<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
I'm trying retrieve upd packets with pcap_next_ex but I compare the results with this example in the manual using pcap_loop<BR>
<BR>
<A href="http://www.winpcap.org/docs/docs_40_2/html/group__wpcap__tut6.html">http://www.winpcap.org/docs/docs_40_2/html/group__wpcap__tut6.html</A><BR>
<BR>
and I think something it's wrong, because with pcap_next_ex give me incoherent ports and some ip's, what's happen? thanks<BR>
<BR>
// 4 bytes IP address<BR>typedef struct ip_address{<BR> u_char byte1;<BR> u_char byte2;<BR> u_char byte3;<BR> u_char byte4;<BR>}ip_address;<BR>
// 20 bytes IP Header<BR>typedef struct ip_header{<BR> u_char ver_ihl; // Version (4 bits) + Internet header length (4 bits)<BR> u_char tos; // Type of service<BR> u_short tlen; // Total length<BR> u_short identification; // Identification<BR> u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)<BR> u_char ttl; // Time to live<BR> u_char proto; // Protocol<BR> u_short crc; // Header checksum<BR> ip_address saddr; // Source address<BR> ip_address daddr; // Destination address<BR> u_int op_pad; // Option + Padding -- NOT NEEDED!<BR>}ip_header;<BR>
typedef struct udp_header{<BR> u_short sport; // Source port<BR> u_short dport; // Destination port<BR> u_short len; // Datagram length<BR> u_short crc; // Checksum<BR>}udp_header;<BR>
int main()<BR>{<BR> pcap_if_t *alldevs;<BR> pcap_if_t *d;<BR> int inum;<BR> int i=0;<BR> pcap_t *adhandle;<BR> int res;<BR> char errbuf[PCAP_ERRBUF_SIZE];<BR> struct tm *ltime;<BR> char timestr[16];<BR> struct pcap_pkthdr *header;<BR> const u_char *pkt_data;<BR> time_t local_tv_sec;<BR>
<BR> /* Retrieve the device list on the local machine */<BR> if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)<BR> {<BR> fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);<BR> exit(1);<BR> }<BR>
/* Print the list */<BR> for(d=alldevs; d; d=d->next)<BR> {<BR> printf("%d. %s", ++i, d->name);<BR> if (d->description)<BR> printf(" (%s)\n", d->description);<BR> else<BR> printf(" (No description available)\n");<BR> }<BR>
if(i==0)<BR> {<BR> printf("\nNo interfaces found! Make sure WinPcap is installed.\n");<BR> return -1;<BR> }<BR>
printf("Enter the interface number (1-%d):",i);<BR> scanf("%d", &inum);<BR>
if(inum < 1 || inum > i)<BR> {<BR> printf("\nInterface number out of range.\n");<BR> /* Free the device list */<BR> pcap_freealldevs(alldevs);<BR> return -1;<BR> }<BR>
/* Jump to the selected adapter */<BR> for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);<BR>
/* Open the device */<BR> if ( (adhandle= pcap_open(d->name, // name of the device<BR> 65536, // portion of the packet to capture.<BR> // 65536 guarantees that the whole packet will be captured on all the link layers<BR> PCAP_OPENFLAG_PROMISCUOUS, // promiscuous mode<BR> 1000, // read timeout<BR> NULL, // authentication on the remote machine<BR> errbuf // error buffer<BR> ) ) == NULL)<BR> {<BR> fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);<BR> /* Free the device list */<BR> pcap_freealldevs(alldevs);<BR> return -1;<BR> }<BR>
printf("\nlistening on %s...\n", d->description);<BR>
/* At this point, we don't need any more the device list. Free it */<BR> pcap_freealldevs(alldevs);<BR>
<BR>ip_header *ip; //ip header<BR>udp_header *udp;<BR>u_int ip_len;<BR>u_short sport,dport;<BR>
<BR> while((res=pcap_next_ex( adhandle, &header, &pkt_data))>=0)<BR> {<BR>
if(res == 0)<BR> //Timeout elapsed<BR> continue;<BR>
ip = (ip_header*)(pkt_data + 14);<BR>
ip_len = (ip->ver_ihl & 0xf) * 4; //Longitud de Ip header<BR>udp = (udp_header *)((u_char *)ip + ip_len);<BR>
sport = ntohs( udp->sport );<BR>dport = ntohs( udp->dport );<BR>
printf("Dir Sourc: %d.%d.%d.%d\n", ip->saddr.byte1,ip->saddr.byte2,ip->saddr.byte3,ip->saddr.byte4);<BR>printf("Dir Dest: %d.%d.%d.%d\n", ip->daddr.byte1,ip->daddr.byte2,ip->daddr.byte3,ip->daddr.byte4);<BR>
printf("Port Sourc: %d\n", sport);<BR>printf("Port Dest: %d\n", dport);<BR>
<BR>
}<BR> if(res == -1){<BR> printf("Error reading the packets: %s\n", pcap_geterr(adhandle));<BR> return -1;<BR> }<BR> return 0;<BR>}<BR><br /><hr />Sigue de cerca las últimas tendencias y lo que más rompe <a href='http://video.msn.com/video.aspx?mkt=es-es' target='_new'>MSN Vídeo</a></body>
</html>