涓嬭澆錛?div>http://www.easyice.cn/5imx2s/download.htm
]]>
榪欒妭鐨勪緥瀛愬緢璞″厛鍓嶇殑涓绔狅紙鑾峰緱緗戝崱鐨勯珮綰т俊鎭級(jí)浣嗘槸榪欎竴鑺備腑鏄敤pcap_next_ex()鏉ヤ唬鏇縫cap_loop()鏉ユ崟鑾鋒暟鎹寘銆傚熀浜庡洖璋冨寘鎹曡幏鏈哄埗
鐨刾cap_loop()鍦ㄦ煇浜涙儏鍐典笅鏄笉閿欑殑閫夋嫨銆備絾鏄湪涓浜涙儏鍐典笅澶勭悊鍥炶皟騫朵笉鐗瑰埆濂斤細(xì)榪欎細(xì)浣跨▼搴忓彉鐨勫鏉傚茍涓斿湪璞″綰跨▼鎴朇++綾昏繖浜涙儏鍐典笅
瀹冪湅璧鋒潵鍒拌薄涓鍧楃粖鑴氱煶銆?/p>
鍦ㄨ繖浜涙儏鍐典笅pcap_next_ex()鍏佽鐩存帴璋冪敤鏉ユ帴鏀跺寘錛屽畠鐨勫弬鏁板拰pcap_loop()鐩稿悓錛氭湁涓涓綉鍗℃弿榪板壇錛屽拰涓や釜鎸囬拡錛岃繖涓や釜鎸囬拡浼?xì)琚垵濮嬪?/p>
騫惰繑鍥炵粰鐢ㄦ埛錛屼竴涓槸pcap_pkthdr緇撴瀯錛屽彟涓涓槸鎺ユ敹鏁版嵁鐨勭紦鍐插尯銆備笅闈㈢殑紼嬪簭鎴戦棬灝嗗驚鐜皟鐢ㄥ墠涓鑺傜殑渚嬪瓙涓殑鍥炴帀閮ㄥ垎錛屽彧鏄妸瀹冪Щ鍒?/p>
浜唌ain閲岄潰浜嗐?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include "pcap.h"
main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
int res;
char errbuf[PCAP_ERRBUF_SIZE];
struct tm *ltime;
char timestr[16];
struct pcap_pkthdr *header;
u_char *pkt_data;
/* Retrieve the device list */
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* Print the list */
for(d=alldevs; d; d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else
printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return -1;
}
printf("Enter the interface number (1-%d):",i);
scanf("%d", &inum);
if(inum < 1 || inum > i)
{
printf("\nInterface number out of range.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* Jump to the selected adapter */
for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
/* Open the adapter */
if ( (adhandle= pcap_open_live(d->name, // name of the device
65536, // portion of the packet to capture.
// 65536 grants that the whole packet will be captured on all the MACs.
1, // promiscuous mode
1000, // read timeout
errbuf // error buffer
) ) == NULL)
{
fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
printf("\nlistening on %s...\n", d->description);
/* At this point, we don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
/* 姝ゅ寰幆璋冪敤 pcap_next_ex鏉ユ帴鍙楁暟鎹姤*/
while((res = pcap_next_ex( adhandle, &header, &pkt_data)) >= 0){
if(res == 0)
/* Timeout elapsed */
continue;
/* convert the timestamp to readable format */
ltime=localtime(&header->ts.tv_sec);
strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);
}
if(res == -1){
printf("Error reading the packets: %s\n", pcap_geterr(adhandle));
return -1;
}
return 0;
}
娉細(xì)pcap_next_ex()鍙湪Win32鐜涓嬫墠琛屽洜涓哄畠涓嶆槸鍘熷libpcap API涓殑涓閮ㄥ垎錛岃繖灝辨剰鍛崇潃渚濊禆浜庤繖涓嚱鏁扮殑浠ｇ爜涓嶄細(xì)鍦║NIX涓嬪伐浣溿傞偅
涔堜負(fù)浠涔堟垜浠敤pcap_next_ex()鑰屼笉鐢╬cap_next()錛熷洜涓簆cap_next()鏈夎澶氶檺鍒跺湪寰堝鎯呭喌涓嬪茍涓嶉紦鍔辯敤瀹冦傞鍏堝畠鐨勬晥鐜囧緢浣庡洜涓哄畠闅愯棌
浜嗗洖鎺夋柟娉曞茍涓旇繕渚濊禆浜巔cap_dispatch()榪欎釜鍑芥暟銆傚啀嬈″畠涓嶈兘澶熻瘑鍒枃浠剁粨鏉熸爣蹇桬OF鎵浠ュ鏉ヨ嚜鏂囦歡鐨勬暟鎹祦瀹冨嚑涔庢棤鑳戒負(fù)鍔涖?br>娉ㄦ剰褰損cap_next_ex()鍦ㄦ垚鍔燂紝瓚呮椂錛屽嚭閿欏拰鏂囦歡緇撴潫鐨勬儏鍐典笅浼?xì)杩斿洖涓嶅悓鐨勫?br>
浜旓級(jí)鏁版嵁嫻佺殑榪囨護(hù)
WinPcap鎴杔ibpca鏈寮哄ぇ鐨勭壒鐐逛箣涓灝辨槸鏁版嵁嫻佺殑榪囨護(hù)寮曟搸銆傚畠鎻愪緵涓縐嶉珮鏁堢殑鏂規(guī)硶鏉ュ彧鎹曡幏緗戠粶鏁版嵁嫻佺殑鏌愪簺鏁版嵁鑰屼笖甯稿父鍜岀郴緇熺殑鎹曡幏鏈哄埗
鐩擱泦鎴愩傝繃婊ゆ暟鎹殑鍑芥暟鏄痯cap_compile() 鍜?pcap_setfilter()鏉ュ疄鐜扮殑銆?/p>
pcap_compile()鏉ョ紪璇戜竴涓繃婊よ澶囷紝瀹冮氳繃涓涓珮灞傜殑boolean鍨嬪彉閲忓拰瀛椾覆浜х敓涓緋誨垪鐨勮兘澶熻搴曞眰椹卞姩鎵瑙ｉ噴鐨勪簩榪涘埗緙栫爜銆俠oolean琛?/p>
紺鴻娉曡兘澶熷湪榪欎釜鏂囦歡鐨勮繃婊よ〃紺鴻娉曚腑鎵懼埌銆?/p>
pcap_setfilter() 鐢ㄦ潵鑱旂郴涓涓湪鍐呮牳椹卞姩涓婅繃婊ょ殑榪囨護(hù)鍣紝榪欐椂鎵鏈夌綉緇滄暟鎹寘閮藉皢嫻佺粡榪囨護(hù)鍣紝騫舵嫹璐濆埌搴旂敤紼嬪簭涓?/p>
涓嬮潰鐨勪唬鐮佸睍紺轟簡濡備綍緙栬瘧騫剁ぞ瀹氫竴涓繃婊よ澶囥傛敞鎰忔垜浠繀欏諱粠pcap_if緇撴瀯涓幏寰楁帺鐮侊紝鍥犱負(fù)涓浜涜繃婊ゅ櫒鐨勫垱寤洪渶瑕佽繖涓弬鏁般?/p>
涓嬮潰鐨勪唬鐮佹涓殑pcap_compile()鐨?ip and tcp"鍙傛暟璇存槑鍙湁IPV4鍜孴CP鏁版嵁鎵嶄細(xì)琚唴鏍鎬繚瀛樺茍琚紶閫掑埌搴旂敤紼嬪簭銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
if(d->addresses != NULL)
/* 鑾峰緱絎竴涓帴鍙ｅ湴鍧鐨勬帺鐮?*/
netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
else
/* 濡傛灉榪欎釜鎺ュ彛娌℃湁鍦板潃閭ｄ箞鎴戜滑鍋囪浠栦負(fù)C綾誨湴鍧 */
netmask=0xffffff;
//compile the filter
if(pcap_compile(adhandle, &fcode, "ip and tcp", 1, netmask) <0 ){
fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
//set the filter
if(pcap_setfilter(adhandle, &fcode)<0){
fprintf(stderr,"\nError setting the filter.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
鍏級(jí)瑙ｆ瀽鏁版嵁鍖?br>鐜板湪緇忚繃涓婂嚑鑺傜殑瀛︿範(fàn)鑳藉榪涜鏁版嵁鎶ョ殑鎹曡幏鍜岃繃婊や簡錛屾垜浠兂鐢ㄤ竴涓畝鍗曠殑"real world"紼嬪簭灝嗘垜浠墍瀛︾殑
鐭ヨ瘑搴旂敤浜庡疄闄呫?br>榪欎竴鑺傞噷鎴戜滑灝嗗埄鐢ㄤ互鍓嶇殑浠ｇ爜騫跺皢鍏跺紩鐢充粠鑰屽緩绔嬩竴涓洿瀹炵敤鐨勭▼搴忋傝紼嬪簭鐨勪富瑕佺洰鐨勬槸濡備綍鏄劇ず鍑烘墍鎹?/p>
鑾風(fēng)殑鏁版嵁鎶ョ殑鍐呭錛屽挨鍏舵槸瀵瑰畠鐨勫崗璁ご鐨勫垎鏋愬拰璇存槑銆傝繖涓▼搴忓悕鍙玌DPdump瀹冨皢鍦ㄥ睆騫曚笂鏄劇ず鍑烘垜浠綉緇滀笂
UDP鏁版嵁鐨勪俊鎭?br>鍦ㄦ鎴戜滑閫夋嫨瑙ｆ瀽UDP鑰屼笉鐢═CP鍥犱負(fù)浠栨瘮TCP綆鍗曟洿鍔犵殑鐩磋鏄庝簡銆備笅闈㈣鎴戜滑鏉ョ湅鐪嬪師浠ｇ爜銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
/*
* Copyright (c) 1999 - 2002
* Politecnico di Torino. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the Politecnico
* di Torino, and its contributors.‘‘ Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS‘‘ AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
#include "pcap.h"
/* 4 BIT鐨処P澶村畾涔?*/
typedef struct ip_address{
u_char byte1;
u_char byte2;
