使用pcap_findalldevs_ex()函數編程,在文檔中是這樣介紹這個函數的:
This function is a superset of the old 'pcap_findalldevs()', which is obsolete, and which allows listing only the devices present on the local machine. Vice versa, pcap_findalldevs_ex() allows listing the devices present on a remote machine as well.
簡單說pcap_findalldevs_ex()是pcap_findalldevs()的一個超集, 他不僅可以擷取本地的裝置列表,還可以擷取遠端電腦的社別列表,但是在將pcap_findalldevs()換成pcap_findalldevs_ex()的過程中卻出現了意想不到的錯誤:(代碼如下)
#include <iostream.h> #include <stdio.h>#include <pcap.h>#define _CRT_SECURE_NO_WARNINGS#pragma comment (lib,"wpcap.lib")void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data);int main(){pcap_t *cap_ins_des;pcap_if_t *alldevs;pcap_if_t *d;char errbuf[PCAP_ERRBUF_SIZE];int i;if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1) {printf("%s\n", errbuf);exit(-1);}d = alldevs;while (d != NULL) {printf("%s\n", d->description == NULL ? NULL : d->description);d = d->next;}d = alldevs;scanf("%d", &i);while (i--)d = d->next;cap_ins_des = pcap_open(d->name, 100, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf);if (cap_ins_des == NULL) {printf("%s\n", errbuf);exit(-1);}pcap_freealldevs(alldevs);pcap_loop(cap_ins_des, 30 , packet_handler, NULL);return 0;}void packet_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data){time_t time = pkt_header->ts.tv_sec;struct tm *ltime = localtime(&time);char timestr[16];(VOID)user;(VOID)pkt_data;strftime(timestr, sizeof timestr, "%H:%M:%S", ltime);printf("%s. %d, %d, %d\n", timestr, pkt_header->ts.tv_usec, pkt_header->caplen, pkt_header->len);}
出現錯誤如下:
--------------------Configuration: 2 - Win32 Debug--------------------Compiling...2.cppc:\users\administrator\desktop\mfc__temp\2.cpp(19) : error C2065: 'pcap_findalldevs_ex' : undeclared identifierc:\users\administrator\desktop\mfc__temp\2.cpp(19) : error C2065: 'PCAP_SRC_IF_STRING' : undeclared identifierc:\users\administrator\desktop\mfc__temp\2.cpp(36) : error C2065: 'pcap_open' : undeclared identifierc:\users\administrator\desktop\mfc__temp\2.cpp(36) : error C2065: 'PCAP_OPENFLAG_PROMISCUOUS' : undeclared identifierc:\users\administrator\desktop\mfc__temp\2.cpp(36) : error C2440: '=' : cannot convert from 'int' to 'struct pcap *' Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast執行 cl.exe 時出錯.2.obj - 1 error(s), 0 warning(s)
有人說這是wincap的一個失誤,忘記把該函數的聲明檔案包含進去了,我開啟pcap.h看了一下,確實沒有pcap_findalldevs_ex函數的聲明,其實,現在的Winpcap做了更新,因為winpcap現在增加了遠程捕獲的功能, 在pcap_findalldevs_ex和pcap_open函數中增加了遠程主機驗證的參數struct pcap_rmtauth * auth,所以將兩個函數的定義轉移到remote-ext.h中去了。
所以現在使用這兩個參數的時候需要包含#include <remote-ext.h> ,但包含之後又出現問題:
--------------------Configuration: 2 - Win32 Debug--------------------Compiling...2.cppc:\program files\microsoft visual studio\vc98\include\remote-ext.h (39) : fatal error C1189: #error : Please do not include this file directly. Just define HAVE_REMOTE and then include pcap.h執行 cl.exe 時出錯.Creating browse info file...BSCMAKE: error BK1506 : cannot open file '.\Debug\2.sbr': No such file or directory執行 bscmake.exe 時出錯.2.exe - 1 error(s), 0 warning(s)
查看錯誤的地方:
#ifndef HAVE_REMOTE#error Please do not include this file directly. Just define HAVE_REMOTE and then include pcap.h#endif
之後,修改為:
#include <stdio.h>#define HAVE_REMOTE#include <pcap.h>
程式終於正常運行!