libpcap和pfring应用程序--Pcap_open_live(二)

末蓝、 2022-09-30 09:44 908阅读 0赞

首先以libpcap为主线，先通过pcap\_open\_live函数，做一些初始化的操作，比如打开网卡，设置好读取数据包的回调函数等等，然后就可以通过pcap\_next，pcap\_next\_ex，pcap\_dispatch，pcap\_loop来捕获数据包了。本文的主要宗旨是分析源码，从应用层的libpcap，pfring一直分析到内核的PF\_RING，通过对源码的讲解，使得我们深入的理解PF\_RING，及它是怎样改善libpcap捕获数据包的性能的。

1) pcap\_open\_live

首先还是从应用层的libpcap开始分析，第一个分析的函数pcap\_open\_live，在pcap.c文件中找到pcap\_open\_live函数，源码如下：

pcap\_t \* **pcap\_open\_live**(constchar \*source, int snaplen, int promisc, int to\_ms, char \*errbuf)

pcap\_t\*p;

intstatus;

p= pcap\_create(source, errbuf);

if(p == NULL)

return(NULL);

status= pcap\_set\_snaplen(p, snaplen);

if(status < 0)

gotofail;

status= pcap\_set\_promisc(p, promisc);

if(status < 0)

gotofail;

status= pcap\_set\_timeout(p, to\_ms);

if(status < 0)

gotofail;

p->oldstyle= 1;

status= pcap\_activate(p);

if(status < 0)

gotofail;

return(p);

fail:

if(status == PCAP\_ERROR)

snprintf(errbuf,PCAP\_ERRBUF\_SIZE, "%s: %s", source,

p->errbuf);

elseif (status == PCAP\_ERROR\_NO\_SUCH\_DEVICE ||

status == PCAP\_ERROR\_PERM\_DENIED)

snprintf(errbuf,PCAP\_ERRBUF\_SIZE, "%s: %s (%s)", source,

pcap\_statustostr(status), p->errbuf);

else

snprintf(errbuf,PCAP\_ERRBUF\_SIZE, "%s: %s", source,

pcap\_statustostr(status));

pcap\_close(p);

return(NULL);

从上面的源码可以看出，pcap\_open\_live函数首先调用pcap\_create函数，这个函数里面的内容到下面在进行分析，然后调用pcap\_set\_snaplen设置最大捕获包的长度，对于以太网数据包，最大长度为1518bytes，默认可以设置成65535就可以捕获所有的数据包了。然后调用pcap\_set\_promisc设置数据包的捕获模式，1为混杂模式，pcap\_set\_timeout函数的作用是设置超时的时间，当应用程序在这个时间内没读到数据就返回。接着就是pcap\_activate函数了，这个也在下面进行讲解。其实在pcap\_create函数和pcap\_activate函数之间还可以调用pcap\_set\_buffer\_size函数设置内核缓冲区的大小，这个函数我们可以在opentest.c文件中看到它的调用方法。我也会在下文中进行讲解。

Libpcap源码为了支持多个[操作系统][Link 1]，代码错综复杂，你搜一下pcap\_create函数，有很多地方定义了该函数，但是我们是在[Linux][]系统下进行源码分析，所以我们首先在pcap\_linux.c下面搜索pcap\_create函数，源码如下：

pcap\_t \* pcap\_create(constchar \*device, char \*ebuf)

\{      //device 为网卡的设备名，ebuf：存放错误信息的缓冲区

pcap\_t \*handle;

/\*

\* A null device name is equivalent to the"any" device.

\*/

if (device == NULL)

device ="any";

\#ifdef HAVE\_DAG\_API

if (strstr(device,"dag")) \{

returndag\_create(device, ebuf);

\#endif /\* HAVE\_DAG\_API \*/

\#ifdef HAVE\_SEPTEL\_API

if (strstr(device,"septel")) \{

returnseptel\_create(device, ebuf);

\#endif /\* HAVE\_SEPTEL\_API \*/

\#ifdef HAVE\_SNF\_API

handle =snf\_create(device, ebuf);

if (strstr(device,"snf") || handle != NULL)

return handle;

\#endif /\* HAVE\_SNF\_API \*/

\#ifdef PCAP\_SUPPORT\_BT

if (strstr(device,"bluetooth")) \{

returnbt\_create(device, ebuf);

\#endif

\#ifdef PCAP\_SUPPORT\_CAN

if (strstr(device,"can") || strstr(device, "vcan")) \{

returncan\_create(device, ebuf);

\#endif

\#ifdef PCAP\_SUPPORT\_USB

if (strstr(device,"usbmon")) \{

returnusb\_create(device, ebuf);

\#endif

handle = pcap\_create\_common(device, ebuf);

if (handle == NULL)

return NULL;

// pcap\_create\_common为初始化的函数，通过网卡设备的名字，获得pcap\_t\*一个句柄，然后再设定handle的回调函数。

handle->activate\_op =pcap\_activate\_linux;

handle->can\_set\_rfmon\_op= pcap\_can\_set\_rfmon\_linux;  //设置rfmonmode

return handle;

