Main Page   Modules   Data Structures   File List   Data Fields   Globals   Related Pages  

pcap_filter.c

Go to the documentation of this file.
00001 /*
00002  * Copyright (c) 1999 - 2002
00003  *  Politecnico di Torino.  All rights reserved.
00004  *
00005  * Redistribution and use in source and binary forms, with or without
00006  * modification, are permitted provided that: (1) source code distributions
00007  * retain the above copyright notice and this paragraph in its entirety, (2)
00008  * distributions including binary code include the above copyright notice and
00009  * this paragraph in its entirety in the documentation or other materials
00010  * provided with the distribution, and (3) all advertising materials mentioning
00011  * features or use of this software display the following acknowledgement:
00012  * ``This product includes software developed by the Politecnico
00013  * di Torino, and its contributors.'' Neither the name of
00014  * the University nor the names of its contributors may be used to endorse
00015  * or promote products derived from this software without specific prior
00016  * written permission.
00017  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
00018  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
00019  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
00020  */
00021 
00022 #include <stdlib.h>
00023 #include <stdio.h>
00024 
00025 #include <pcap.h>
00026 
00027 #define MAX_PRINT 80
00028 #define MAX_LINE 16
00029 
00030 
00031 void dispatcher_handler(u_char *, 
00032     const struct pcap_pkthdr *, const u_char *);
00033 void usage();
00034 
00035 void main(int argc, char **argv) {
00036   pcap_t *fp;
00037   char error[PCAP_ERRBUF_SIZE];
00038   char *device=NULL;
00039   char *ifilename=NULL;
00040   char *ofilename=NULL;
00041   char *filter=NULL;
00042   int i=0;
00043   pcap_dumper_t *dumpfile;
00044   struct bpf_program fcode;
00045   bpf_u_int32 SubNet,NetMask;
00046   
00047   if (argc == 1)
00048   {
00049       usage();
00050       return;
00051   }
00052   
00053   for(i=1;i<argc;i+=2){
00054       
00055       switch (argv[i] [1])
00056       {
00057           
00058       case 'i':
00059           {
00060               device=argv[i+1];
00061           };
00062           break;
00063           
00064       case 'f':
00065           {
00066               ifilename=argv[i+1];
00067           };
00068           break;
00069           
00070       case 'o':
00071           {
00072               ofilename=argv[i+1];
00073           };
00074           break;
00075           
00076       case 'p':
00077           {
00078               filter=argv[i+1];
00079           };
00080           break;
00081           
00082           
00083       }
00084       
00085   }
00086   
00087   //open a capture from the network
00088   if (device != NULL){
00089       if ( (fp= pcap_open_live(device, 1514, 1, 20, error) ) == NULL)
00090       {
00091           fprintf(stderr,"\nUnable to open the adapter.\n");
00092           return;
00093       }
00094   }
00095   //open a capture from file
00096   else if (ifilename != NULL){
00097       if ( (fp = pcap_open_offline(ifilename, NULL) ) == NULL)
00098       {
00099           fprintf(stderr,"\nUnable to find input file.\n");
00100           return;
00101       }
00102   }
00103   else usage();
00104   
00105   if(filter!=NULL){
00106       
00107       //obtain the subnet
00108       if(device!=NULL){
00109           if(pcap_lookupnet(device, &SubNet, &NetMask, error)<0){
00110               fprintf(stderr,"\nUnable to obtain the netmask.\n");
00111               return;
00112           }
00113       }
00114       else NetMask=0xffffff; //If reading from file, we suppose to be in a C class network
00115       
00116       //compile the filter
00117       if(pcap_compile(fp, &fcode, filter, 1, NetMask)<0){
00118           fprintf(stderr,"\nError compiling filter: wrong syntax.\n");
00119           return;
00120       }
00121       
00122       //set the filter
00123       if(pcap_setfilter(fp, &fcode)<0){
00124           fprintf(stderr,"\nError setting the filter\n");
00125           return;
00126       }
00127       
00128   }
00129   
00130   //open the dump file
00131   if (ofilename != NULL){
00132       dumpfile=pcap_dump_open(fp, ofilename);
00133       if(dumpfile==NULL){
00134           fprintf(stderr,"\nError opening output file\n");
00135           return;
00136       }
00137   }
00138   else usage();
00139   
00140   //start the capture
00141   pcap_loop(fp, 0, dispatcher_handler, (unsigned char *)dumpfile);
00142   
00143 }
00144 
00145 
00146 //Callback function called by libpcap for every incoming packet
00147 void dispatcher_handler(u_char *dumpfile,
00148                         const struct pcap_pkthdr *header, const u_char *pkt_data)
00149 {
00150     u_int i=0;
00151     
00152     //save the packet on the dump file
00153     pcap_dump(dumpfile,header,pkt_data);
00154 
00155 }
00156 
00157 
00158 void usage()
00159 {
00160     
00161     printf("\npf - generic packet filter.\nWritten by Loris Degioanni (loris@netgroup-serv.polito.it).");
00162     printf("\nUsage:\npf [-i interface] | [-f input_file_name] -o output_file_name -p packet_filter\n\n");
00163     exit(0);
00164 }

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.