环境Ubuntu14.04,
首先你得装好环境,很多大神都写了如何用libpcap抓包,但是没有写如何存储。程序如下:
#include <pcap.h>
#include <stdlib.h>
#include <stdio.h>
int main()
{ void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data);
char errBuf[PCAP_ERRBUF_SIZE], * devStr;
/* get a device */
devStr = pcap_lookupdev(errBuf);
if(devStr)
{
printf("success! device: %s\n", devStr);
}
else
{
printf("error: %s\n", errBuf);
exit(1);
}
/* open a device, wait until a packet arrives */
pcap_t * device = pcap_open_live(devStr, 65535, 1, 0, errBuf);
if(!device)
{
printf("error: pcap_open_live(): %s\n", errBuf);
exit(1);
}
/* wait loop forever */
pcap_dumper_t * dumpfp = pcap_dump_open(device, "./save.pcap");
if(!dumpfp) {
printf("Error on opening output file\n");
exit(-1);
}
pcap_loop(device, -1, packet_handler, (u_char *)dumpfp);
pcap_dump_close(dumpfp);
pcap_close(device);
return 0;
}
void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data)
{ int i;
static int x=1;
printf("get a packet No:%d \n",x++);
pcap_dump(user, pkt_header, pkt_data);
for(i=0;i<pkt_header->len;i++)
{
printf(" %02x",pkt_data[i]);
if((i+1)%16==0) printf("\n");
}
printf("\n\n");
}