为了支持不同的设备，pcap\_create通过 \#ifdef进行区分，这样就将打开不同的设备集成在一个函数中，而在我们的应用中就是普通的网卡，所以它就是调用pcap\_create\_common函数，它在pcap.c中定义，感觉有点混乱，为什么不直接在pcap-linux.c中定义呢，个人观点，应该在pcap-linux中定义，显的直观些，害我跟踪的时候，还要到pcap.c中取找这个函数，因为libpcap还要兼容其它操作系统的原因吧，因为你把它放在pcap-linux.c，其它操作系统调用这个函数，就不方便了，从这一点考虑，libpcap的作者们的[架构][Link 2]还是挺不错的。另外定义2个回调函数pcap\_activate\_linux和pcap\_can\_set\_rfmon\_linux函数。Pcap\_create函数的返回值为pcap\_t\*类型的网卡的句柄。既然讲到了pcap\_create函数，就必须跟踪到pcap\_create\_common函数及另外的2个回调函数中去。下面接着看pcap\_create\_common函数的源码。

pcap\_t \*pcap\_create\_common(constchar \*source, char \*ebuf)

pcap\_t\*p;

p= malloc(sizeof(\*p));         //给p分配内存

if(p == NULL) \{

snprintf(ebuf,PCAP\_ERRBUF\_SIZE, "malloc: %s",

pcap\_strerror(errno));

return(NULL);

memset(p,0, sizeof(\*p));      //对p的内存区域清0

\#ifndef WIN32

p->fd= -1;     /\* not opened yet \*/

p->selectable\_fd= -1;

p->send\_fd= -1;

\#endif

p->opt.source= strdup(source);    //source为网卡的名字

if(p->opt.source == NULL) \{

snprintf(ebuf,PCAP\_ERRBUF\_SIZE, "malloc: %s",

pcap\_strerror(errno));

free(p);

return(NULL);

/\*

\* Default to"can't set rfmon mode"; if it's supported by

\* a platform, thecreate routine that called us can set

\* the op to its routineto check whether a particular

\* device supports it.

\*/

p->can\_set\_rfmon\_op= pcap\_cant\_set\_rfmon;

initialize\_ops(p);

/\*put in some defaults\*/

pcap\_set\_timeout(p,0);

pcap\_set\_snaplen(p,65535);  /\* max packet size \*/

p->opt.promisc= 0;

p->opt.buffer\_size= 0;

return(p);

在这个函数中，需要讲解的是strdup函数，它的作用是复制字符串，返回指向被复制的字符串的指针。注意应用它时，需要加头文件\#include <string.h>。

p->can\_set\_rfmon\_op =pcap\_cant\_set\_rfmon; 这句话的作用在函数里面的注释中已经讲了，默认为不设置rfmon mode。initialize\_ops(p);函数的作用就是设置初始化的一系列回调函数。

pcap\_set\_timeout(p,0);

pcap\_set\_snaplen(p,65535);  /\* max packet size \*/

p->opt.promisc= 0;

p->opt.buffer\_size= 0;

这几行代码的作用是设置初始的超时，snaplen=65535，设置成非混杂模式，内核缓冲区的大小初始化为0。整的来说pcap\_create\_common就是一个初始化函数。

其中initialize\_ops函数的源码如下：

static void initialize\_ops(pcap\_t\*p)

/\*

\* Set operationpointers for operations that only work on

\* an activated pcap\_tto point to a routine that returns

\* a "this isn'tactivated" error.

\*/

p->read\_op= (read\_op\_t)pcap\_not\_initialized;

p->inject\_op= (inject\_op\_t)pcap\_not\_initialized;

p->setfilter\_op= (setfilter\_op\_t)pcap\_not\_initialized;

p->setdirection\_op= (setdirection\_op\_t)pcap\_not\_initialized;

p->set\_datalink\_op= (set\_datalink\_op\_t)pcap\_not\_initialized;

p->getnonblock\_op= (getnonblock\_op\_t)pcap\_not\_initialized;

p->setnonblock\_op= (setnonblock\_op\_t)pcap\_not\_initialized;

p->stats\_op= (stats\_op\_t)pcap\_not\_initialized;

\#ifdef WIN32

p->setbuff\_op= (setbuff\_op\_t)pcap\_not\_initialized;

p->setmode\_op= (setmode\_op\_t)pcap\_not\_initialized;

p->setmintocopy\_op= (setmintocopy\_op\_t)pcap\_not\_initialized;

\#endif

/\*

\* Default cleanupoperation - implementations can override

\* this, but should callpcap\_cleanup\_live\_common() after

\* doing their ownadditional cleanup.

\*/

p->cleanup\_op= pcap\_cleanup\_live\_common;

/\*

\* In most cases, the standard one-shortcallback can

\* be used for pcap\_next()/pcap\_next\_ex().

