#include <stdio.h>
#include <pcap.h>#define LINE_LEN 16void dispatcher_handler(u_char *, const struct pcap_pkthdr *, const u_char *);int main(int argc, char **argv)
{
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
char source[PCAP_BUF_SIZE];if(argc != 2){printf("usage: %s filename", argv[0]);return -1;}/* Create the source string according to the new WinPcap syntax */if ( pcap_createsrcstr( source,         // variable that will keep the source stringPCAP_SRC_FILE,  // we want to open a fileNULL,           // remote hostNULL,           // port on the remote hostargv[1],        // name of the file we want to openerrbuf          // error buffer) != 0){fprintf(stderr,"\nError creating a source string\n");return -1;}/* Open the capture file */if ( (fp= pcap_open(source,         // name of the device65536,          // portion of the packet to capture// 65536 guarantees that the whole packet will be captured on all the link layersPCAP_OPENFLAG_PROMISCUOUS,     // promiscuous mode1000,              // read timeoutNULL,              // authentication on the remote machineerrbuf         // error buffer) ) == NULL){fprintf(stderr,"\nUnable to open the file %s.\n", source);return -1;}// read and dispatch packets until EOF is reachedpcap_loop(fp, 0, dispatcher_handler, NULL);return 0;
}void dispatcher_handler(u_char *temp1, const struct pcap_pkthdr *header, const u_char *pkt_data)
{u_int i=0;/** Unused variable*/(VOID)temp1;/* print pkt timestamp and pkt len */printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);          /* Print the packet */for (i=1; (i < header->caplen + 1 ) ; i++){printf("%.2x ", pkt_data[i-1]);if ( (i % LINE_LEN) == 0) printf("\n");}printf("\n\n");     }

#include <stdio.h>
#include <pcap.h>#define LINE_LEN 16int main(int argc, char **argv)
{
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
char source[PCAP_BUF_SIZE];
struct pcap_pkthdr *header;
const u_char *pkt_data;
u_int i=0;
int res;if(argc != 2){printf("usage: %s filename", argv[0]);return -1;}/* Create the source string according to the new WinPcap syntax */if ( pcap_createsrcstr( source,         // variable that will keep the source stringPCAP_SRC_FILE,  // we want to open a fileNULL,           // remote hostNULL,           // port on the remote hostargv[1],        // name of the file we want to openerrbuf          // error buffer) != 0){fprintf(stderr,"\nError creating a source string\n");return -1;}/* Open the capture file */if ( (fp= pcap_open(source,         // name of the device65536,          // portion of the packet to capture// 65536 guarantees that the whole packet will be captured on all the link layersPCAP_OPENFLAG_PROMISCUOUS,     // promiscuous mode1000,              // read timeoutNULL,              // authentication on the remote machineerrbuf         // error buffer) ) == NULL){fprintf(stderr,"\nUnable to open the file %s.\n", source);return -1;}/* Retrieve the packets from the file */while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0){/* print pkt timestamp and pkt len */printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);          /* Print the packet */for (i=1; (i < header->caplen + 1 ) ; i++){printf("%.2x ", pkt_data[i-1]);if ( (i % LINE_LEN) == 0) printf("\n");}printf("\n\n");     }if (res == -1){printf("Error reading the packets: %s\n", pcap_geterr(fp));}return 0;
}

Writing packets to a dump file with pcap_live_dump

注意：由于新内核缓冲区存在一些问题，此功能已被禁用。

WinPcap的最新版本提供了一种将网络流量节省到pcap_live_dump（）函数的另一种方法。pcap_live_dump（）具有三个参数：一个文件名，允许该文件达到的最大大小（以字节为单位），以及该文件允许包含的最大数据包数。零表示对这两个值没有限制。请注意，在调用pcap_live_dump（）之前，该程序可以设置一个过滤器（使用pcap_setfilter（），请参阅过滤流量），以定义要保存的流量的子集。

pcap_live_dump（）是非阻塞的，因此它将启动转储并立即返回：转储进程异步进行，直到达到最大文件大小或最大数据包数。

应用程序可以使用pcap_live_dump_ended（）等待或检查转储结束。请注意，如果同步参数非零，如果极限均为0，此功能将永久阻止应用程序。

#include <stdlib.h>
#include <stdio.h>#include <pcap.h>#error At the moment the kernel dump feature is not supported in the drivermain(int argc, char **argv) {pcap_if_t *alldevs, *d;pcap_t *fp;u_int inum, i=0;char errbuf[PCAP_ERRBUF_SIZE];printf("kdump: saves the network traffic to file using WinPcap kernel-level dump faeature.\n");printf("\t Usage: %s [adapter] | dump_file_name max_size max_packs\n", argv[0]);printf("\t Where: max_size is the maximum size that the dump file will reach (0 means no limit)\n");printf("\t Where: max_packs is the maximum number of packets that will be saved (0 means no limit)\n\n");if(argc < 5){/* The user didn't provide a packet source: Retrieve the device list */if (pcap_findalldevs(&alldevs, errbuf) == -1){fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);exit(1);}/* Print the list */for(d=alldevs; d; d=d->next){printf("%d. %s", ++i, d->name);if (d->description)printf(" (%s)\n", d->description);elseprintf(" (No description available)\n");}if(i==0){printf("\nNo interfaces found! Make sure WinPcap is installed.\n");return -1;}printf("Enter the interface number (1-%d):",i);scanf("%d", &inum);if(inum < 1 || inum > i){printf("\nInterface number out of range.\n");/* Free the device list */return -1;}/* Jump to the selected adapter */for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);/* Open the device */if ( (fp = pcap_open_live(d->name, 100, 1, 20, errbuf) ) == NULL){fprintf(stderr,"\nError opening adapter\n");return -1;}/* Free the device list */pcap_freealldevs(alldevs);/* Start the dump */if(pcap_live_dump(fp, argv[1], atoi(argv[2]), atoi(argv[3]))==-1){printf("Unable to start the dump, %s\n", pcap_geterr(fp));return -1;}}else{/* Open the device */if ( (fp= pcap_open_live(argv[1], 100, 1, 20, errbuf) ) == NULL){fprintf(stderr,"\nError opening adapter\n");return -1;}/* Start the dump */if(pcap_live_dump(fp, argv[0], atoi(argv[1]), atoi(argv[2]))==-1){printf("Unable to start the dump, %s\n", pcap_geterr(fp));return -1;}}/* Wait until the dump finishes, i.e. when  max_size or max_packs is reached*/pcap_live_dump_ended(fp, TRUE);/* Close the adapter, so that the file is correctly flushed */pcap_close(fp);return 0;
}

除了设置限制的可能性之外，pcap_live_dump（）和pcap_dump（）之间的区别是性能。pcap_live_dump（）利用了WinPcap NPF驱动程序的功能（参见NPF驱动程序内部手册）从内核级写入转储，最小化上下文切换和内存副本的数量。

显然，由于此功能目前在其他操作系统上不可用，因此pcap_live_dump（）是WinPcap特有的，仅在Win32下存在。