Main Page Modules Data Structures File List Data Fields Globals Related Pages

# pcap_filter.c

Go to the documentation of this file.

    00001 /*
    00002  * Copyright (c) 1999 - 2002
    00003  *  Politecnico di Torino.  All rights reserved.
    00004  *
    00005  * Redistribution and use in source and binary forms, with or without
    00006  * modification, are permitted provided that: (1) source code distributions
    00007  * retain the above copyright notice and this paragraph in its entirety, (2)
    00008  * distributions including binary code include the above copyright notice and
    00009  * this paragraph in its entirety in the documentation or other materials
    00010  * provided with the distribution, and (3) all advertising materials mentioning
    00011  * features or use of this software display the following acknowledgement:
    00012  * ``This product includes software developed by the Politecnico
    00013  * di Torino, and its contributors.'' Neither the name of
    00014  * the University nor the names of its contributors may be used to endorse
    00015  * or promote products derived from this software without specific prior
    00016  * written permission.
    00017  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
    00018  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
    00019  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
    00020  */
    00021
    00022 #include <stdlib.h>
    00023 #include <stdio.h>
    00024
    00025 #include <pcap.h>
    00026
    00027 #define MAX_PRINT 80
    00028 #define MAX_LINE 16
    00029
    00030
    00031 void dispatcher_handler(u_char *,
    00032     const struct pcap_pkthdr *, const u_char *);
    00033 void usage();
    00034
    00035 void main(int argc, char **argv) {
    00036   pcap_t *fp;
    00037   char error[PCAP_ERRBUF_SIZE];
    00038   char *device=NULL;
    00039   char *ifilename=NULL;
    00040   char *ofilename=NULL;
    00041   char *filter=NULL;
    00042   int i=0;
    00043   pcap_dumper_t *dumpfile;
    00044   struct bpf_program fcode;
    00045   bpf_u_int32 SubNet,NetMask;
    00046
    00047   if (argc == 1)
    00048   {
    00049       usage();
    00050       return;
    00051   }
    00052
    00053   for(i=1;i<argc;i+=2){
    00054
    00055       switch (argv[i] [1])
    00056       {
    00057
    00058       case 'i':
    00059           {
    00060               device=argv[i+1];
    00061           };
    00062           break;
    00063
    00064       case 'f':
    00065           {
    00066               ifilename=argv[i+1];
    00067           };
    00068           break;
    00069
    00070       case 'o':
    00071           {
    00072               ofilename=argv[i+1];
    00073           };
    00074           break;
    00075
    00076       case 'p':
    00077           {
    00078               filter=argv[i+1];
    00079           };
    00080           break;
    00081
    00082
    00083       }
    00084
    00085   }
    00086
    00087   //open a capture from the network
    00088   if (device != NULL){
    00089       if ( (fp= pcap_open_live(device, 1514, 1, 20, error) ) == NULL)
    00090       {
    00091           fprintf(stderr,"\nUnable to open the adapter.\n");
    00092           return;
    00093       }
    00094   }
    00095   //open a capture from file
    00096   else if (ifilename != NULL){
    00097       if ( (fp = pcap_open_offline(ifilename, NULL) ) == NULL)
    00098       {
    00099           fprintf(stderr,"\nUnable to find input file.\n");
    00100           return;
    00101       }
    00102   }
    00103   else usage();
    00104
    00105   if(filter!=NULL){
    00106
    00107       //obtain the subnet
    00108       if(device!=NULL){
    00109           if(pcap_lookupnet(device, &SubNet, &NetMask, error)<0){
    00110               fprintf(stderr,"\nUnable to obtain the netmask.\n");
    00111               return;
    00112           }
    00113       }
    00114       else NetMask=0xffffff; //If reading from file, we suppose to be in a C class network
    00115
    00116       //compile the filter
    00117       if(pcap_compile(fp, &fcode, filter, 1, NetMask)<0){
    00118           fprintf(stderr,"\nError compiling filter: wrong syntax.\n");
    00119           return;
    00120       }
    00121
    00122       //set the filter
    00123       if(pcap_setfilter(fp, &fcode)<0){
    00124           fprintf(stderr,"\nError setting the filter\n");
    00125           return;
    00126       }
    00127
    00128   }
    00129
    00130   //open the dump file
    00131   if (ofilename != NULL){
    00132       dumpfile=pcap_dump_open(fp, ofilename);
    00133       if(dumpfile==NULL){
    00134           fprintf(stderr,"\nError opening output file\n");
    00135           return;
    00136       }
    00137   }
    00138   else usage();
    00139
    00140   //start the capture
    00141   pcap_loop(fp, 0, dispatcher_handler, (unsigned char *)dumpfile);
    00142
    00143 }
    00144
    00145
    00146 //Callback function called by libpcap for every incoming packet
    00147 void dispatcher_handler(u_char *dumpfile,
    00148                         const struct pcap_pkthdr *header, const u_char *pkt_data)
    00149 {
    00150     u_int i=0;
    00151
    00152     //save the packet on the dump file
    00153     pcap_dump(dumpfile,header,pkt_data);
    00154
    00155 }
    00156
    00157
    00158 void usage()
    00159 {
    00160
    00161     printf("\npf - generic packet filter.\nWritten by Loris Degioanni (loris@netgroup-serv.polito.it).");
    00162     printf("\nUsage:\npf [-i interface] | [-f input_file_name] -o output_file_name -p packet_filter\n\n");
    00163     exit(0);
    00164 }

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.