u_char byte3;
u_char byte4;
}ip_address;
/* IPv4 澶寸殑瀹氫箟 */
typedef struct ip_header{
u_char ver_ihl; // 4 bit鐨勭増鏈俊鎭?+ 4 bits鐨勫ご闀?br>u_char tos; // TOS綾誨瀷
u_short tlen; // 鎬婚暱搴?br>u_short identification; // Identification
u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)
u_char ttl; // 鐢熷瓨鏈?br>u_char proto; // 鍚庨潰鐨勫崗璁俊鎭?br>u_short crc; // 鏍￠獙鍜?br>ip_address saddr; // 婧怚P
ip_address daddr; // 鐩殑IP
u_int op_pad; // Option + Padding
}ip_header;
/* UDP header*/
typedef struct udp_header{
u_short sport; // Source port
u_short dport; // Destination port
u_short len; // Datagram length
u_short crc; // Checksum
}udp_header;
/* 瀹氫箟澶勭悊鍖呯殑鍑芥暟 */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];
u_int netmask;
char packet_filter[] = "ip and udp";
struct bpf_program fcode;
/* Retrieve the device list */
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* Print the list */
for(d=alldevs; d; d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else
printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return -1;
}
printf("Enter the interface number (1-%d):",i);
scanf("%d", &inum);
if(inum < 1 || inum > i)
{
printf("\nInterface number out of range.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* Jump to the selected adapter */
for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
/* Open the adapter */
if ( (adhandle= pcap_open_live(d->name, // name of the device
65536, // portion of the packet to capture.
// 65536 grants that the whole packet will be captured on
all the MACs.
1, // promiscuous mode
1000, // read timeout
errbuf // error buffer
) ) == NULL)
{
fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* Check the link layer. We support only Ethernet for simplicity. */
if(pcap_datalink(adhandle) != DLT_EN10MB)
{
fprintf(stderr,"\nThis program works only on Ethernet networks.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
if(d->addresses != NULL)
/* Retrieve the mask of the first address of the interface */
netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
else
/* If the interface is without addresses we suppose to be in a C class network */
netmask=0xffffff;
//compile the filter
if(pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) <0 ){
fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
//set the filter
if(pcap_setfilter(adhandle, &fcode)<0){
fprintf(stderr,"\nError setting the filter.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
printf("\nlistening on %s...\n", d->description);
/* At this point, we don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
/* start the capture */
pcap_loop(adhandle, 0, packet_handler, NULL);
return 0;
}
/* Callback function invoked by libpcap for every incoming packet */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
struct tm *ltime;
char timestr[16];
ip_header *ih;
udp_header *uh;
u_int ip_len;
u_short sport,dport;
/* convert the timestamp to readable format */
ltime=localtime(&header->ts.tv_sec);
strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
/* print timestamp and length of the packet */
printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len);
/* 鎵懼埌IP澶寸殑浣嶇疆 */
ih = (ip_header *) (pkt_data +
14); //14涓轟互澶ご鐨勯暱搴?/p>
/* 鎵懼埌UDP鐨勪綅緗?*/
ip_len = (ih->ver_ihl & 0xf) * 4;
uh = (udp_header *) ((u_char*)ih + ip_len);
/* 灝嗙鍙ｄ俊鎭粠緗戠粶鍨嬭漿鍙樹負(fù)涓繪満欏哄簭 */
sport = ntohs( uh->sport );
dport = ntohs( uh->dport );
/* print ip addresses and udp ports */
printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n",
ih->saddr.byte1,
ih->saddr.byte2,
ih->saddr.byte3,
ih->saddr.byte4,
sport,
ih->daddr.byte1,
ih->daddr.byte2,
ih->daddr.byte3,
ih->daddr.byte4,
dport);
}
棣栧厛鎴戦棬璁劇疆UDP榪囨護(hù)錛岀敤榪欑鏂規(guī)硶鎴戜滑紜繚packet_handler()鍙帴鍙楀埌鍩轟簬IPV4鐨刄DP鏁版嵁銆傛垜浠悓鏍峰畾涔変簡
涓や釜鏁版嵁緇撴瀯鏉ユ弿榪癐P 鍜孶DP鐨勫ご閮ㄤ俊鎭紝packet_handler()鐢ㄨ繖涓や釜緇撴瀯鏉ュ畾浣嶅ご閮ㄧ殑鍚勭瀛楁銆?br>packet_handler()铏界劧鍙槸闄愪簬澶勭悊涓浜沀DP鏁版嵁浣嗗嵈鏄劇ず浜嗗鏉傜殑鍡呮帰鍣ㄥtcpdump/WinDump鐨勫伐浣滃師鐞嗐?br>棣栧厛鎴戜滑瀵筂AC鍦板潃鐨勫ご閮ㄥ茍涓嶆劅鍏磋叮鎵浠ユ垜浠煩榪囧畠銆備笉榪囧湪寮濮嬫崟鑾蜂箣鍓嶆垜浠敤pcap_datalink()鏉ユ鏌AC
灞傦紝鎵浠ヤ互涓婄殑紼嬪簭鍙兘澶熷伐浣滃湪Ethernet networks涓婏紝鍐嶆鎴戜滑紜繚MAC澶翠負(fù)14 bytes銆?br>MAC澶翠箣鍚庢槸IP澶達(dá)紝鎴戜滑浠庝腑鎻愬彇鍑轟簡鐩殑鍦板潃銆侷P涔嬪悗鏄疷DP錛屽湪紜畾UDP鐨勪綅緗椂鏈夌偣澶嶆潅錛屽洜涓篒P鐨勯暱搴︿互
涓虹増鏈殑涓嶅悓鑰屼笉鍚岋紝鎵浠ユ垜浠敤澶撮暱瀛楁鏉ュ畾浣峌DP錛屼竴鏃?鎴戜滑紜畾浜哢DP鐨勮搗濮嬩綅緗紝鎴戜滑灝卞彲浠ヨВ鏋愬嚭鍘?/p>
鍜岀洰鐨勭鍙ｃ?br>涓嬮潰鏄垜浠墦鍗板嚭鏉ョ殑涓浜涚粨鏋滐細(xì)
1. {A7FD048A-5D4B-478E-B3C1-34401AC3B72F} (Xircom t 10/100 Adapter)
Enter the interface number (1-2):1
listening on Xircom CardBus Ethernet 10/100 Adapter...
