Programming

char filterExpr[1024];
filterExpr = "udp and src host 192.168.16.100 and dst host 55.55.55.55 and src port 3248 and dst port 1234";
putenv("PCAP_SNAPLEN=1600");
putenv("PCAP_FRAMES=2048");
putenv("PCAP_TO_MS=200");
putenv("PCAP_PROMISC=-1");
putenv("PCAP_PROTO=ip");
pCapture = pcap_opn_live(..);
if(!pCapture)
{
    return -1;
}
if(pcap_lookupnet(..)<0)
{
    return -1;
}
if(pcap_compile(pCapture, &fcode, filterExpr, 0, netmask) < 0)
{
    pcap_close(pCapture);
    return -1;
}
if(pcap_setfilter(pCapture, &fcode))
{
    pcap_close(pCapture);
    return -1;
}

if(pCapture)
{
  pcap_close(pCapture);
  pCapture = 0;
}

filterExpr = "vlan 87 and udp and src host 192.168.16.100 and dst host 55.55.55.55 and src port 3248 and dst port 1234";

#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/if_ether.h> 

/* just print a count every time we have a packet...                        */
void my_callback(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char*
        packet)
{
    static int count = 1;
    fprintf(stdout,"%d, ",count);
    fflush(stdout);
    count++;
}

int main(int argc,char **argv)
{ 
    int i;
    char *dev; 
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t* descr;
    const u_char *packet;
    struct pcap_pkthdr hdr;     /* pcap.h                    */
    struct ether_header *eptr;  /* net/ethernet.h            */
    struct bpf_program fp;      /* hold compiled program     */
    bpf_u_int32 maskp;          /* subnet mask               */
    bpf_u_int32 netp;           /* ip                        */


    if(argc != 2){ fprintf(stdout,"Usage: %s \"filter program\"\n"
            ,argv[0]);return 0;}

    /* grab a device to peak into... */
    dev = pcap_lookupdev(errbuf);
    if(dev == NULL)
    { fprintf(stderr,"%s\n",errbuf); exit(1); }
    
    dev = "eth1";
    /* ask pcap for the network address and mask of the device */
    pcap_lookupnet(dev,&netp,&maskp,errbuf);

    /* open device for reading this time lets set it in promiscuous
     * mode so we can monitor traffic to another machine             */
    descr = pcap_open_live(dev,BUFSIZ,1,-1,errbuf);
    if(descr == NULL)
    { printf("pcap_open_live(): %s\n",errbuf); exit(1); }

    /* Lets try and compile the program.. non-optimized */
    if(pcap_compile(descr,&fp,argv[1],0,netp) == -1)
    { fprintf(stderr,"Error calling pcap_compile\n"); exit(1); }

    /* set the compiled program as the filter */
    if(pcap_setfilter(descr,&fp) == -1)
    { fprintf(stderr,"Error setting filter\n"); exit(1); }

    pcap_next(descr, &hdr);
    fprintf(stdout, "pkt length: %d\n", hdr.len);

    pcap_close(descr);
    pcap_freecode(&fp);
    descr = NULL;

    /* grab a device to peak into... */
    dev = pcap_lookupdev(errbuf);
    if(dev == NULL)
    { fprintf(stderr,"%s\n",errbuf); exit(1); }

    dev = "eth1";
    /* ask pcap for the network address and mask of the device */
    pcap_lookupnet(dev,&netp,&maskp,errbuf);

    /* open device for reading this time lets set it in promiscuous
     * mode so we can monitor traffic to another machine             */
    descr = pcap_open_live(dev,BUFSIZ,1,-1,errbuf);
    if(descr == NULL)
    { printf("pcap_open_live(): %s\n",errbuf); exit(1); }

    /* Lets try and compile the program.. non-optimized */
    if(pcap_compile(descr,&fp,argv[1],0,netp) == -1)
    { fprintf(stderr,"Error calling pcap_compile\n"); exit(1); }

    /* set the compiled program as the filter */
    if(pcap_setfilter(descr,&fp) == -1)
    { fprintf(stderr,"Error setting filter\n"); exit(1); }


    /* ... and loop */ 
    pcap_loop(descr,-1,my_callback,NULL);

    return 0;
}