循序渐进学习使用WINPCAP（四）

清疚 2022-09-28 15:19 17阅读 0赞

不用callback捕获数据报

这节的例子很像先前的一章（获得网卡的高级信息），但是这一节中使用的是pcap\_next\_ex()而非pcap\_loop()。

pcap\_loop()函数的基于回调包捕获机制是一流的，在某些情况下是不错的选择。但是在一些情况下处理回调并不特别好：这会使程序变的复杂并且在象多线程或C++类这些情况下它看起来到象一块绊脚石。

在这些情况下，pcap\_next\_ex()允许直接调用来接收包。使用pcap\_next\_ex()可以仅仅在程序员需要接受的时候接受包。

它的参数和回调捕捉（pcap\_loop()）相同：有一个网卡描述符和一对指针，这两个指针会被初始化并返回给用户。一个指向一个pcap\_pkthdr结构，另一个是指向接收数据的缓冲区。

下面的程序我们将循环调用前一节的例子中的回掉部分，只是把它移到了main里面了，位于函数pcap\_next\_ex()之后。

\#include "pcap.h" int main() \{ pcap\_if\_t \*alldevs; pcap\_if\_t \*d; int inum; int i=0; pcap\_t \*adhandle; int res; char errbuf\[PCAP\_ERRBUF\_SIZE\]; struct tm ltime; char timestr\[16\]; struct pcap\_pkthdr \*header; const u\_char \*pkt\_data; time\_t local\_tv\_sec; /\* 获取本地机器适配器列表 \*/ if (pcap\_findalldevs\_ex(PCAP\_SRC\_IF\_STRING, NULL, &alldevs, errbuf) == -1) \{ fprintf(stderr,"Error in pcap\_findalldevs: %s/n", errbuf); exit(1); \} /\* 打印列表 \*/ for(d=alldevs; d; d=d->next) \{ printf("%d. %s", ++i, d->name); if (d->description) printf(" (%s)/n", d->description); else printf(" (No description available)/n"); \} if(i==0) \{ printf("/nNo interfaces found! Make sure WinPcap is installed./n"); return -1; \} printf("Enter the interface number (1-%d):",i); scanf\_s("%d", &inum); if(inum < 1 || inum > i) \{ printf("/nInterface number out of range./n"); /\* 释放设备列表 \*/ pcap\_freealldevs(alldevs); return -1; \} /\* 转到选择的适配器 \*/ for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++); /\* 打开设备 \*/ if ( (adhandle= pcap\_open(d->name, 65536, PCAP\_OPENFLAG\_PROMISCUOUS, 1000, NULL, errbuf ) ) == NULL) \{ fprintf(stderr,"/nUnable to open the adapter. %s is not supported by WinPcap/n", d->name); pcap\_freealldevs(alldevs); return -1; \} printf("/nlistening on %s.../n", d->description); pcap\_freealldevs(alldevs); /\* 此处循环调用pcap\_next\_ex()获取包 \*/ while((res = pcap\_next\_ex( adhandle, &header, &pkt\_data)) >= 0)\{ if(res == 0) /\* 超时发生 \*/ continue; local\_tv\_sec = header->ts.tv\_sec; localtime\_s(<ime, &local\_tv\_sec); strftime( timestr, sizeof timestr, "%H:%M:%S", <ime); printf("%s,%.6d len:%d/n", timestr, header->ts.tv\_usec, header->len); \} if(res == -1)\{ printf("Error reading the packets: %s/n", pcap\_geterr(adhandle)); return -1; \} return 0; \}

pcap\_next\_ex()只在Win32环境下才行因为它不是原始libpcap API中的一部分，这就意味着依赖于这个函数的代码不会在UNIX下工作。那么为什么我们用pcap\_next\_ex()而不用pcap\_next()？因为pcap\_next()有许多限制，在很多情况下并不鼓励用它。首先它的效率很低，因为它隐藏了回掉方法却任然依赖于pcap\_dispatch()这个函数。其次它不能够识别文件结束标志EOF，所以对来自文件的数据流它几乎无能为力。

最后值得注意的是pcap\_next\_ex()在成功，超时，出错和文件结束的情况下会返回不同的值。

附原文：

The example program in this lesson behaves exactly like the previous program (Opening an adapter and capturing the packets), but it uses pcap\_next\_ex() instead of pcap\_loop().

The callback-based capture mechanism of pcap\_loop() is elegant and it could be a good choice in some situations. However, handling a callback is sometimes not practical -- it often makes the program more complex especially in situations with multithreaded applications or C++ classes.

In these cases, pcap\_next\_ex() retrievs a packet with a direct call -- using pcap\_next\_ex() packets are received only when the programmer wants them.

The parameters of this function are the same as a capture callback -- it takes an adapter descriptor and a couple of pointers that will be initialized and returned to the user (one to a pcap\_pkthdr structure and another to a buffer with the packet data).

In the following program, we recycle the callback code of the previous lesson's example and move it inside main() right after the call to pcap\_next\_ex().

/\* codes \*/

Why do we use pcap\_next\_ex() instead of the old pcap\_next()? Because pcap\_next() has some drawbacks. First of all, it is inefficient because it hides the callback method but still relies on pcap\_dispatch(). Second, it is not able to detect EOF, so it's not very useful when gathering packets from a file.

Notice also that pcap\_next\_ex() returns different values for success, timeout elapsed, error and EOF conditions.

\#end