16:13:15.312784 len:87 130.192.31.67.2682 -> 130.192.3.21.53
16:13:15.314796 len:137 130.192.3.21.53 -> 130.192.31.67.2682
16:13:15.322101 len:78 130.192.31.67.2683 -> 130.192.3.21.53
涓婇潰姣忎竴琛岄兘鏄劇ず鍑轟笉鍚岀殑鏁版嵁鍖呯殑鍐呭.
錛堜竷錛夊鐞嗚劚鏈虹殑鍫嗘枃浠?/p>
閫氳繃浠ュ墠鐨勫涔?fàn)鎴戦棬宸簿l忕啛鎮(zhèn)変簡浠庣綉鍗′笂鎹曡幏鏁版嵁鍖咃紝鐜板湪鎴戦棬灝嗗涔?fàn)濡備綍澶勭悊鏁版嵁鍖呫俉INPCAP涓烘垜浠彁渚涗簡寰堝API鏉ュ皢嫻佺粡緗戠粶鐨勬暟鎹寘
淇濆瓨鍒頒竴涓爢鏂囦歡騫惰鍙栧爢鐨勫唴瀹廣傝繖涓鑺傚皢璁茶堪濡備綍浣跨敤鎵鏈夌殑榪欎簺API銆?br>榪欑鏂囦歡鐨勬牸寮忓緢綆鍗曪紝浣嗗寘鍚簡鎵鎹曡幏鐨勬暟鎹姤鐨勪簩榪涘埗鍐呭錛岃繖縐嶆枃浠舵牸寮忎篃鏄緢澶氱綉緇滃伐鍏風(fēng)殑鏍囧噯濡俉inDump, Ethereal 榪樻湁 Snort絳?
鍏充簬濡備綍灝嗘暟鎹寘淇濆瓨鍒版枃浠訛細(xì)
棣栧厛鎴戜滑鐪嬬湅濡備綍浠IBPCAP鐨勬牸寮忓啓鏁版嵁鍖呫?br>涓嬮潰鐨勪緥瀛愭紨紺轟簡濡備綍浠庢寚瀹氱殑鎺ュ彛涓婃崟鑾鋒暟鎹寘騫跺皢瀹冧滑瀛樺偍鍒頒竴涓寚瀹氱殑鏂囦歡銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include "pcap.h"
/* 瀹氫箟澶勭悊鏁版嵁鐨勫嚱鏁板師褰?*/
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
main(int argc, char **argv)
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;//瀹氫箟鏂囦歡鍙ユ焺
char errbuf[PCAP_ERRBUF_SIZE];
pcap_dumper_t *dumpfile;
/* 媯(gè)鏌ュ懡浠よ鍙傛暟 鏄惁甯︽湁鏂囦歡鍚?/
if(argc != 2){
printf("usage: %s filename", argv[0]);
return -1;
}
/* 鑾峰緱椹卞姩鍒楄〃 */
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* 鎵撳嵃 list */
for(d=alldevs; d; d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else
printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return -1;
}
printf("Enter the interface number (1-%d):",i);
scanf("%d", &inum);
if(inum < 1 || inum > i)
{
printf("\nInterface number out of range.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* 璺寵漿鍒版寚瀹氱殑緗戝崱 */
for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
/* Open the adapter */
if ( (adhandle = pcap_open_live(d->name, // name of the device
65536, // portion of the packet to capture.
// 65536 grants that the whole packet will be captured on all the MACs.
1, // promiscuous mode
1000, // read timeout
errbuf // error buffer
) ) == NULL)
{
fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* 鎵撳紑鏂囦歡 */
dumpfile = pcap_dump_open(adhandle, argv[1]);
if(dumpfile==NULL){
fprintf(stderr,"\nError opening output file\n");
return -1;
}
printf("\nlistening on %s...\n", d->description);
/* At this point, we don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
/* 寰幆鎹曡幏鏁版嵁騫惰皟鐢╬acket_handler鍑芥暟鎶婃暟鎹瓨鍌ㄥ埌鍫嗘枃浠?*/
pcap_loop(adhandle, 0, packet_handler, (unsigned char *)dumpfile);
return 0;
}
/* Callback function invoked by libpcap for every incoming packet */
void packet_handler(u_char *dumpfile, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
/* 姝ゅ嚱鏁板姛鑳藉皢鏁版嵁鎶ュ瓨鍌ㄥ埌鍫嗘枃浠?*/
pcap_dump(dumpfile, header, pkt_data);
}
姝ｅ浣犵湅鍒扮殑閭ｆ牱璇ョ▼搴忕殑緇撴瀯闈炲父綾諱技涓庝互鍓嶇殑渚嬪瓙錛屽尯鍒槸錛?br>涓鏃︽墦寮緗戝崱灝辮皟鐢╬cap_dump_open()鏉ユ墦寮涓涓枃浠訛紝璇ヨ皟鐢ㄥ皢鏂囦歡鍜屾煇涓綉鍗＄浉鍏寵仈銆?br>packet_handler()鍐呴儴閫氳繃璋冪敤pcap_dump()鏉ュ皢鎹曡幏鐨勬暟鎹姤瀛樺偍鍒版枃浠躲俻cap_dump()鐨勫弬鏁板拰 packet_handler()涓鏍鳳紝鎵浠ョ敤璧鋒潵姣旇緝鏂?/p>
渚褲?/p>
浠庢枃浠惰鏁版嵁鍖咃細(xì)
涓嬮潰鎴戜滑鏉ョ湅濡備綍浠庢枃浠惰鍙栨暟鎹唴瀹廣備笅闈㈢殑浠ｇ爜鎵撳紑浜?涓涓爢鏂囦歡騫舵墦鍗頒簡鍏朵腑鐨勬瘡涓寘鍐呭銆?br>pcap_open_offline()鐢ㄦ潵鎵撳紑涓涓爢鏂囦歡錛屼箣鍚庣敤pcap_loop()鏉ュ驚鐜粠鏂囦歡涓鍙栨暟鎹備綘鑳藉彂鐜拌鍙栬劚鏈虹殑鏁版嵁鍑犱箮鍜屽疄鏃剁殑浠庣綉鍗′笂璇?/p>
鍙栦竴鎽鎬竴鏍楓?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include <stdio.h>
#include <pcap.h>
#define LINE_LEN 16
void dispatcher_handler(u_char *, const struct pcap_pkthdr *, const u_char *);
main(int argc, char **argv) {
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
if(argc != 2){
printf("usage: %s filename", argv[0]);
return -1;
}
/* 鎵撳紑涓涓瓨鍌ㄦ湁鏁版嵁鐨勫爢鏂囦歡 */
if ( (fp = pcap_open_offline(argv[1], errbuf) ) == NULL)
{
fprintf(stderr,"\nError opening dump file\n");
return -1;
}
// 璇誨彇鏁版嵁鐩村埌閬囧埌 EOF鏍囧織銆?
