基于libpcap的抓包与存储程序

  环境Ubuntu14.04，

  首先你得装好环境，很多大神都写了如何用libpcap抓包，但是没有写如何存储。程序如下：

#include <pcap.h>   
#include <stdlib.h>  
#include <stdio.h>  

int main()  
{ void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data);
  char errBuf[PCAP_ERRBUF_SIZE], * devStr;     
  /* get a device */  
  devStr = pcap_lookupdev(errBuf);     
  if(devStr)  
  {  
    printf("success! device: %s\n", devStr);  
  }  
  else  
  {  
    printf("error: %s\n", errBuf);  
    exit(1);  
  }      
  /* open a device, wait until a packet arrives */  
  pcap_t * device = pcap_open_live(devStr, 65535, 1, 0, errBuf);      
  if(!device)  
  {  
    printf("error: pcap_open_live(): %s\n", errBuf);  
    exit(1);  
  }      
  /* wait loop forever */  
  pcap_dumper_t *  dumpfp = pcap_dump_open(device, "./save.pcap");
    if(!dumpfp) {
        printf("Error on opening output file\n");
        exit(-1);
    }
  pcap_loop(device, -1, packet_handler, (u_char *)dumpfp);  
  pcap_dump_close(dumpfp);
  pcap_close(device);  
  return 0;  
}

void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data)
{ int i;
  static int  x=1;
  printf("get a packet No:%d \n",x++);
  pcap_dump(user, pkt_header, pkt_data);
 for(i=0;i<pkt_header->len;i++)
  {
    printf(" %02x",pkt_data[i]);
    if((i+1)%16==0) printf("\n");
  }
 printf("\n\n");
}