Main Page   Modules   Data Structures   File List   Data Fields   Globals   Related Pages  

pcap_filter.c

Go to the documentation of this file.
00001 /*
00002  * Copyright (c) 1999 - 2003
00003  * NetGroup, Politecnico di Torino (Italy)
00004  * All rights reserved.
00005  * 
00006  * Redistribution and use in source and binary forms, with or without 
00007  * modification, are permitted provided that the following conditions 
00008  * are met:
00009  * 
00010  * 1. Redistributions of source code must retain the above copyright 
00011  * notice, this list of conditions and the following disclaimer.
00012  * 2. Redistributions in binary form must reproduce the above copyright 
00013  * notice, this list of conditions and the following disclaimer in the 
00014  * documentation and/or other materials provided with the distribution. 
00015  * 3. Neither the name of the Politecnico di Torino nor the names of its 
00016  * contributors may be used to endorse or promote products derived from 
00017  * this software without specific prior written permission. 
00018  * 
00019  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
00020  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
00021  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 
00022  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 
00023  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
00024  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 
00025  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 
00026  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
00027  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
00028  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
00029  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
00030  * 
00031  */
00032 
00033 
00034 #include <stdlib.h>
00035 #include <stdio.h>
00036 
00037 #include <pcap.h>
00038 
00039 #define MAX_PRINT 80
00040 #define MAX_LINE 16
00041 
00042 
00043 void usage();
00044 
00045 
00046 void main(int argc, char **argv)
00047 {
00048 pcap_t *fp;
00049 char errbuf[PCAP_ERRBUF_SIZE];
00050 char *source=NULL;
00051 char *ofilename=NULL;
00052 char *filter=NULL;
00053 int i;
00054 pcap_dumper_t *dumpfile;
00055 struct bpf_program fcode;
00056 bpf_u_int32 NetMask;
00057 int res;
00058 struct pcap_pkthdr *header;
00059 u_char *pkt_data;
00060 
00061     if (argc == 1)
00062     {
00063         usage();
00064         return;
00065     }
00066 
00067     for(i=1;i < argc; i+= 2)
00068     {
00069 
00070         switch (argv[i] [1])
00071         {
00072             case 's':
00073                 source=argv[i+1]; break;
00074 
00075             case 'o':
00076                 ofilename=argv[i+1]; break;
00077 
00078             case 'f':
00079                 filter=argv[i+1]; break;
00080         }
00081     }
00082 
00083     // open a capture from the network
00084     if (source != NULL)
00085     {
00086         if ( (fp= pcap_open(argv[2],
00087                             1514 /*snaplen*/,
00088                             PCAP_OPENFLAG_PROMISCUOUS /*flags*/,
00089                             20 /*read timeout*/,
00090                             NULL /* remote authentication */,
00091                             errbuf)
00092                             ) == NULL)
00093         {
00094             fprintf(stderr,"\nUnable to open the adapter.\n");
00095             return;
00096         }
00097     }
00098 
00099     else usage();
00100 
00101     if (filter != NULL)
00102     {
00103         // We should loop through the adapters returned by the pcap_findalldevs_ex()
00104         // in order to locate the correct one.
00105         //
00106         // Let's do things simpler: we suppose to be in a C class network ;-)
00107         NetMask=0xffffff;
00108 
00109         //compile the filter
00110         if (pcap_compile(fp, &fcode, filter, 1, NetMask) < 0)
00111         {
00112             fprintf(stderr,"\nError compiling filter: wrong syntax.\n");
00113             return;
00114         }
00115 
00116         //set the filter
00117         if (pcap_setfilter(fp, &fcode) < 0)
00118         {
00119             fprintf(stderr,"\nError setting the filter\n");
00120             return;
00121         }
00122 
00123     }
00124 
00125     //open the dump file
00126     if (ofilename != NULL)
00127     {
00128         dumpfile= pcap_dump_open(fp, ofilename);
00129 
00130         if (dumpfile == NULL)
00131         {
00132             fprintf(stderr,"\nError opening output file\n");
00133             return;
00134         }
00135     }
00136     else usage();
00137 
00138     //start the capture
00139     while ((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0)
00140     {
00141         if(res == 0)
00142         /* Timeout elapsed */
00143         continue;
00144 
00145         //save the packet on the dump file
00146         pcap_dump((unsigned char *) dumpfile, header, pkt_data);
00147     }
00148 }
00149 
00150 
00151 void usage()
00152 {
00153 
00154     printf("\npf - Generic Packet Filter.\n");
00155     printf("\nUsage:\npf [-s source] -o output_file_name -f filter_string\n\n");
00156     exit(0);
00157 }

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.