pcap_loop(fp, 0, dispatcher_handler, NULL);
return 0;
}
void dispatcher_handler(u_char *temp1,
const struct pcap_pkthdr *header, const u_char *pkt_data)
{
u_int i=0;
/* print pkt timestamp and pkt len */
printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);
/* Print the packet */
for (i=1; (i < header->caplen + 1 ) ; i++)
{
printf("%.2x ", pkt_data[i-1]);
if ( (i % LINE_LEN) == 0) printf("\n");
}
printf("\n\n");
}
涓嬮潰鐨勪唬鐮佸叿鏈変竴鏍風(fēng)殑浣滅敤錛屽彧涓嶈繃鏄敤pcap_next_ex()鏉ヤ唬鏇縫cap_loop()寰幆璇誨彇鏁版嵁鑰屽凡銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include <stdio.h>
#include <pcap.h>
#define LINE_LEN 16
main(int argc, char **argv) {
pcap_t *fp;
char errbuf[PCAP_ERRBUF_SIZE];
struct pcap_pkthdr *header;
u_char *pkt_data;
u_int i=0;
int res;
if(argc != 2){
printf("usage: %s filename", argv[0]);
return -1;
}
/* Open a capture file */
if ( (fp = pcap_open_offline(argv[1], errbuf) ) == NULL)
{
fprintf(stderr,"\nError opening dump file\n");
return -1;
}
/* Retrieve the packets from the file */
while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0){
/* print pkt timestamp and pkt len */
printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);
/* Print the packet */
for (i=1; (i < header->caplen + 1 ) ; i++)
{
printf("%.2x ", pkt_data[i-1]);
if ( (i % LINE_LEN) == 0) printf("\n");
}
printf("\n\n");
}
if(res == -1){
printf("Error reading the packets: %s\n", pcap_geterr(fp));
}
return 0;
}
鐢╬cap_live_dump灝嗘暟鎹啓鍒版枃浠訛細(xì)
WinPcap鐨勬渶鏂扮増鏈彁渚涗簡涓涓繘涓姝ョ殑鏂規(guī)硶鏉ュ皢鏁版嵁鍖呭瓨鍌ㄥ埌紓佺洏錛屽氨鏄嬌鐢╬cap_live_dump()鍑芥暟銆備粬闇瑕佷笁涓弬鏁幫細(xì)涓涓枃浠跺悕錛屽拰涓涓?/p>
璇ユ枃浠跺厑璁哥殑鏈澶ч暱搴﹁繕鏈変竴涓弬鏁版槸璇ユ枃浠舵墍鍏佽鐨勬渶澶у寘鐨勬暟閲忋傚榪欎簺鍙傛暟鏉ヨ 0 鎰忓懗鐫娌℃湁鏈澶ч檺鍒躲傛敞錛氭垜浠彲浠ュ湪璋冪敤
pcap_live_dump()鍓嶈緗竴涓繃婊ゅ櫒鏉ュ畾涔夊摢浜涙暟鎹姤闇瑕佸瓨鍌ㄣ?/p>
pcap_live_dump() 鏄潪闃誨鐨勶紝鎵浠ヤ粬浼?xì)绔嬪埢杩斿洖锛?xì)鏁版嵁鐨勫瓨鍌ㄨ繃紼嬪皢浼?xì)寮傛鐨剺q涜錛岀洿鍒版枃浠跺埌杈句簡鎸囧畾鐨勬渶澶ч暱搴︽垨鏈澶ф暟鎹姤鐨勬暟鐩負(fù)
姝€?br>搴旂敤紼嬪簭鑳藉鐢╬cap_live_dump_ended()鏉ョ瓑媯(gè)鏌ユ槸鍚︽暟鎹瓨鍌ㄥ畬姣曪紝濡傛灉浣犳寚瀹氱殑鏈澶ч暱搴﹀弬鏁板拰鏁版嵁鎶ユ暟閲忎負(fù)0錛岄偅涔堣鎿嶄綔灝嗘案榪滈樆濉炪?/p>
pcap_live_dump() 鍜?pcap_dump()鐨勪笉鍚屼粠璁劇疆鐨勬渶澶ф瀬闄愭潵璇村氨鏄ц兘鐨勯棶棰樸俻cap_live_dump()閲囩敤WinPcap NPF椹卞姩鏉ヤ粠鍐呮牳綰х殑灞傛
涓婂悜鏂囦歡涓啓鏁版嵁錛屼粠鑰屼嬌鍐呭瓨鎷瘋礉鏈灝忓寲銆?br>鏄劇劧錛岃繖浜涚壒鐐瑰綋鍓嶅湪鍏朵粬鐨勬搷浣滅郴緇熶笅鏄笉鑳藉瀹炵幇鐨勶紝pcap_live_dump()鏄疻inPcap鎵鐗規(guī)湁鐨勶紝鑰屼笖鍙兘澶熷簲鐢ㄤ簬Win32鐜.
鍏級(jí)鍙戦佹暟鎹寘
灝界WinPcap浠庡悕瀛椾笂鏉ョ湅琛ㄦ槑浠栫殑涓昏鐩殑鏄崟鑾鋒暟鎹寘錛屼絾鏄粬榪樹負(fù)鍘熷緗戠粶鎻愪緵浜嗕竴浜涘叾浠栫殑鍔熻兘錛屽叾涓?/p>
涔嬩竴灝辨槸鐢ㄦ埛鍙互鍙戦佹暟鎹寘錛岃繖涔熷氨鏄湰鑺傜殑涓昏鍐呭銆傞渶瑕佹寚鍑虹殑鏄師鏉ョ殑libpcap騫朵笉鎻愪緵鏁版嵁鍖?鐨勫彂
閫佸姛鑳斤紝榪欓噷鎵璇寸殑鍔熻兘閮芥槸WinPcap鐨勬墿灞曞姛鑳斤紝鎵浠ュ茍涓嶈兘澶熷伐浣滃湪UNIX涓嬨?/p>
鐢╬cap_sendpacket鏉ュ彂閫佷竴涓暟鎹寘錛?/p>
涓嬮潰鐨勪唬鐮佹槸涓涓渶綆鍗曠殑鍙戦佹暟鎹殑鏂規(guī)硶銆傛墦寮涓涓傞厤鍣ㄥ悗灝卞彲浠ョ敤 pcap_sendpacket錛堬級(jí)鏉ユ墜宸ュ彂閫佷竴
涓暟鎹寘浜嗐傝繖涓嚱鏁伴渶瑕佺殑鍙傛暟錛氫竴涓鏈夎鍙戦佹暟鎹殑緙撳啿鍖猴紝瑕佸彂閫佺殑闀垮害錛屽拰涓涓傞厤鍣ㄣ傛敞鎰忕紦鍐?/p>
鍖轟腑鐨勬暟鎹皢涓嶈鍐呮牳鍗忚澶勭悊錛屽彧鏄綔涓烘渶鍘熷鐨勬暟鎹祦琚彂閫侊紝鎵浠ユ垜闂ㄥ繀欏誨～鍏呭ソ姝ｇ‘鐨勫崗璁ご浠ヤ究姝?/p>
紜殑灝嗘暟鎹彂閫併?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
void usage();
void main(int argc, char **argv) {
pcap_t *fp;
char error[PCAP_ERRBUF_SIZE];
u_char packet[100];
int i;
/* Check the validity of the command line */
if (argc != 2)
{
printf("usage: %s inerface", argv[0]);
return;
}
/* 鎵撳紑鎸囧畾緗戝崱 */
if((fp = pcap_open_live(argv[1], 100, 1, 1000, error) ) == NULL)
{
fprintf(stderr,"\nError opening adapter: %s\n", error);
return;
}
/* 鍋囪緗戠粶鐜涓篹thernet錛屾垜闂ㄦ妸鐩殑MAC璁句負(fù)1:1:1:1:1:1*/
packet[0]=1;
packet[1]=1;
packet[2]=1;
packet[3]=1;
packet[4]=1;
packet[5]=1;
/* 鍋囪婧怣AC涓?2:2:2:2:2:2 */
packet[6]=2;
packet[7]=2;
packet[8]=2;
packet[9]=2;
packet[10]=2;
packet[11]=2;
/* 濉厖鍙戦佸寘鐨勫墿浣欓儴鍒?*/
for(i=12;i<100;i++){
packet[i]=i%256;
}
/* 鍙戦佸寘 */
pcap_sendpacket(fp,
packet,
100);
return;
}
鍙戦侀槦鍒楋細(xì)
pcap_sendpacket()鍙槸鎻愪緵涓涓畝鍗曠殑鐩存帴鐨勫彂閫佹暟鎹殑鏂規(guī)硶錛岃屽彂閫侀槦鍒楁彁渚涗竴涓珮綰х殑寮哄ぇ鐨勫拰鏈浼樼殑鏈?/p>
鍒舵潵鍙戦佷竴緇勬暟鎹寘錛岄槦鍒楀疄闄呬笂鏄竴涓鏈夎鍙戦佹暟鎹殑涓涓鍣紝浠栨湁涓涓渶澶у兼潵琛ㄦ槑浠栨墍鑳藉 瀹圭撼鐨?/p>
鏈澶ф瘮鐗規(guī)暟銆?br>pcap_sendqueue_alloc()鐢ㄦ潵鍒涘緩涓涓槦鍒楋紝騫舵寚瀹氳闃熷垪鐨勫ぇ灝忋?br>涓鏃﹂槦鍒楄鍒涘緩灝卞彲浠ヨ皟鐢╬cap_sendqueue_queue()鏉ュ皢鏁版嵁瀛樺偍鍒伴槦鍒椾腑錛岃繖涓嚱鏁版帴鍙椾竴涓甫鏈夋椂闂存埑鍜?/p>
