ether_dhost[6];

 u_int8_t ether_shost[6];

 u_int16_t ether_type;

};

 

 

struct my_ip

{

  u_int8_t ip_vhl;/* header length, version */

#define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4)

#define IP_HL(ip) ((ip)->ip_vhl & 0x0f)

  u_int8_t ip_tos;/* type of service */

  u_int16_t ip_len;/* total length */

  u_int16_t ip_id;/* identification */

  u_int16_t ip_off;/* fragment offset field */

#define IP_DF 0x4000/* dont fragment flag */

#define IP_MF 0x2000/* more fragments flag */

#define IP_OFFMASK 0x1fff/* mask for fragmenting bits */

  u_int8_t ip_ttl;/* time to live */

  u_int8_t ip_p;/* protocol */

  u_int16_t ip_sum;/* checksum */

  struct in_addr ip_src,ip_dst;/* source and dest address */

};

 

struct tcphdr

{

 u_int16_t source;

 u_int16_t dest;

 u_int32_t tcp_sequence_num;

 u_int32_t ack_seq;

#ifdef WORDS_BIGENDIAN

 u_int8_t tcp_offset:4,tcp_offset:4;

#else

 u_int8_t tcp_reserved:4,tcp_offset:4;

#endif

 u_int8_t tcp_flags;

 u_int16_t tcp_windows;

 u_int16_t tcp_checksum;

 u_int16_t tcp_urent_pointer;

};

 

void work(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet)

{

  const struct my_ip* ip;

  u_int length = pkthdr->len;

  u_int hlen,off,version;

  struct tcphdr *tcpptr;

  char buf[25];

 

  u_int len;

 

  /* jump pass the ethernet header */

  ip = (struct my_ip*)(packet + sizeof(struct ether_header));

  length -= sizeof(struct ether_header);

  /* check to see we have a packet of valid length */

  if (length < sizeof(struct my_ip))

    {

      printf("truncated ip %d",length);

    }

  len     = ntohs(ip->ip_len);

  hlen    = IP_HL(ip); /* header length */

  version = IP_V(ip);/* ip version */

 

  /* check version */

  if(version != 4)

    {

      fprintf(stdout,"Unknown version %d/n",version);

    }

 

 

if(hlen < 5 )

    {

      fprintf(stdout,"bad-hlen %d /n",hlen);

    }

 

  /* see if we have as much packet as we should */

  if(length < len)

    printf("/ntruncated IP - %d bytes missing/n",len - length);

 

  /* Check to see if we have the first fragment */

  off = ntohs(ip->ip_off);

 

  tcpptr = (struct tcphdr*)(packet+sizeof(struct ether_header)+sizeof(struct my_ip));

  

  if((off& 0x1fff) == 0 && strstr(inet_ntoa(ip->ip_src),"192.168.13.")==NULL)/* aka no 1's in first 13 bits */

    {/* print SOURCE DESTINATION hlen version len offset */

      //strftime(buf,24,"%Y-%m-%d %H:%M:%S",localtime(&(pkthdr->ts.tv_sec)));

      fprintf(stdout,"IP: ",buf);

      fprintf(stdout,"%s ",

              inet_ntoa(ip->ip_src));

      fprintf(stdout,"%s %d %d %d %d %d",

              inet_ntoa(ip->ip_dst),

              hlen,version,len,off,ip->ip_p);

 fprintf(stdout," %d %d/n",ntohs(tcpptr->source),ntohs(tcpptr->dest));

    }

}

 

 

int main(void) 

{ 

  char *dev;

  char errbuf[PCAP_ERRBUF_SIZE];

  pcap_if_t *alldevs;

  struct in_addr addr;

 

  pcap_t* descr;

  struct bpf_program fp;      /* hold compiled program     */

  bpf_u_int32 maskp;          /* subnet mask               */

  bpf_u_int32 netp;           /* ip                        */

    pcap_findalldevs(&alldevs, errbuf);

  dev=alldevs->next->next->name;

  printf("%s/n",dev);

  

  pcap_lookupnet(dev,&netp,&maskp,errbuf);

  addr.s_addr=netp;

  printf("%s/n",inet_ntoa(addr));

  descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf);

  pcap_compile(descr,&fp,"ip and dst host 192.168.13.177 and port 80",0,netp);

  pcap_setfilter(descr,&fp);

  pcap_loop(descr,-1,work,NULL);

}