Main Page Modules Data Structures File List Data Fields Globals Related Pages

# pcap_filter.c

Go to the documentation of this file.

    00001 /*
    00002  * Copyright (c) 1999 - 2003
    00003  * NetGroup, Politecnico di Torino (Italy)
    00004  * All rights reserved.
    00005  *
    00006  * Redistribution and use in source and binary forms, with or without
    00007  * modification, are permitted provided that the following conditions
    00008  * are met:
    00009  *
    00010  * 1. Redistributions of source code must retain the above copyright
    00011  * notice, this list of conditions and the following disclaimer.
    00012  * 2. Redistributions in binary form must reproduce the above copyright
    00013  * notice, this list of conditions and the following disclaimer in the
    00014  * documentation and/or other materials provided with the distribution.
    00015  * 3. Neither the name of the Politecnico di Torino nor the names of its
    00016  * contributors may be used to endorse or promote products derived from
    00017  * this software without specific prior written permission.
    00018  *
    00019  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
    00020  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
    00021  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
    00022  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
    00023  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
    00024  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
    00025  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
    00026  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
    00027  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
    00028  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
    00029  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    00030  *
    00031  */
    00032
    00033
    00034 #include <stdlib.h>
    00035 #include <stdio.h>
    00036
    00037 #include <pcap.h>
    00038
    00039 #define MAX_PRINT 80
    00040 #define MAX_LINE 16
    00041
    00042
    00043 void usage();
    00044
    00045
    00046 void main(int argc, char **argv)
    00047 {
    00048 pcap_t *fp;
    00049 char errbuf[PCAP_ERRBUF_SIZE];
    00050 char *source=NULL;
    00051 char *ofilename=NULL;
    00052 char *filter=NULL;
    00053 int i;
    00054 pcap_dumper_t *dumpfile;
    00055 struct bpf_program fcode;
    00056 bpf_u_int32 NetMask;
    00057 int res;
    00058 struct pcap_pkthdr *header;
    00059 u_char *pkt_data;
    00060
    00061     if (argc == 1)
    00062     {
    00063         usage();
    00064         return;
    00065     }
    00066
    00067     for(i=1;i < argc; i+= 2)
    00068     {
    00069
    00070         switch (argv[i] [1])
    00071         {
    00072             case 's':
    00073             {
    00074                 source=argv[i+1];
    00075             };
    00076             break;
    00077
    00078             case 'o':
    00079             {
    00080                 ofilename=argv[i+1];
    00081             };
    00082             break;
    00083
    00084             case 'f':
    00085             {
    00086                 filter=argv[i+1];
    00087             };
    00088             break;
    00089         }
    00090     }
    00091
    00092     // open a capture from the network
    00093     if (source != NULL)
    00094     {
    00095         if ( (fp= pcap_open(argv[2],
    00096                             1514 /*snaplen*/,
    00097                             PCAP_OPENFLAG_PROMISCUOUS /*flags*/,
    00098                             20 /*read timeout*/,
    00099                             NULL /* remote authentication */,
    00100                             errbuf)
    00101                             ) == NULL)
    00102         {
    00103             fprintf(stderr,"\nUnable to open the adapter.\n");
    00104             return;
    00105         }
    00106     }
    00107
    00108     else usage();
    00109
    00110     if (filter != NULL)
    00111     {
    00112         // We should loop through the adapters returned by the pcap_findalldevs_ex()
    00113         // in order to locate the correct one.
    00114         //
    00115         // Let's do things simpler: we suppose to be in a C class network ;-)
    00116         NetMask=0xffffff;
    00117
    00118         //compile the filter
    00119         if(pcap_compile(fp, &fcode, filter, 1, NetMask) < 0)
    00120         {
    00121             fprintf(stderr,"\nError compiling filter: wrong syntax.\n");
    00122             return;
    00123         }
    00124
    00125         //set the filter
    00126         if(pcap_setfilter(fp, &fcode)<0)
    00127         {
    00128             fprintf(stderr,"\nError setting the filter\n");
    00129             return;
    00130         }
    00131
    00132     }
    00133
    00134     //open the dump file
    00135     if (ofilename != NULL)
    00136     {
    00137         dumpfile= pcap_dump_open(fp, ofilename);
    00138
    00139         if (dumpfile == NULL)
    00140         {
    00141             fprintf(stderr,"\nError opening output file\n");
    00142             return;
    00143         }
    00144     }
    00145     else usage();
    00146
    00147     //start the capture
    00148     while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0)
    00149     {
    00150
    00151         if(res == 0)
    00152         /* Timeout elapsed */
    00153         continue;
    00154
    00155         //save the packet on the dump file
    00156         pcap_dump((unsigned char *) dumpfile, header, pkt_data);
    00157
    00158     }
    00159 }
    00160
    00161
    00162 void usage()
    00163 {
    00164
    00165     printf("\npf - Generic Packet Filter.\n");
    00166     printf("\nUsage:\npf [-s source] -o output_file_name -f filter_string\n\n");
    00167     exit(0);
    00168 }

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.