闀垮害鐨刾cap_pkthdr緇撴瀯鍜屼竴涓鏈夋暟鎹姤鐨勭紦鍐插尯銆傝繖浜涘弬鏁板悓鏍蜂篃搴旂敤浜巔cap_next_ex() 鍜?/p>
pcap_handler()涓紝鎵浠ョ粰瑕佹崟鑾風(fēng)殑鏁版嵁鍖呮垨瑕佷粠鏂囦歡璇誨彇鐨勬暟鎹寘鎺掗槦灝辨槸pcap_sendqueue_queue()鐨勪簨鎯?/p>
浜嗐?br>WinPcap璋冪敤pcap_sendqueue_transmit()鏉ュ彂閫佹暟鎹寘錛屾敞鎰忥紝絎笁涓弬鏁板鏋滈潪闆訛紝閭ｄ箞鍙戦佸皢鏄悓姝ョ殑錛?/p>
榪欏皢绔欑敤寰堝ぇ鐨凜PU璧勬簮錛屽洜涓哄彂鐢熷湪鍐呮牳椹卞姩鐨勫悓姝ュ彂閫佹槸閫氳繃"brute force"loops鐨勶紝浣嗘槸涓鑸儏鍐典笅鑳藉
綺劇‘鍒板井縐掋?br>闇瑕佹寚鍑虹殑鏄敤pcap_sendqueue_transmit()鏉ュ彂閫佹瘮鐢╬cap_sendpacket()鏉ュ彂閫佷竴緋誨垪鐨勬暟鎹楂樻晥鐨勫錛?/p>
鍥犱負(fù)浠栫殑鏁版嵁鏄湪鍐呮牳綰т笂琚紦鍐層?br>褰撲笉鍐嶉渶瑕侀槦鍒楁椂鍙互鐢╬cap_sendqueue_destroy()鏉ラ噴鏀炬帀鎵鏈夌殑闃熷垪璧勬簮銆?/p>
涓嬮潰鐨勪唬鐮佹紨紺轟簡濡備綍鐢ㄥ彂閫侀槦鍒楁潵鍙戦佹暟鎹紝璇ョず渚嬬敤pcap_open_offline()鎵撳紑浜嗕竴涓枃浠訛紝鐒跺悗灝嗘暟鎹?/p>
浠庢枃浠剁Щ鍔ㄥ埌宸插垎閰嶇殑闃熷垪錛岃繖鏃跺氨鍚屾鍦頒紶閫侀槦鍒楋紙濡傛灉鐢ㄦ埛鎸囧畾涓哄悓姝ョ殑璇濓級(jí)銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
/*
* Copyright (c) 1999 - 2002
* Politecnico di Torino. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the Politecnico
* di Torino, and its contributors.‘‘ Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS‘‘ AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
void usage();
void main(int argc, char **argv) {
pcap_t *indesc,*outdesc;
char error[PCAP_ERRBUF_SIZE];
FILE *capfile;
int caplen,
sync;
u_int res;
pcap_send_queue *squeue;
struct pcap_pkthdr *pktheader;
u_char *pktdata;
/* Check the validity of the command line */
if (argc <= 2 || argc >= 5)
{
usage();
return;
}
/* 寰楀埌鏂囦歡闀垮害 */
capfile=fopen(argv[1],"rb");
if(!capfile){
printf("Capture file not found!\n");
return;
}
fseek(capfile , 0, SEEK_END);
caplen= ftell(capfile)- sizeof(struct pcap_file_header);
fclose(capfile);
/* 媯(gè)鏌ョ‘淇濇椂闂存埑琚拷鐣?*/
if(argc == 4 && argv[3][0] == ‘s‘)
sync = TRUE;
else
sync = FALSE;
/* Open the capture */
if((indesc = pcap_open_offline(argv[1], error)) == NULL){
fprintf(stderr,"\nError opening the input file: %s\n", error);
return;
}
/* Open the output adapter */
if((outdesc = pcap_open_live(argv[2], 100, 1, 1000, error) ) == NULL)
{
fprintf(stderr,"\nError opening adapter: %s\n", error);
return;
}
/* 媯(gè)嫻婱AC綾誨瀷 */
if(pcap_datalink(indesc) != pcap_datalink(outdesc)){
printf("Warning: the datalink of the capture differs from the one of the selected
interface.\n");
printf("Press a key to continue, or CTRL+C to stop.\n");
getchar();
}
/* 緇欏鍒楀垎閰嶇┖闂?*/
squeue = pcap_sendqueue_alloc(caplen);
/* 浠庢枃浠惰幏寰楀寘鏉ュ～鍏呴槦鍒?*/
while((res = pcap_next_ex( indesc, &pktheader, &pktdata)) == 1){
if(pcap_sendqueue_queue(squeue, pktheader, pktdata) == -1){
printf("Warning: packet buffer too small, not all the packets will be sent.\n");
break;
}
}
if(res == -1){
printf("Corrupted input file.\n");
pcap_sendqueue_destroy(squeue);
return;
}
/* 浼犻侀槦鍒楁暟鎹?*/
if((res = pcap_sendqueue_transmit(outdesc, squeue, sync)) < squeue->len)
{
printf("An error occurred sending the packets: %s. Only %d bytes were sent\n", error,
res);
}
/* free the send queue */
pcap_sendqueue_destroy(squeue);
return;
}
void usage()
{
printf("\nSendcap, sends a libpcap/tcpdump capture file to the net. Copyright (C) 2002 Loris
Degioanni.\n");
printf("\nUsage:\n");
printf("\t sendcap file_name adapter [s]\n");
printf("\nParameters:\n");
printf("\nfile_name: the name of the dump file that will be sent to the network\n");
printf("\nadapter: the device to use. Use \"WinDump -D\" for a list of valid devices\n");
printf("\ns: if present, forces the packets to be sent synchronously, i.e. respecting the
timestamps in the dump file. This option will work only under Windows NTx.\n\n");
exit(0);
}
涔?jié)锛?jí)鏀墮泦騫剁粺璁＄綉緇滄祦閲?br>榪欎竴鑺傚皢灞曠ずWinPcap鐨勫彟涓楂樼駭鍔熻兘錛氭敹闆嗙綉緇滄祦閲忕殑緇熻淇℃伅銆俉inPcap鐨勭粺璁″紩鎿庡湪鍐呮牳灞傛涓婂鍒版潵鐨勬暟鎹繘琛屽垎綾匯傚鏋滀綘鎯充簡瑙ｆ洿
澶氱殑緇嗚妭璇鋒煡鐪婲PF椹卞姩鎸囧崡銆?br>涓轟簡鍒╃敤榪欎釜鍔熻兘鏉ョ洃瑙嗙綉緇滐紝鎴戦棬鐨勭▼搴忓繀欏繪墦寮涓涓綉鍗″茍鐢╬cap_setmode()灝嗗叾璁劇疆涓虹粺璁℃ā寮忋傛敞鎰弍cap_setmode()瑕佺敤 MODE_STAT
鏉ュ皢緗戝崱璁劇疆涓虹粺璁℃ā寮忋?br>鍦ㄧ粺璁℃ā寮忎笅緙栧啓涓涓▼搴忔潵鐩戣TCP嫻侀噺鍙槸鍑犺浠ｇ爜鐨勪簨鎯咃紝涓嬮潰鐨勪緥瀛愯鏄庝簡濡備綍鏉ュ疄鐜拌鍔熻兘鐨勩?
