1.程序代码

#include

#include

#include

#include

#include

#define PCAP_ERRBUF_SIZE 1024

#define pcap_t void

typedef unsigned int bpf_u_int32;

typedef unsigned char u_char;

struct bpf_program

{

unsigned int bf_len;

void *bf_insns;

};

struct pcap_pkthdr

{

struct timeval ts;

bpf_u_int32 caplen; //表示抓到的数据长度

bpf_u_int32 len; //表示数据包的实际长度

};

void get_packet(const struct pcap_pkthdr *pkthdr, const u_char *packet)

{

int i;

printf("\n");

printf("Packet length: %d\n", pkthdr->len);

printf("Number of bytes: %d\n", pkthdr->caplen);

printf("Recieved time: %s\n", ctime((const time_t *)&pkthdr->ts.tv_sec));

for(i=0; ilen; ++i)

{

printf("%02x ", packet[i]);

if((i + 1) % 16 == 0)

{

printf("\n");

}

}

printf("\n\n");

}

int main(int argc, char **argv)

{

struct in_addr addr;

struct bpf_program filter;

struct pcap_pkthdr header; //由pcap.h定义

pcap_t *handle;

char errbuf[PCAP_ERRBUF_SIZE];

char filter_app[] = "port 23"; //过滤表达式

char *dev = NULL;

bpf_u_int32 mask; //执行嗅探的设备的网络掩码

bpf_u_int32 net; //执行嗅探的设备的IP地址

u_char *packet; //实际的包

dev = (char *)pcap_lookupdev(errbuf);

memset(&header, 0x00, sizeof(header));

printf("\nDevice = [%s]\n", dev);

//printf("errbuf = [%s]\n", errbuf);

/* 探查设备属性 */

pcap_lookupnet(dev, &net, &mask, errbuf);

/* 以混杂模式打开会话 */

handle = (pcap_t *)pcap_open_live(dev, 1000, 1, 0, errbuf);

/* 编译过滤器 */

//pcap_compile(handle, &filter, filter_app, 0, net);

/* 应用过滤器 */

//pcap_setfilter(handle, &filter);

addr.s_addr = net;

printf("net=[%s]\n", inet_ntoa(addr));

addr.s_addr = mask;

printf("mask=[%s]\n", inet_ntoa(addr));

/* 截获一个包 */

packet = (u_char *)pcap_next(handle, &header);

if(!packet)

{

printf("did not capture a packet!\n");

exit(1);

}

/* 打印包数据 */

get_packet(&header, packet);

/* 关闭会话 */

pcap_close(handle);

return 0;

}

2.编译

gcc -o pcap-test pcap-test.c -lpcap

3.运行及结果

# ./pcap-test

Device = [eth1]

net=[172.16.79.0]

mask=[255.255.255.0]

Packet length: 150

Number of bytes: 150

Recieved time: Mon Dec 30 19:13:19 2019

00 50 56 c0 00 08 00 0c 29 55 6e bc 08 00 45 10

00 88 68 3c 40 00 40 06 db 81 ac 10 4f 80 ac 10

4f 01 00 16 c9 c7 16 d5 1c f4 4b 0e 77 50 50 18

01 68 81 12 00 00 de a1 f2 88 9f 59 54 22 cb 29

8a b9 c0 e5 d2 f3 3c cd ae 84 93 74 9a b5 66 44

17 be cb 6d 3b 1a 99 33 01 11 26 04 31 8f de 58

52 52 fa a8 99 a1 3a f6 fe 31 de 23 76 81 bc f1

70 a6 b5 48 04 69 1f a2 8e 34 b1 70 e6 f6 8d ac

f2 95 16 f9 3d a3 a1 b3 5e 39 63 b9 15 23 f6 bd

20 80 02 f7 4f df