爲什麼分組的以太網和IP報頭，其通過libpcap的功能捕獲，被扭曲

Question

我使用的libpcap函數pcap_next（）來捕獲來自其他主機 一些TCP包我檢查捕獲的數據包 的字節並注意 數據包的以太網和IP報頭是扭曲的，在很多0的亂七八糟，但TCP頭很好

這是什麼原因？

代碼：

pcap_t* create_pcap_handler() 
{ 
    pcap_t *handle;     /* Session handle */ 
    char *dev;      /* The device to sniff on */ 
    char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */ 
    struct bpf_program fp;   /* The compiled filter */ 
    char filter_exp[] = "port 32000"; /* The filter expression */ 
    bpf_u_int32 mask;    /* Our netmask */ 
    bpf_u_int32 net;    /* Our IP subnet*/ 

    /* Define the device */ 
    dev = pcap_lookupdev(errbuf); 
    if (dev == NULL) { 
      fprintf(stderr, "Couldn't find default device: %s\n", errbuf); 
      exit(2); 
    } 
    /* Find the properties for the device */ 
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) { 
      fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf); 
      net = 0; 
      mask = 0; 
    } 

    struct in_addr tmp; 
    tmp.s_addr=net; 
    char IPdotdec[20]; 
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16); 
    printf("net is %s\n", IPdotdec); 
    tmp.s_addr=mask; 
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16); 
    printf("mask is %s\n", IPdotdec); 
    printf("dev is %s\n",dev); 

    handle = pcap_open_live(dev, BUFSIZ, 0, 0, errbuf); 
    if (handle == NULL) { 
      fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf); 
      exit(2) ; 
    } 
    /* Compile and apply the filter */ 
    if (pcap_compile(handle, &fp, filter_exp, 0, mask) == -1) { 
      fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle)); 
      exit(2); 
    } 
    if (pcap_setfilter(handle, &fp) == -1) { 
      fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle)); 
      exit(2); 
    } 

    return handle; 
} 

和主要功能

int main() 
{ 
    pcap_t * pcap_handler=create_pcap_handler(); 
    struct pcap_pkthdr pcap_header;  /* The header that pcap gives us */ 
    const u_char *pcap_packet;   /* The actual packet */ 
    pcap_packet = pcap_next(pcap_handler, &pcap_header); 
    if(pcap_packet !=NULL) 
      printf("capture one packet with length of %d\n", pcap_header.len); 
    pcap_close(pcap_handler); 


    return 0; 
} 

Answer 1

pcap_packet = pcap_next(pcap_handler, &pcap_header); 
if(pcap_packet !=NULL) 
     printf("capture one packet with length of %d\n", pcap_header.len); 
pcap_close(pcap_handler); 
parse_pkt(pcap_packet,pcap_header.len); 

這是行不通的。

當您關閉pcap_handler，也不能保證通過調用與pcap_handler回到pcap_next()或pcap_next_ex()任何指針將繼續有效。

嘗試

pcap_packet = pcap_next(pcap_handler, &pcap_header); 
if(pcap_packet !=NULL) 
     printf("capture one packet with length of %d\n", pcap_header.len); 
parse_pkt(pcap_packet,pcap_header.len); 
pcap_close(pcap_handler); 

代替。