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
/*
* Copyright (c) 1999 - 2002
* Politecnico di Torino. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the Politecnico
* di Torino, and its contributors.‘‘ Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS‘‘ AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
void usage();
void dispatcher_handler(u_char *,
const struct pcap_pkthdr *, const u_char *);
void main(int argc, char **argv) {
pcap_t *fp;
char error[PCAP_ERRBUF_SIZE];
struct timeval st_ts;
u_int netmask;
struct bpf_program fcode;
/* Check the validity of the command line */
if (argc != 2)
{
usage();
return;
}
/* Open the output adapter */
if((fp = pcap_open_live(argv[1], 100, 1, 1000, error) ) == NULL)
{
fprintf(stderr,"\nError opening adapter: %s\n", error);
return;
}
/* Don‘t care about netmask, it won‘t be used for this filter */
netmask=0xffffff;
//compile the filter
if(pcap_compile(fp, &fcode, "tcp", 1, netmask) <0 ){
fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
/* Free the device list */
return;
}
//set the filter
if(pcap_setfilter(fp, &fcode)<0){
fprintf(stderr,"\nError setting the filter.\n");
/* Free the device list */
return;
}
/* 灝嗙綉鍗¤緗負(fù)緇熻妯″紡 */
pcap_setmode(fp, MODE_STAT);
printf("TCP traffic summary:\n");
/* Start the main loop */
pcap_loop(fp, 0, dispatcher_handler, (PUCHAR)&st_ts);
return;
}
void dispatcher_handler(u_char *state, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
struct timeval *old_ts = (struct timeval *)state;
u_int delay;
LARGE_INTEGER Bps,Pps;
struct tm *ltime;
char timestr[16];
/* 浠庢渶榪戜竴嬈＄殑閲囨牱浠ュ井縐掕綆楀歡榪熸椂闂?*/
/* This value is obtained from the timestamp that the associated with the sample. */
delay=(header->ts.tv_sec - old_ts->tv_sec) * 1000000 - old_ts->tv_usec + header->ts.tv_usec;
/* 鑾峰緱姣忕鐨勬瘮鐗規(guī)暟 */
Bps.QuadPart=(((*(LONGLONG*)(pkt_data + 8)) * 8 * 1000000) / (delay));
/* ^ ^
| |
| |
| |
converts bytes in bits -- |
|
delay is expressed in microseconds --
*/
/* 鑾峰緱姣忕鐨勬暟鎹寘鏁?*/
Pps.QuadPart=(((*(LONGLONG*)(pkt_data)) * 1000000) / (delay));
/* 灝嗘椂闂存埑杞彉涓哄彲璇葷殑鏍囧噯鏍煎紡 */
ltime=localtime(&header->ts.tv_sec);
strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
/* Print timestamp*/
printf("%s ", timestr);
/* Print the samples */
printf("BPS=%I64u ", Bps.QuadPart);
printf("PPS=%I64u\n", Pps.QuadPart);
//store current timestamp
old_ts->tv_sec=header->ts.tv_sec;
old_ts->tv_usec=header->ts.tv_usec;
}
void usage()
{
printf("\nShows the TCP traffic load, in bits per second and packets per second.\nCopyright (C) 2002 Loris Degioanni.\n");
printf("\nUsage:\n");
printf("\t tcptop adapter\n");
printf("\t You can use \"WinDump -D\" if you don‘t know the name of your adapters.\n");
exit(0);
}
鍦ㄨ緗負(fù)緇熻妯″紡鍓嶅彲浠ヨ緗竴涓繃婊ゅ櫒鏉ユ寚瀹氳鎹曡幏鐨勫崗璁寘銆傚鏋滄病鏈夎緗繃婊ゅ櫒閭ｄ箞鏁翠釜緗戠粶鏁版嵁閮藉皢琚洃瑙嗐備竴鏃﹁緗簡 榪囨護(hù)鍣ㄥ氨鍙?/p>
浠ヨ皟鐢╬cap_setmode()鏉ヨ緗負(fù)緇熻妯″紡錛屼箣鍚庣綉鍗″紑濮嬪伐浣滃湪緇熻妯″紡涓嬨?br>闇瑕佹寚鍑虹殑鏄痯cap_open_live()鐨勭鍥涗釜鍙傛暟(to_ms)瀹氫箟浜嗛噰鏍風(fēng)殑闂撮殧錛屽洖璋冨嚱鏁皃cap_loop()姣忛殧涓瀹氶棿闅斿氨鑾峰彇涓嬈￠噰鏍風(fēng)粺璁★紝榪欎釜閲囨牱
琚鍏cap_loop()鐨勭浜屽拰絎笁涓弬鏁幫紝榪囩▼濡備笅鍥炬墍紺猴細(xì)
______________
|struct timeval ts |
|_____________|
|bpf_u_int32 |
|caplen=16 | struct pcap_pkthdr*
|_____________| (鍙傛暟2)
| bpf_u_int32 |
| len=16 |
|_____________|
__________________________
|large_integer Accepted packet |
|_________________________| uchar *
| large_integer Accepted bits | (鍙傛暟3)
|_________________________|
鐢ㄤ袱涓?4浣嶇殑璁℃暟鍣ㄥ垎鍒褰曟渶榪戜竴嬈￠棿闅旀暟鎹寘鏁伴噺鍜屾瘮鐗規(guī)暟閲忋?br>鏈緥瀛愪腑錛岀綉鍗℃墦寮鏃惰緗秴鏃朵負(fù)1000姣錛屼篃灝辨槸璇磀ispatcher_handler()姣忛殧1縐掑氨琚皟鐢ㄤ竴嬈°傝繃婊ゅ櫒涔?/p>
璁劇疆涓哄彧鐩戣TCP鍖咃紝鐒跺悗pcap_setmode() and pcap_loop()琚皟鐢紝娉ㄦ剰涓涓寚鍚憈imeval鐨勬寚閽?浣滀負(fù)鍙傛暟浼?/p>
閫佸埌pcap_loop()銆傝繖涓猼imeval緇撴瀯灝嗙敤鏉ュ瓨鍌ㄤ釜鏃墮棿鎴充互璁＄畻涓ゆ閲囨牱鐨勬椂闂撮棿闅斻?br>dispatcher_handler()鐢ㄨ闂撮殧鏉ヨ幏鍙栨瘡縐掔殑姣旂壒鏁板拰鏁版嵁鍖呮暟錛屽茍鎶婄潃涓や釜鏁版樉紺哄湪鏄劇ず鍣ㄤ笂銆?br>鏈鍚庢寚鍑虹殑鏄洰鍓嶈繖涓緥瀛愭槸姣斾換浣曚竴涓埄鐢ㄤ紶緇熸柟娉曞湪鐢ㄦ埛灞傜粺璁＄殑鍖呮崟鑾風(fēng)▼搴忛兘楂樻晥銆傚洜涓虹粺璁℃ā寮忛渶瑕?/p>
