pcap_loop, pcap_dispatch - process packets from a live capture or savefile
处理抓取的数据包
函数原型
#include <pcap/pcap.h>
typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h, const u_char *bytes);
int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user);
int pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user);
pcap_loop()处理捕获给定的cnt个数据包,如果给定的参数cnt是-1或0,则表示将无限的捕获数据包。
回调函数pcap_handler处理具体的数据包,
回调函数有三个参数:
u_char *user参数是pcap_loop通过user(第三个参数)传递给pcap_handler的;
const struct pcap_pkthdr *h参数表示包的时间戳和长度;
const u_char *bytes参数表示h中长度的数据。
pcap_loop() processes packets from a live capture or ``savefile'' until cnt packets are processed, the end of the ``savefile'' is reached when reading from a ``savefile'', pcap_breakloop(3PCAP) is called, or an error occurs. It does not retur