libcap小例

/*
 * cap.c
 *
 *  Created on: 2010-4-30
 *      Author: root
 */
#include
#include
#include
#include
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
int main(){
        struct bpf_program filter;
        char *dev,errbuf[256];
        char fileter_app[] = "port 23";
        dev = pcap_lookupdev(errbuf);
        if (dev == NULL){
                printf("error:%s\n",errbuf);
                exit(0);
        }else {
                printf("dev:[%s]\n",dev);
                     }
        pcap_t *handle;
        errbuf[0] = 0;
        handle=pcap_open_live(dev,4096,1,0,errbuf);
        pcap_compile(handle, &filter, fileter_app,0,0);
        pcap_setfilter(handle, &filter);
        pcap_loop(handle, 0, packet_handler, NULL);
        exit(0);
}

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data){
                struct tm *ltime;
                char timestr[16];
                /* 将时间戳转变为易读的标准格式*/
                ltime=localtime(&header->ts.tv_sec);
                strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
                printf("%s,%.6d len:%d\n", timestr, (int)header->ts.tv_usec, header->len);
                return;
}