鏈灝忔暟閲忕殑鏁版嵁鎷瘋礉鍜屼笂涓嬬幆澧冧氦鎹紝鍚屾椂榪樻湁鏈灝忕殑鍐呭瓨闇姹傦紝鎵浠PU鏄渶浼樼殑銆?/p>
鐢≒CAP鍐欏簲鐢ㄧ▼搴忕殑絎竴浠朵簨寰寰灝辨槸瑕佽幏寰楁湰鍦扮殑緗戝崱鍒楄〃銆侾CAP鎻愪緵浜唒cap_findalldevs()榪欎釜鍑芥暟鏉ュ疄鐜版鍔熻兘錛岃繖涓狝PI榪斿洖涓涓?/p>
pcap_if緇撴瀯鐨勮繛琛紝榪炶〃鐨勬瘡欏瑰唴瀹歸兘鍚湁鍏ㄩ潰鐨勭綉鍗′俊鎭細(xì)灝ゅ叾鏄瓧孌靛悕瀛楀拰鍚湁鍚嶅瓧鐨勬弿榪頒互鍙?qiáng)鏈夊叧椹卞姩鍣ㄧ殑鏄撹M俊鎭?/p>
寰楀埌緗戠粶椹卞姩鍒楄〃鐨勭▼搴忓涓嬶細(xì)
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include "pcap.h"
main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int i=0;
char errbuf[PCAP_ERRBUF_SIZE];
/* 榪欎釜API鐢ㄦ潵鑾峰緱緗戝崱 鐨勫垪琛?*/
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* 鏄劇ず鍒楄〃鐨勫搷搴斿瓧孌電殑鍐呭 */
for(d=alldevs;d;d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return;
}
/* We don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
}
[code]鏈夊叧榪欐紼嬪簭鐨勪竴浜涜鏄庯細(xì)
棣栧厛pcap_findalldevs()鍚屽叾浠栫殑libpcap鍑芥暟涓鏍鋒湁涓涓猠rrbuf鍙傛暟錛屽綋鏈夊紓甯告儏鍐靛彂鐢熸椂錛岃繖涓弬鏁頒細(xì)琚玃CAP濉厖涓烘煇涓壒瀹氱殑閿欒瀛椾覆銆?/p>
鍐嶆錛孶NIX涔熷悓鏍鋒彁渚沺cap_findalldevs()榪欎釜鍑芥暟錛屼絾鏄娉ㄦ剰騫墮潪鎵鏈夌殑緋葷粺閮芥敮鎸乴ibpcap鎻愪緵鐨勭綉緇滅▼搴忔帴鍙ｃ傛墍浠ユ垜闂ㄨ鎯沖啓鍑哄悎閫?/p>
鐨勭▼搴忓氨蹇呴』鑰冭檻鍒拌繖浜涙儏鍐碉紙緋葷粺涓嶈兘澶熻繑鍥炰竴浜涘瓧孌電殑鎻忚堪淇℃伅錛夛紝鍦ㄨ繖縐嶆儏鍐典笅鎴戦棬搴旇緇欏嚭綾諱技"No description available"榪欐牱鐨?/p>
鎻愮ず銆?/p>
鏈鍚庣粨鏉熸椂鍒繕浜嗙敤pcap_freealldevs()閲婃斁鎺夊唴瀛樿祫婧愩?/p>
[code]#include "pcap.h"
main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int i=0;
char errbuf[PCAP_ERRBUF_SIZE];
/* Retrieve the device list */
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* Print the list */
for(d=alldevs;d;d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return;
}
/* We don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
}
浜岋級(jí)鑾峰緱宸插畨瑁呯綉緇滈┍鍔ㄥ櫒鐨勯珮綰т俊鎭?/p>
鍦ㄧ涓绔犱腑婕旂ず浜嗗浣曡幏寰楀凡瀛樺湪閫傞厤鍣ㄧ殑闈欐佷俊鎭傚疄闄呬笂WinPcap鍚屾牱涔熸彁渚涘叾浠栫殑楂樼駭淇℃伅錛岀壒鍒槸 pcap_findalldevs()榪欎釜鍑芥暟榪斿洖
鐨勬瘡涓?pcap_if緇撴瀯浣撻兘鍚屾牱鍖呭惈涓涓猵cap_addr緇撴瀯鐨勫垪琛紝浠栧寘鍚細(xì)
涓涓湴鍧鍒楄〃錛屼竴涓帺鐮佸垪琛紝涓涓箍鎾湴鍧鍒楄〃鍜屼竴涓洰鐨勫湴鍧鍒楄〃銆?br>涓嬮潰鐨勪緥瀛愰氳繃涓涓猧fprint()鍑芥暟鎵撳嵃鍑轟簡pcap_if緇撴瀯鐨勭殑鎵鏈夊瓧孌典俊鎭紝璇ョ▼搴忓姣忎竴涓猵cap_findalldevs()鎵榪斿洖鐨刾cap_if緇撴瀯寰幆璋?/p>
鐢╥fprint()鏉ユ樉紺鴻緇嗙殑瀛楁淇℃伅銆?/p>
紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include "pcap.h"
#ifndef WIN32
#include <sys/socket.h>
#include <netinet/in.h>
#else
#include <winsock.h>
#endif
void ifprint(pcap_if_t *d);
char *iptos(u_long in);
int main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
char errbuf[PCAP_ERRBUF_SIZE+1];
/* 鑾峰緱緗戝崱鐨勫垪琛?*/
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n",errbuf);
exit(1);
}
/* 寰幆璋冪敤ifprint() 鏉ユ樉紺簆cap_if緇撴瀯鐨勪俊鎭?/
for(d=alldevs;d;d=d->next)
{
ifprint(d);
}
return 1;
}
/* Print all the available information on the given interface */
void ifprint(pcap_if_t *d)
{
pcap_addr_t *a;
/* Name */
printf("%s\n",d->name);
/* Description */
if (d->description)
printf("\tDescription: %s\n",d->description);
/* Loopback Address*/
printf("\tLoopback: %s\n",(d->flags & PCAP_IF_LOOPBACK)?"yes":"no");
/* IP addresses */
for(a=d->addresses;a;a=a->next) {
printf("\tAddress Family: #%d\n",a->addr->sa_family);
/*鍏充簬 sockaddr_in 緇撴瀯璇峰弬鑰冨叾浠栫殑緗戠粶緙栫▼涔?/
switch(a->addr->sa_family)
{
case AF_INET:
printf("\tAddress Family Name: AF_INET\n");//鎵撳嵃緗戠粶鍦板潃綾誨瀷
if (a->addr)//鎵撳嵃IP鍦板潃
printf("\tAddress: %s\n",iptos(((struct sockaddr_in *)a->addr)->sin_addr.s_addr));
if (a->netmask)//鎵撳嵃鎺╃爜
printf("\tNetmask: %s\n",iptos(((struct sockaddr_in *)a->netmask)->sin_addr.s_addr));
if (a->broadaddr)//鎵撳嵃騫挎挱鍦板潃
printf("\tBroadcast Address: %s\n",iptos(((struct sockaddr_in *)a->broadaddr)->sin_addr.s_addr));
if (a->dstaddr)//鐩殑鍦板潃
printf("\tDestination Address: %s\n",iptos(((struct sockaddr_in *)a->dstaddr)->sin_addr.s_addr));
break;
default:
printf("\tAddress Family Name: Unknown\n");
break;
}
}
printf("\n");
}
/* 灝嗕竴涓猽nsigned long 鍨嬬殑IP杞崲涓哄瓧絎︿覆綾誨瀷鐨処P */
#define IPTOSBUFFERS 12
char *iptos(u_long in)
{
static char output[IPTOSBUFFERS][3*4+3+1];
static short which;
u_char *p;
p = (u_char *)∈
