Wincap捕獲過濾表達式語法

Question

如何指定用其IP地址過濾tcp服務器端口的語法？

const char *packet_filter = "tcp src port 2054"; 

    bpf_u_int32 netmask; 
    bpf_program fcode; 

    if (d->addresses != NULL) 
     /* Retrieve the mask of the first address of the interface */ 
     netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr; 
    else 
     /* If the interface is without an address we suppose to be in a C class network */ 
     netmask=0xffffff; 


    //compile the filter 
    if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0) 
    { 
     fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n"); 
     /* Free the device list */ 
     pcap_freealldevs(alldevs); 
     return -1; 
    } 

    //set the filter 
    if (pcap_setfilter(adhandle, &fcode) < 0) 
    { 
     fprintf(stderr,"\nError setting the filter.\n"); 
     /* Free the device list */ 
     pcap_freealldevs(alldevs); 
     return -1; 
} 

Answer 1

「TCP和DST主機YOU_SERVER_IP和目標端口2054」

你可以在http://www.cs.ucr.edu/~marios/ethereal-tcpdump.pdf

獲得更多的信息