读取cap文件的例子代码

#include <stdio.h>
#include <pcap.h>

#define P(format, ...) do \
        { \
            printf("%s %s %d " format "\n", __FILE__, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
            fflush(stdout); \
        } \
        while (0);

void PrintHex(const char* Buffer, int Size, FILE* fp = stderr)
{
    fprintf(fp, "start: %08X count=%d\n", (unsigned int)Buffer, Size);
    fprintf(fp, "Address: 0 1 2 3 4 5 6 7 8 9 A B C D E F\n"
                "========================================================= ");
    const char* p = NULL;
    int i;
    int nSpaceCount = (unsigned int)Buffer % 16;
    if ( nSpaceCount != 0)
    {
        fprintf(fp, "\n%08X: ", (unsigned int)Buffer-nSpaceCount);
        for (i=0; i<nSpaceCount; i++)
        {
            fprintf(fp, "   ");
        }
    }
    char line[17];
    memset(line, 0x20, sizeof(line));
    line[sizeof(line)-1] = '\0';
    for (i=0, p = Buffer; i<Size; i++, p++)
    {
        if (((unsigned int)p) % 16 == 0)
        {
            fprintf(fp, "|   [%s]\n%08X: ", line, (unsigned int)p);
        }
        fprintf(fp, "%02X ", (unsigned char)*p);
        if (*p>0x20 && *p<=0x7E)
        {
            line[(unsigned int)p % 16] = *p;
        }
        else
        {
            line[(unsigned int)p % 16] = 0x20;
        }
    }
    nSpaceCount = 16 - (unsigned int)p % 16;
    if (nSpaceCount>0)
    {
        for (i=0; i<nSpaceCount; i++)
        {
            line[i+(16-nSpaceCount)] = 0x20;
            fprintf(fp, "   ");
        }
        fprintf(fp, "|   [%s]", line);
    }

    fprintf(fp, "\n========================================================="
                "\nAddress: 0 1 2 3 4 5 6 7 8 9 A B C D E F\n"
                );
}

void TimeT2String(time_t Time, char* Buffer, int BufferSize)
{
    if (NULL == Buffer || 0 >= BufferSize)
    {
        return;
    }
    struct tm* pTM = localtime(&Time);
    strftime(Buffer, BufferSize-1, "%Y-%m-%d %H:%M:%S", pTM);
    Buffer[BufferSize-1] = '\0';
}

void test()
{
    const char* file_path = "F:/TEMP/2008-08-29/cap.cap";
    char error[PCAP_ERRBUF_SIZE];
    pcap_t* handle = pcap_open_offline(file_path, error);
    if (NULL==handle)
    {
        P("open file error:%s", error);
        return;
    }
    //
    struct pcap_pkthdr* pHead;
    char* pData;
    int nReturnCode;
    char time_str[21];
    do
    {
        nReturnCode = pcap_next_ex(handle, &pHead, (const u_char**)&pData);
        switch (nReturnCode)
        {
        case 1:
            TimeT2String(pHead->ts.tv_sec, time_str, sizeof(time_str));
            P("time=%s.%d,len=%d", time_str, (int)pHead->ts.tv_usec, pHead->len/*-sizeof(struct pcap_pkthdr)*/);
            PrintHex(pData, pHead->len);
            printf("\n");
            break;
        case 0:
            P("time out");
            continue;
            break;
        case -1:
            P("error:%s", pcap_geterr(handle));
            goto EndReadFile;
            break;
        case -2:
            P("end of file");
            goto EndReadFile;
            break;
        default:
            P("unknown code:%d", nReturnCode);
            goto EndReadFile;
            break;
        }
    } while(1);
    //
EndReadFile:
    pcap_close(handle);
    handle = NULL;
}

int main()
{
    test();
    return 1;
}

/*
g++ -o main.o -c main.cpp -g -Wall -Werror -I"F:\AoTainFaundationLibrary\Library\WinPcap\include"
g++ -o main.exe main.o "F:\AoTainFaundationLibrary\Library\WinPcap\lib\libwpcap.a"
main.exe
pause
*/