WinCap 使用心得

最近需要设计网络抓包方面的软件，WinCap在这方面还是挺有名气的，于是下载了一个WinCap 4.02做了点研究由于本人一直在用MFC做一些设计，所以这里就MFC下使用WinCap4.02写点心得，主要目的是总结和帮助新手们更快地入门。
一、 配置
第一步：下载官方主页上的WinCap安装包和开发包(Develop)
第二步： 为方便使用把开发包里面的include文件下 的.h文件添加入VC6的include文件夹下面，把lib文件夹下面的.lib文件添加入vc6的lib文件夹下面。
好了现在在开发MFC项 目的使用要使用wincap只需要在项目文档中加入应用#include "pcap.h"，在编译器选项当中增加连接库wcap.lib 和wsock32.lib两个，然和就可以使用wincap提供的函数了。
二、基本的程序
使用wincap最简单的应用是抓包，抓 tcp/ip数据包。其他的就先不看了，直接运行开发包里面给的examples，看看文件：pktdump.h
/*
 * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
 * Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the Politecnico di Torino, CACE Technologies
 * nor the names of its contributors may be used to endorse or promote
 * products derived from this software without specific prior written
 * permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

#include
#include

#include

#define LINE_LEN 16

int main(int argc, char **argv)
{ 
 pcap_if_t *alldevs, *d;
 pcap_t *fp;
 u_int inum, i=0;
 char errbuf[PCAP_ERRBUF_SIZE];
 int res;
 struct pcap_pkthdr *header;
 const u_char *pkt_data;
 
 printf("pktdump_ex: prints the packets of the network using WinPcap.\n");
 printf("   Usage: pktdump_ex [-s source]\n\n"
  "   Examples:\n"
  "      pktdump_ex -s file.acp\n"
  "      pktdump_ex -s ");

 if(argc < 3)
 {
  printf("\nNo adapter selected: printing the device list:\n");
  /* The user didn't provide a packet source: Retrieve the local device list */
  if(pcap_findalldevs(&alldevs, errbuf) == -1)
  {
   fprintf(stderr,"Error in pcap_findalldevs_ex: %s\n", errbuf);
   exit(1);
  }
  
  /* Print the list */
  for(d=alldevs; d; d=d->next)
  {
   printf("%d. %s\n    ", ++i, d->name);

   if (d->description)
    printf(" (%s)\n", d->description);
   else
    printf(" (No description available)\n");
  }
  
  if (i==0)
  {
   printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
   return -1;
  }
  
  printf("Enter the interface number (1-%d):",i);
  scanf("%d", &inum);
  
  if (inum < 1 || inum > i)
  {
   printf("\nInterface number out of range.\n");

   /* Free the device list */
   pcap_freealldevs(alldevs);
   return -1;
  }
  
  /* Jump to the selected adapter */
  for (d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
  
  /* Open the adapter */
  if ((fp = pcap_open_live(d->name, // name of the device
   65536,       // portion of the packet to capture.
           // 65536 grants that the whole packet will be captured on all the MACs.
   1,        // promiscuous mode (nonzero means promiscuous)
   1000,       // read timeout
   errbuf       // error buffer
   )) == NULL)
  {
   fprintf(stderr,"\nError opening adapter\n");
   return -1;
  }
 }
 else
 {
  /* Do not check for the switch type ('-s') */
  if ((fp = pcap_open_live(argv[2], // name of the device
   65536,       // portion of the packet to capture.
           // 65536 grants that the whole packet will be captured on all the MACs.
   1,        // promiscuous mode (nonzero means promiscuous)
   1000,       // read timeout
   errbuf       // error buffer
   )) == NULL)
  {
   fprintf(stderr,"\nError opening adapter\n");
   return -1;
  }
 }

 /* Read the packets */
 while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0)
 {

  if(res == 0)
   /* Timeout elapsed */
   continue;

  /* print pkt timestamp and pkt len */
  printf("%ld:%ld (%ld)\n", header->ts.tv_sec, header->ts.tv_usec, header->len);   
  
  /* Print the packet */
  for (i=1; (i < header->caplen + 1 ) ; i++)
  {
   printf("%.2x ", pkt_data[i-1]);
   if ( (i % LINE_LEN) == 0) printf("\n");
  }
  
  printf("\n\n");  
 }

 if(res == -1)
 {
  printf("Error reading the packets: %s\n", pcap_geterr(fp));
  return -1;
 }

 pcap_close(fp);
 return 0;
}