libpcap 使用(1)

   计算机网络自顶向下 一书中，介绍了ethereal。 该软件开源，用于抓包分析。版本最新的更名为wireshark，是目前最好的网络抓包分析工具。ethereal主要使用了gtk＋ 和 libpcap来进行设计。gtk +提供用户界面，而libpcap是unix/linux平台下的网络数据包捕获函数包，大多数网络监控软件都以它为基础。Libpcap可以在绝大多数类unix平台下工作，提供了网络监控和包捕获的功能。入侵检测系统及一些网络sniffer都是依靠它来进行的。Libpcap本身是开源的，有时间可以好好学学。

官网：http://www.tcpdump.org, 上面资料丰富。


转一简单介绍:

Who this is for: Allright peeps, this tutorial assumes at least a cursory knowledge in networks in general. For example, what a packet is, how packets are sent, physical vs datalink vs network layers etc. However, I am not assuming any previous knowledge in network programming, just a basic familiarity with c. If you already are a c/c++ master, then you might as well just man 3 pcap so you can skip my annoying writing style. You should have a working c compiler on your system and libpcap installed. We are only going to concern ourselves with Ethernet datalink layer.. so if you are using some funky network card like token ring... then you are on your own as to finding your way around the datalink headers. Finally, all source in this section was written and tested on linux, kernel 2.2.14, while it should be mostly portable (hehe) I can't guarantee that it will compile or run on other operating systems. You are going to want to run as root so be careful and be sure not to break your box in the meantime. Oh, and though I have tested and run all the code presented in this tutorial with no problems, I am NOT responsible if your shit breaks and has to be quarantined by the he