[Winpcap-users] pcap_findalldevs()

[Guy Harris]

On Feb 6, 2006, at 4:15 PM, Cardenas Arevalo Gustavo Antonio wrote:

> I called to pcap_findalldevs() with the structure:
>
> struct sockaddr {
>   u_int8_t ss_len;
>   u_int8_t ss_family;
>   u_int8_t fill[126];
> }

Don't define your own structure.  Use the "pcap_if_t" structure  
defined by libpcap/WinPcap; pass to pcap_findalldevs():

	a pointer to a pointer to "pcap_if_t";

	a pointer to a "char" array of size PCAP_ERRBUF_SIZE.

If "pcap_findalldevs()" returns -1, the pointer to "pcap_if_t" is  
*NOT* set, but an error message is put into the "char" array; use  
that to display an error.

If "pcap_findalldevs()" returns 0, the pointer to "pcap_if_t" is  
set.  It points to a structure with the following members (this list  
comes straight from the libpcap man page):

               next   if not NULL, a pointer to the next element in   
the  list;
                      NULL for the last element of the list

               name   a  pointer  to  a  string giving a name for the  
device to
                      pass to pcap_open_live()

               description
                      if not NULL, a pointer to a string giving  a   
human-read-
                      able description of the device

               addresses
                      a pointer to the first element of a list of  
addresses for
                      the interface

               flags  interface flags:

                      PCAP_IF_LOOPBACK
                             set if the interface is a loopback  
interface

The structure in question is the first in a list of "pcap_if_t"  
structures, one per interface.  The "next" pointer points to the next  
"pcap_if_t" structure in the list; it's NULL in the last entry in the  
list.

"addresses" points to a list of addresses for the interface.   
Addresses are structures of type "pcap_addr_t"; that structure has  
the following members:

               next   if  not  NULL, a pointer to the next element in  
the list;
                      NULL for the last element of the list

               addr   a pointer to a struct sockaddr containing an  
address

               netmask
                      if not NULL, a pointer to a struct sockaddr  
that contains
                      the  netmask  corresponding  to the address  
pointed to by
                      addr

               broadaddr
                      if not NULL, a pointer to a struct sockaddr  
that contains
                      the   broadcast  address  corresponding  to   
the  address
                      pointed to by addr; may be null if the  
interface  doesn't
                      support broadcasts

               dstaddr
                      if not NULL, a pointer to a struct sockaddr  
that contains
                      the destination  address  corresponding  to   
the  address
                      pointed  to by addr; may be null if the  
interface isn't a
                      point-to-point interface

A "struct sockaddr" has an "sa_family" member, which says what type  
of address it is.

If it's AF_INET, then the address is an IPv4 address, and you should  
cast the pointer to "struct sockaddr" into a pointer to "struct  
sockaddr_in".  A "struct sockaddr_in" has a member "sin_addr", which  
is a "struct in_addr"; that's the IPv4 address.