pcap读写pcap文件

 

 1 #include <stdio.h>
 2 #include <stdint.h>
 3 #include <stdlib.h>
 4 
 5 #include <pcap.h>
 6 
 7 ////
 8 
 9 // ./a.out [源文件]
10 int main(int argc, char **argv)
11 {
12     pcap_t  *pcap = NULL;
13     struct  pcap_pkthdr *pcaphdr = NULL;
14     pcap_dumper_t *dump;
15     const uint8_t *pktdata = NULL;
16     int ret = -1;
17 
18     if (argc < 2)
19     {
20         fprintf(stderr, "arg err\n");
21         exit(1);
22     }
23 
24     pcap = pcap_open_offline(argv[1], NULL);
25     dump = pcap_dump_open(pcap, argv[2]);
26 
27     ret = pcap_next_ex(pcap, &pcaphdr, &pktdata);
28     for (; ret == 1; ret = pcap_next_ex(pcap, &pcaphdr, &pktdata) )
29     {
30         pcap_dump((uint8_t *)dump, pcaphdr, pktdata);
31     }
32 
33     pcap_close(pcap);
34     pcap_dump_flush(dump);
35     pcap_dump_close(dump);
36 
37     return EXIT_SUCCESS;
38 };

转载于:https://www.cnblogs.com/tiantao/archive/2012/03/15/2398572.html