winpcap函数四步骤捕获报文

1.int pcap_findalldevs(pcap_if_t **, char *)说明：用来获得网卡的列表参数：指向pcap_if_t**类型的列表的指针的指针; char型指针,当打开列表错误时返回错误信息返回值: 为int型，当显示列表失败时返回-1pcap_if_t 是pcap_if 重命名而来：typedef struct pcap_if pcap_if_t;pcap_if结构体如下：struct pcap_if{struct pcap_if *next; /*多个网卡时使用来显示各个网卡的信息*/char *name; /* name to hand to "pcap_open_live()" */char *description; /* textual description of interface, or NULL 就是网卡的型号、名字等*/struct pcap_addr *addresses; //pcap_addr 结构体bpf_u_int32 flags; /* PCAP_IF_ interface flags 接口标志*/};pcap_addr 结构体如下：struct pcap_addr{struct pcap_addr *next;struct sockaddr *addr; /* address */struct sockaddr *netmask; /* netmask for that address 子网掩码*/struct sockaddr *broadaddr; /* broadcast address for that address 广播地址*/struct sockaddr *dstaddr; /* P2P destination address for that address P2P目的地址 */ };举例：pcap_if_t *alldevs;pcap_if_t *d;char errbuf[64];if (pcap_findalldevs(&alldevs, errbuf) == -1)/* 这个API用来获得网卡的列表*/{fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);exit(1);}for(d=alldevs;d;d=d->next)/* 显示列表的响应字段的内容*/{printf("%d. %s", ++i, d->name);if (d->description)printf(" (%s)\n", d->description);elseprintf(" (No description available)\n");}用pcap_findalldevs不能获得网卡的MAC，有两种方法可以实现，一、向自己发送arp包，二、使用IPHelp的API 可以获得。

2. void pcap_freealldevs(pcap_if_t *)说明：与int pcap_findalldevs(pcap_if_t **, char *)配套使用，当不再需要网卡列表时，用此函数free释放空间参数：打开网卡列表时申请的pcap_if_t型的指针举例：pcap_freealldevs(alldevs);3. pcap_t *pcap_open_live(const char * device, int snaplen, int promisc, int to_ms, char ebuf *)说明：被用来得到一个包抓取得描述符参数：device是一个指出要抓取的网络设备的字符串。

snaplen指明最大可抓取的字节长度。

promisc置位表明该接口要被设置成混杂模式。

to_ms以毫秒为单位设置超时时间。

当在超时时间内网卡上没有数据到来时对网卡的读操作将返回（如 pcap_dispatch() or pcap_next_ex()等函数）。

ebuf被用来存放当pcap_open_live()调用失败时，返回的错误字符串。

返回值: pcap_t型的指针，供pcap_dispatch() or pcap_next_ex()等函数调用。

pcap_t的结构体：struct pcap {#ifdef WIN32ADAPTER *adapter;LPPACKET Packet;int timeout;int nonblock;#elseint fd;#endifint snapshot;int linktype;int tzoff; /* timezone offset */int offset; /* offset for proper alignment */struct pcap_sf sf;struct pcap_md md;int bufsize; /* Read buffer. */u_char *buffer;u_char *bp;int cc; //Place holder for pcap_next().u_char *pkt; //Placeholder for filter code if bpf not in kernel.struct bpf_program fcode;char errbuf[PCAP_ERRBUF_SIZE + 1];int dlt_count;int *dlt_list;#ifdef REMOTE/*! \brief '1' if we're the network client; needed by several functions (like pcap_setfilter() ) to know ifthey have to use the socket or they have to open the local adapter. */int rmt_clientside;SOCKET rmt_sockctrl; //!< socket ID of the socket used for the control connection SOCKET rmt_sockdata; //!< socket ID of the socket used for the data connectionpthread_t rmt_threaddata; //!< handle to the receiving thread, we need to kill it in case of 'pcap_clos()'int rmt_flags; //!< we have to save flags, since they are passed by the pcap_open_live(), but they are used by the pcap_start capture()int rmt_capstarted; //!< 'true' if the capture is already started (needed to knoe if we have to call the pcap_startcapture()struct pcap_pkthdr pcap_header; //!< In Linux, you have to copy the packet headers another time before giving them to the user#endif};举例：/* Open the adapter */if ( (adhandle= pcap_open_live(d->name, // name of the device65536, // portion of the packet to capture. 65536 grants that the whole packet will be captured on all the MACs.1, // 混杂模式1000, // 设置超时时间,亳秒为单位errbuf // 发生错误时存放错误内容的缓冲区) ) == NULL){fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");pcap_freealldevs(alldevs);return -1;}4. int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user);说明：捕获数据包；不会响应pcap_open_live()中设置的超时时间参数：p是由pcap_open_live()返回的所打开网卡的指针cnt用于设置所捕获数据包的个数packet_handler是与void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)配合使用的一个参数。

回调函数。

user值一般为NULL举例：pcap_loop(adhandle, 0, packet_handler, NULL);void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data){struct tm *ltime;char timestr[16];ltime=localtime(&header->_sec); /* 将时间戳转变为易读的标准格式*/strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);printf("%s,%.6d len:%d\n", timestr, header->_usec, header->len);。