详解 pcap_findalldevs_ex

pcap是packet capture的缩写。意为抓包。

功能：查找所有网络设备

原型：int pcap_findalldevs_ex(char* source, struct pcap_rmtauth *auth, pcap_if_t** alldevs, char* errbuf );

返回值：0表示查找成功。-1表示查找失败

参数说明：

source:

指定是本地适配器或者远程适配器

本地适配器：'rpcap://'

远程适配器：'rpcap://host:port'

抓包文件。'file://c:/myfolder/'.

Defined:

#define	PCAP_SRC_FILE_STRING "file://"
	String that will be used to determine the type of source in use (file, remote/local interface).
#define	PCAP_SRC_IF_STRING "rpcap://"
	String that will be used to determine the type of source in use (file, remote/local interface).

详细描述：

The formats allowed by the pcap_open() are the following:

file://path_and_filename [opens a local file]

rpcap://devicename [opens the selected device devices available on the local host, without using the RPCAP protocol]

rpcap://host/devicename [opens the selected device available on a remote host]

rpcap://host:port/devicename [opens the selected device available on a remote host, using a non-standard port for RPCAP]

adaptername [to open a local adapter; kept for compability, but it is strongly discouraged]

(NULL) [to open the first local adapter; kept for compability, but it is strongly discouraged]

The formats allowed by the pcap_findalldevs_ex() are the following:

file://folder/ [lists all the files in the given folder]

rpcap:// [lists all local adapters]

rpcap://host:port/ [lists the devices available on a remote host]

Referring to the 'host' and 'port' paramters, they can be either numeric or literal. Since IPv6 is fully supported, these are the allowed formats:

host (literal): e.g. host.foo.bar

host (numeric IPv4): e.g. 10.11.12.13

host (numeric IPv4, IPv6 style): e.g. [10.11.12.13]

host (numeric IPv6): e.g. [1:2:3::4]

port: can be either numeric (e.g. '80') or literal (e.g. 'http')

Here you find some allowed examples:

rpcap://host.foo.bar/devicename [everything literal, no port number]

rpcap://host.foo.bar:1234/devicename [everything literal, with port number]

rpcap://10.11.12.13/devicename [IPv4 numeric, no port number]

rpcap://10.11.12.13:1234/devicename [IPv4 numeric, with port number]

rpcap://[10.11.12.13]:1234/devicename [IPv4 numeric with IPv6 format, with port number]

rpcap://[1:2:3::4]/devicename [IPv6 numeric, no port number]

rpcap://[1:2:3::4]:1234/devicename [IPv6 numeric, with port number]

rpcap://[1:2:3::4]:http/devicename [IPv6 numeric, with literal port number]

struct pcap_rmtauth的定义如下：

struct pcap_rmtauth
{
int type;
char *username;
char *password;
};

type:简要身份验证所需的类型。

username:用户名

password:密码

auth参数可以为NULL.

pcap_if_t的定义如下：

struct pcap_if {
struct pcap_if *next;
char *name;        /* name to hand to "pcap_open_live()" */
char *description;    /* textual description of interface, or NULL */
struct pcap_addr *addresses;
bpf_u_int32 flags;    /* PCAP_IF_ interface flags */
};

pcap_addr的定义如下：

struct pcap_addr {
struct pcap_addr *next;
struct sockaddr *addr;        /* address */
struct sockaddr *netmask;    /* netmask for that address */
struct sockaddr *broadaddr;    /* broadcast address for that address */
struct sockaddr *dstaddr;    /* P2P destination address for that address */
};

bpf_u_int32的定义如下：

typedef unsigned int    u_int;

typedef    u_int bpf_u_int32;

struct sockaddr的定义如下：

struct sockaddr {
u_short sa_family;              /* address family */
char    sa_data[14];            /* up to 14 bytes of direct address */
};

alldevs参数用于存放获取的适配器数据。如果查找失败，alldevs的值为NULL.

errbuf参数存放查找失败的信息。