循序渐进学习使用WINPCAP（二）

末蓝、 2022-09-28 15:18 6阅读 0赞

获得已安装网络驱动器的高级信息

在第一章中演示了如何获得已存在适配器的基本信息（名字和描述）。事实上，WinPcap同样也提供其他的高级信息，特别是 pcap\_findalldevs\_ex()这个函数返回的每个 pcap\_if结构体都同样包含一个pcap\_addr结构的列表，它包含：

*  一个地址列表
 *  一个掩码列表（每一项与地址列表的条目相对应）
 *  一个广播地址列表（每一项与地址列表的条目相对应）
 *  一个目的地址列表（每一项与地址列表的条目相对应）

另外，pcap\_findalldevs\_ex()也能够返回远程的适配器和一个给出的位于本地的文件夹中的pcap列表文件

下面的例子通过一个ifprint()函数打印出了pcap\_if结构的的所有字段信息，该程序对每一个pcap\_findalldevs\_ex()所返回的pcap\_if结构循环调用ifprint()来显示详细的字段信息。

/\* \* Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy) \* Copyright (c) 2005 - 2006 CACE Technologies, Davis (California) \* All rights reserved. \* \* Redistribution and use in source and binary forms, with or without \* modification, are permitted provided that the following conditions \* are met: \* \* 1. Redistributions of source code must retain the above copyright \* notice, this list of conditions and the following disclaimer. \* 2. Redistributions in binary form must reproduce the above copyright \* notice, this list of conditions and the following disclaimer in the \* documentation and/or other materials provided with the distribution. \* 3. Neither the name of the Politecnico di Torino, CACE Technologies \* nor the names of its contributors may be used to endorse or promote \* products derived from this software without specific prior written \* permission. \* \* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT \* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR \* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT \* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT \* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, \* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT \* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE \* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \* \*/ \#include <stdio.h> \#include "pcap.h" \#ifndef WIN32 \#include <sys/socket.h> \#include <netinet/in.h> \#else \#include <winsock.h> \#endif // Function prototypes void ifprint(pcap\_if\_t \*d); char \*iptos(u\_long in); char\* ip6tos(struct sockaddr \*sockaddr, char \*address, int addrlen); int main() \{ pcap\_if\_t \*alldevs; pcap\_if\_t \*d; char errbuf\[PCAP\_ERRBUF\_SIZE+1\]; char source\[PCAP\_ERRBUF\_SIZE+1\]; printf("Enter the device you want to list:/n" "rpcap:// ==> lists interfaces in the local machine/n" "rpcap://hostname:port ==> lists interfaces in a remote machine/n" " (rpcapd daemon must be up and running/n" " and it must accept 'null' authentication)/n" "file://foldername ==> lists all pcap files in the give folder/n/n" "Enter your choice: "); fgets(source, PCAP\_ERRBUF\_SIZE, stdin); source\[PCAP\_ERRBUF\_SIZE\] = '/0'; /\* 获取接口列表 \*/ if (pcap\_findalldevs\_ex(source, NULL, &alldevs, errbuf) == -1) \{ fprintf(stderr,"Error in pcap\_findalldevs: %s/n",errbuf); exit(1); \} /\* 遍历打印 \*/ for(d=alldevs;d;d=d->next) \{ ifprint(d); \} pcap\_freealldevs(alldevs); return 1; \} /\*打印所选接口上的可用信息\*/ void ifprint(pcap\_if\_t \*d) \{ pcap\_addr\_t \*a; char ip6str\[128\]; /\* 名字 \*/ printf("%s/n",d->name); /\* 描述 \*/ if (d->description) printf("/tDescription: %s/n",d->description); /\* 回送地址\*/ printf("/tLoopback: %s/n",(d->flags & PCAP\_IF\_LOOPBACK)?"yes":"no"); /\* IP地址 \*/ for(a=d->addresses;a;a=a->next) \{ printf("/tAddress Family: \#%d/n",a->addr->sa\_family); switch(a->addr->sa\_family) \{ case AF\_INET: /\* IPV4 \*/ printf("/tAddress Family Name: AF\_INET/n"); /\* 打印网络地址类型 \*/ if (a->addr) /\* 打印IP地址 \*/ printf("/tAddress: %s/n",iptos(((struct sockaddr\_in \*)a->addr)->sin\_addr.s\_addr)); if (a->netmask) /\* 打印掩码 \*/ printf("/tNetmask: %s/n",iptos(((struct sockaddr\_in \*)a->netmask)->sin\_addr.s\_addr)); if (a->broadaddr) /\* 打印广播地址 \*/ printf("/tBroadcast Address: %s/n",iptos(((struct sockaddr\_in \*)a->broadaddr)->sin\_addr.s\_addr)); if (a->dstaddr) /\* 打印目的地址 \*/ printf("/tDestination Address: %s/n",iptos(((struct sockaddr\_in \*)a->dstaddr)->sin\_addr.s\_addr)); break; case AF\_INET6: /\* IPV6 \*/ printf("/tAddress Family Name: AF\_INET6/n"); if (a->addr) printf("/tAddress: %s/n", ip6tos(a->addr, ip6str, sizeof(ip6str))); break; default: printf("/tAddress Family Name: Unknown/n"); break; \} \} printf("/n"); \} /\* 将一个unsigned long型的IPV4转换为字符串类型的IP \*/ \#define IPTOSBUFFERS 12 char \*iptos(u\_long in) \{ static char output\[IPTOSBUFFERS\]\[3\*4+3+1\]; static short which; u\_char \*p; p = (u\_char \*)&in; which = (which + 1 == IPTOSBUFFERS ? 0 : which + 1); \_snprintf\_s(output\[which\], sizeof(output\[which\]), sizeof(output\[which\]),"%d.%d.%d.%d", p\[0\], p\[1\], p\[2\], p\[3\]); return output\[which\]; \} /\*将一个unsigned long型的IPV6转换为字符串类型的IP \*/ char\* ip6tos(struct sockaddr \*sockaddr, char \*address, int addrlen) \{ socklen\_t sockaddrlen; \#ifdef WIN32 sockaddrlen = sizeof(struct sockaddr\_in6); \#else sockaddrlen = sizeof(struct sockaddr\_storage); \#endif if(getnameinfo(sockaddr, sockaddrlen, address, addrlen, NULL, 0, NI\_NUMERICHOST) != 0) address = NULL; return address; \}

附原文（程序略）：

Lesson 1 (Obtaining the device list) demonstrated how to get basic information (i.e. device name and description) about available adapters. Actually, WinPcap provides also other advanced information. In particular, every pcap\_if structure returned by pcap\_findalldevs\_ex() contains also a list of pcap\_addr structures, with:

*  a list of addresses for that interface.
 *  a list of netmasks (each of which corresponds to an entry in the addresses list).
 *  a list of broadcast addresses (each of which corresponds to an entry in the addresses list).
 *  a list of destination addresses (each of which corresponds to an entry in the addresses list).

Additionally, pcap\_findalldevs\_ex() can also return remote adapters and a list of pcap files that are located in a given local folder.

The following sample provides an ifprint() function that prints the complete contents of a pcap\_if structure. It is invoked by the program for every entry returned by pcap\_findalldevs\_ex().

/\* codes \*/

\#end