which = (which + 1 == IPTOSBUFFERS ? 0 : which + 1);
sprintf(output[which], "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
return output[which];
}
涓夛級(jí)鎵撳紑緗戝崱鎹曡幏鏁版嵁鍖?/p>
鐜板湪鎴戦棬宸茬粡鐭ラ亾浜嗗浣曞幓鑾峰緱緗戝崱鐨勪俊鎭幇鍦ㄥ氨璁╂垜浠紑濮嬬湡姝ｇ殑宸ヤ綔錛氭墦寮緗戝崱騫舵崟鑾鋒暟鎹祦銆傚湪榪欎竴鑺?/p>
閲屾垜浠皢鍐欎竴涓墦鍗版祦緇忕綉緇滅殑姣忎釜鏁版嵁鍖呬俊鎭殑紼嬪簭銆傛墦寮緗戝崱鐨勫姛鑳芥槸閫氳繃pcap_open_live()鏉ュ疄鐜扮殑瀹?/p>
鏈変笁涓弬鏁皊naplen promisc to_ms銆?/p>
snaplen鐢ㄤ簬鎸囧畾鎵鎹曡幏鍖呯殑鐗瑰畾閮ㄥ垎錛屽湪涓浜涚郴緇熶笂錛堣薄xBSD and Win32絳夛級(jí)椹卞姩鍙粰鍑烘墍鎹曡幏鏁版嵁鍖呯殑涓閮ㄥ垎鑰屼笉鏄叏閮紝榪欐牱灝卞噺灝戜簡鎷?/p>
璐濇暟鎹殑鏁伴噺浠庤屾彁楂樹簡鍖呮崟鑾風(fēng)殑鏁堢巼銆?/p>
promisc鎸囨槑緗戝崱澶勪簬娣鋒潅妯″紡錛屽湪姝ｅ父鎯呭喌涓嬬綉鍗″彧鎺ュ彈鍘誨線瀹冪殑鍖呰屽幓寰鍏朵粬涓繪満鐨勬暟鎹寘鍒欒蹇界暐銆傜浉鍙嶅綋緗戝崱澶勪簬娣鋒潅 妯″紡鏃朵粬灝嗘帴
鏀舵墍鏈夌殑嫻佺粡瀹冪殑鏁版嵁鍖咃細(xì)榪欏氨鎰忓懗鐫鍦ㄥ叡浜粙璐ㄧ殑鎯呭喌涓嬫垜闂ㄥ彲浠ユ崟鑾?/p>
鍒板叾瀹冧富鏈虹殑鏁版嵁鍖呫傚ぇ閮ㄥ垎鐨勫寘鎹曡幏紼嬪簭閮藉皢娣鋒潅妯″紡璁句負(fù)榛樿錛屾墍鏈夋垜浠湪涓嬮潰鐨勪緥瀛愰噷涔熷皢緗戝崱璁句負(fù)娣鋒潅妯″紡銆倀o_ms 鍙傛暟鎸囧畾璇繪暟鎹?/p>
鐨勮秴鏃舵帶鍒訛紝瓚呮椂浠ユ縐掕綆椼傚綋鍦ㄨ秴鏃舵椂闂村唴緗戝崱涓婃病鏈夋暟鎹埌鏉ユ椂瀵圭綉鍗＄殑璇繪搷浣滃皢榪斿洖錛堝pcap_dispatch() or pcap_next_ex()絳夊嚱鏁?/p>
錛夈傝繕鏈夛紝濡傛灉緗戝崱澶勪簬緇熻妯″紡涓嬶紙璇鋒煡鐪?#8220;緇熻鍜屾敹闆嗙綉緇滄暟鎹祦涓鑺?#8221;錛塼o_ms榪樺畾涔変簡緇熻鐨勬椂闂撮棿闅斻傚鏋滆鍙傛暟涓?閭ｄ箞鎰忓懗鐫娌?/p>
鏈夎秴鏃舵帶鍒訛紝瀵圭綉鍗＄殑璇繪搷浣滃湪娌℃湁鏁版嵁鍒版潵鏄皢姘歌繙鍫靛銆傚鏋滀負(fù)-1閭ｄ箞瀵圭綉鍗＄殑璇繪搷浣滃皢绔嬪嵆榪斿洖涓嶇鏈夋病鏈夋暟鎹彲璇匯?br>紼嬪簭浠ｇ爜錛?[ 澶嶅埗浠ｇ爜鍒板壀璐存澘 ]
#include "pcap.h"
/* prototype of the packet handler */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
main()
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];
/* 鑾峰緱緗戝崱鐨勫垪琛?*/
if (pcap_findalldevs(&alldevs, errbuf) == -1)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit(1);
}
/* 鎵撳嵃緗戝崱淇℃伅 */
for(d=alldevs; d; d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else
printf(" (No description available)\n");
}
if(i==0)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return -1;
}
printf("Enter the interface number (1-%d):",i);
scanf("%d", &inum); //杈撳叆瑕侀夋嫨鎵撳紑鐨勭綉鍗″彿
if(inum < 1 || inum > i) //鍒ゆ柇鍙風(fēng)殑鍚堟硶鎬?br>{
printf("\nInterface number out of range.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
/* 鎵懼埌瑕侀夋嫨鐨勭綉鍗＄粨鏋?*/
for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
/* 鎵撳紑閫夋嫨鐨勭綉鍗?*/
if ( (adhandle= pcap_open_live(d->name, // 璁懼鍚嶇О
65536, // portion of the packet to capture.
// 65536 grants that the whole packet will be captured on all the MACs.
1, // 娣鋒潅妯″紡
1000, // 璇昏秴鏃朵負(fù)1縐?br>errbuf // error buffer
) ) == NULL)
{
fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
printf("\nlistening on %s...\n", d->description);
/* At this point, we don‘t need any more the device list. Free it */
pcap_freealldevs(alldevs);
/* 寮濮嬫崟鑾峰寘 */
pcap_loop(adhandle, 0, packet_handler, NULL);
return 0;
}
/* 瀵規(guī)瘡涓涓埌鏉ョ殑鏁版嵁鍖呰皟鐢ㄨ鍑芥暟 */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
struct tm *ltime;
char timestr[16];
/* 灝嗘椂闂存埑杞彉涓烘槗璇葷殑鏍囧噯鏍煎紡*/
ltime=localtime(&header->ts.tv_sec);
strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);
}
涓鏃︾綉鍗¤鎵撳紑錛屾棫鍙互璋冪敤pcap_dispatch() 鎴杙cap_loop()榪涜鏁版嵁鐨勬崟鑾鳳紝榪欎袱涓嚱鏁扮殑鍔熻兘鍗佸垎鐩鎬技涓嶅悓鐨勬槸pcap_ dispatch()鍙互涓?/p>
琚樆濉烇紝鑰宲cap_loop()鍦ㄦ病鏈夋暟鎹祦鍒拌揪鏃跺皢闃誨銆傚湪榪欎釜綆鍗曠殑渚嬪瓙閲岀敤pcap_loop()灝辮凍澶熶簡錛岃屽湪涓浜涘鏉傜殑紼嬪簭閲屽線寰鐢?/p>
pcap_dispatch()銆?br>Once the adapter is opened, the capture can be started with pcap_dispatch() or pcap_loop(). These
two functions are very similar, the difference is that pcap_ dispatch() is granted to return when
the expires while pcap_loop() doesn‘t return until cnt packets have been captured, so it can
block for an arbitrary period on a few utilized network. pcap_loop() is enough for the purpose of
this sample, while pcap_dispatch() is normally used in more complex program.
榪欎袱涓嚱鏁伴兘鏈夎繑鍥炵殑鍙傛暟錛屼竴涓寚鍚戞煇涓嚱鏁幫紙璇ュ嚱鏁扮敤鏉ユ帴鍙楁暟鎹璇ョ▼搴忎腑鐨刾acket_handler錛夌殑鎸囬拡錛宭ibpcap璋冪敤璇ュ嚱鏁板姣忎釜浠庣綉
涓婂埌鏉ョ殑鏁版嵁鍖呰繘琛屽鐞嗗拰鎺ユ敹鏁版嵁鍖呫傚彟涓涓弬鏁版槸甯︽湁鏃墮棿鎴沖拰鍖呴暱絳変俊鎭殑澶撮儴錛屾渶鍚庝竴涓槸鍚湁鎵鏈夊崗璁ご閮ㄦ暟鎹姤鐨勫疄闄呮暟鎹傛敞
鎰廙AC鐨勫啑浣欐牎楠岀爜涓鑸笉鍑虹幇錛屽洜涓哄綋涓涓、鍒拌揪騫惰紜鍚庣綉鍗″氨鎶婂畠鍒犻櫎浜嗭紝鍚屾牱闇瑕佹敞鎰忕殑鏄ぇ澶氭暟緗戝崱浼?xì)涓㈡帀鍐椾綑鐮佸嚭閿欑殑鏁版嵁鍖呭Q?/p>
鎵浠inPcap涓鑸笉鑳藉鎹曡幏榪欎簺鍑洪敊鐨勬暟鎹姤銆?/p>
鍒氭墠鐨勪緥瀛愰噷浠巔cap_pkthdr涓彁鍙栧嚭浜嗘瘡涓暟鎹姤鐨勬椂闂存埑鍜岄暱搴﹀茍鍦ㄦ樉紺哄櫒涓婃墦鍗板嚭浜嗕粬浠?br>
]]>