[Winpcap-users] Problems with Tutorial "Filtering the traffic"

Guy Harris guy at alum.mit.edu
Wed Mar 15 09:13:39 GMT 2006


Benjamin Amaudric wrote:
> *I have this problem when I complie this code:*

	...

> pcap_t *adhandle;

	...

>  pcap_t *fp;

>   /* Open the adapter */
>   if ((fp = pcap_open_live(d->name, // name of the device
>    65536,       // portion of the packet to capture.
>            // 65536 grants that the whole packet will be captured on all 
> the MACs.
>    1,        // promiscuous mode (nonzero means promiscuous)
>    1000,       // read timeout
>    errbuf       // error buffer
>    )) == NULL)
>   {
>    fprintf(stderr,"\nError opening adapter\n");
>    return -1;
>   }
>  }
>  else
>  {
>   /* Do not check for the switch type ('-s') */
>   if ((fp = pcap_open_live(argv[2], // name of the device
>    65536,       // portion of the packet to capture.
>            // 65536 grants that the whole packet will be captured on all 
> the MACs.
>    1,        // promiscuous mode (nonzero means promiscuous)
>    1000,       // read timeout
>    errbuf       // error buffer
>    )) == NULL)
>   {
>    fprintf(stderr,"\nError opening adapter\n");
>    return -1;
>   }
>  }

	...

>     //compile the filter
>     if (pcap_compile(adhandle, &fcode, "ip and tcp", 1, netmask) < 0)

You meant to say

      if (pcap_compile(fp, &fcode, "ip and tcp", 1, netmask) < 0)

because you assigned the result of "pcap_open_live()" to "fp", not to 
"adhandle".

>     //set the filter
>     if (pcap_setfilter(adhandle, &fcode) < 0)

Same there - use "fp", not "adhandle".

Then get rid of the "adhandle" variable, as it's not used (and so that 
you don't forget and use it in another call).


More information about the Winpcap-users mailing list