Main Page   Modules   Data Structures   File List   Data Fields   Globals   Related Pages  

pcap_filter.c

Go to the documentation of this file.
00001 /*
00002  * Copyright (c) 1999 - 2003
00003  * NetGroup, Politecnico di Torino (Italy)
00004  * All rights reserved.
00005  * 
00006  * Redistribution and use in source and binary forms, with or without 
00007  * modification, are permitted provided that the following conditions 
00008  * are met:
00009  * 
00010  * 1. Redistributions of source code must retain the above copyright 
00011  * notice, this list of conditions and the following disclaimer.
00012  * 2. Redistributions in binary form must reproduce the above copyright 
00013  * notice, this list of conditions and the following disclaimer in the 
00014  * documentation and/or other materials provided with the distribution. 
00015  * 3. Neither the name of the Politecnico di Torino nor the names of its 
00016  * contributors may be used to endorse or promote products derived from 
00017  * this software without specific prior written permission. 
00018  * 
00019  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
00020  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
00021  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 
00022  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 
00023  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
00024  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 
00025  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 
00026  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
00027  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
00028  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
00029  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
00030  * 
00031  */
00032 
00033 
00034 #include <stdlib.h>
00035 #include <stdio.h>
00036 
00037 #include <pcap.h>
00038 
00039 #define MAX_PRINT 80
00040 #define MAX_LINE 16
00041 
00042 
00043 void usage();
00044 
00045 
00046 void main(int argc, char **argv)
00047 {
00048 pcap_t *fp;
00049 char errbuf[PCAP_ERRBUF_SIZE];
00050 char *source=NULL;
00051 char *ofilename=NULL;
00052 char *filter=NULL;
00053 int i;
00054 pcap_dumper_t *dumpfile;
00055 struct bpf_program fcode;
00056 bpf_u_int32 NetMask;
00057 int res;
00058 struct pcap_pkthdr *header;
00059 u_char *pkt_data;
00060 
00061     if (argc == 1)
00062     {
00063         usage();
00064         return;
00065     }
00066 
00067     for(i=1;i < argc; i+= 2)
00068     {
00069 
00070         switch (argv[i] [1])
00071         {
00072             case 's':
00073             {
00074                 source=argv[i+1];
00075             };
00076             break;
00077 
00078             case 'o':
00079             {
00080                 ofilename=argv[i+1];
00081             };
00082             break;
00083 
00084             case 'f':
00085             {
00086                 filter=argv[i+1];
00087             };
00088             break;
00089         }
00090     }
00091 
00092     // open a capture from the network
00093     if (source != NULL)
00094     {
00095         if ( (fp= pcap_open(argv[2],
00096                             1514 /*snaplen*/,
00097                             PCAP_OPENFLAG_PROMISCUOUS /*flags*/,
00098                             20 /*read timeout*/,
00099                             NULL /* remote authentication */,
00100                             errbuf)
00101                             ) == NULL)
00102         {
00103             fprintf(stderr,"\nUnable to open the adapter.\n");
00104             return;
00105         }
00106     }
00107 
00108     else usage();
00109 
00110     if (filter != NULL)
00111     {
00112         // We should loop through the adapters returned by the pcap_findalldevs_ex()
00113         // in order to locate the correct one.
00114         //
00115         // Let's do things simpler: we suppose to be in a C class network ;-)
00116         NetMask=0xffffff;
00117 
00118         //compile the filter
00119         if(pcap_compile(fp, &fcode, filter, 1, NetMask) < 0)
00120         {
00121             fprintf(stderr,"\nError compiling filter: wrong syntax.\n");
00122             return;
00123         }
00124 
00125         //set the filter
00126         if(pcap_setfilter(fp, &fcode)<0)
00127         {
00128             fprintf(stderr,"\nError setting the filter\n");
00129             return;
00130         }
00131 
00132     }
00133 
00134     //open the dump file
00135     if (ofilename != NULL)
00136     {
00137         dumpfile= pcap_dump_open(fp, ofilename);
00138 
00139         if (dumpfile == NULL)
00140         {
00141             fprintf(stderr,"\nError opening output file\n");
00142             return;
00143         }
00144     }
00145     else usage();
00146 
00147     //start the capture
00148     while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0)
00149     {
00150 
00151         if(res == 0)
00152         /* Timeout elapsed */
00153         continue;
00154 
00155         //save the packet on the dump file
00156         pcap_dump((unsigned char *) dumpfile, header, pkt_data);
00157 
00158     }
00159 }
00160 
00161 
00162 void usage()
00163 {
00164 
00165     printf("\npf - Generic Packet Filter.\n");
00166     printf("\nUsage:\npf [-s source] -o output_file_name -f filter_string\n\n");
00167     exit(0);
00168 }

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.