\*/

p->oneshot\_callback= pcap\_oneshot;

pcap\_create\_common讲解完了，接着讲解pcap\_create函数中的另外一个回调函数，pcap\_activate\_linux，搜索这个函数，呵呵，在pcap-linux.c中找到了这个函数。Libpcap的作者这个架构，实在是令小生佩服。把linux要用到的函数都集成到了pcap-linux.c中，还把多个操作系统共用的函数就放到了pcap.c中，比如前面讲到的pcap\_create\_common函数。先不管这么多，抓住pcap\_activate\_linux再说。下面讲解pcap\_activate\_linux这个源码。从pcap\_activate\_linux的源码可以看到，通过pcap\_create\_common对pcap\_t \* p设定初始值，其实就像c++的初始化函数一样，比如c++的构造函数，MFC的OninitDialog函数一样。初始化就是初始化，对于不同的系统，就要进行不同的设置了，在linux函数中pcap\_activate\_linux中可以看到又对pcap\_create\_common中初始化的回调函数又重新进行了设置，看到这里我就佩服libpcap的作者了，把pcap\_create\_common函数放到了pcap.c文件中。

static int pcap\_activate\_linux(pcap\_t\*handle)

constchar       \*device;

int          status = 0;

device= handle->opt.source;                          //网卡的名字

handle->inject\_op= pcap\_inject\_linux;

handle->setfilter\_op= pcap\_setfilter\_linux;

handle->setdirection\_op= pcap\_setdirection\_linux;

handle->set\_datalink\_op= NULL; /\* can't change data link type \*/

handle->getnonblock\_op= pcap\_getnonblock\_fd;

handle->setnonblock\_op= pcap\_setnonblock\_fd;

handle->cleanup\_op= pcap\_cleanup\_linux;

handle->read\_op= pcap\_read\_linux;

handle->stats\_op= pcap\_stats\_linux;

/\*

\* The "any"device is a special device which causes us not

\* to bind to a particulardevice and thus to look at all

\* devices.

\*/

if(strcmp(device, "any") == 0) \{

if(handle->opt.promisc) \{

handle->opt.promisc= 0;

/\*Just a warning. \*/

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"Promiscuous mode not supported on the\\"any\\" device");

status= PCAP\_WARNING\_PROMISC\_NOTSUP;

handle->md.device = strdup(device);

if(handle->md.device == NULL) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE, "strdup: %s",

pcap\_strerror(errno) );

returnPCAP\_ERROR;

\#ifdef HAVE\_PF\_RING                     //是否定义pf\_ring

if(!getenv("PCAP\_NO\_PF\_RING"))\{

/\* Code courtesy ofChris Wakelin <c.d.wakelin@reading.ac.uk> \*/

char \*clusterId;

handle->ring =pfring\_open((char\*)device, handle->opt.promisc, handle->snapshot, 1);

/\*

\#ifdef HAVE\_PF\_RING       如果定义了PF\_RING，就执行这个里面的东东，从里面的函数可以看出，pf\_ring从新定义了socket函数，pfring\_open函数的作用如下：初始化PF\_RING socket，获得一个pfring类型的结构。函数原型如下：

pfring\* pfring\_open(char \*device\_name,u\_int8\_t promisc, u\_int32\_t caplen, u\_int8\_t reentrant);

函数功能：初始化PF\_RING socket，获得一个pfring类型结构。如果需要以DNA的方式打开一个设备，则必须调用pfring\_open\_dna()函数；

参数：

Device\_name: PF\_RING的符号链接命令(egeth0)；

Promisc: 设置是否为混合模式(1=混合模式)；

Caplen:最大的包捕获长度，(also known assnaplen和pcap\_open\_live函数的snaplen一样，通常设为65535就能捕获到网络上最大的数据包)；

Reentrant: 设为非0，则设备已reentrant的模式打开，它以信号量的机制执行，性能稍微会变差，主要用在多线程应用程序；

返回值：成功返回一个句柄，否则返回NULL

Pfring\_open的源码如下：

pfring\*pfring\_open(char \*device\_name, u\_int8\_t promisc,u\_int32\_t caplen, u\_int8\_t\_reentrant) \{

return(pfring\_open\_consumer(device\_name, promisc, caplen, \_reentrant,

0, NULL, 0));

Pfring\_open 其实是调用的pfring\_open\_consumer函数；该函数到后面我们在继续分析它；

\*/

if(handle->ring) \{

if(clusterId =getenv("PCAP\_PF\_RING\_CLUSTER\_ID"))

/\*

其中getenv为C语言中读取环境变量的当前值的函数

原形：char \*getenv(const char \*name)

用法：s=getenv("环境变量名");

需先定义char \*s;

功能：返回一给定的环境变量值，环境变量名可大写或小写。如果指定的变量在环境中未定义，则返回一空串。

\*/

if(atoi(clusterId) > 0 &&atoi(clusterId) < 255)

if(getenv("PCAP\_PF\_RING\_USE\_CLUSTER\_PER\_FLOW"))

pfring\_set\_cluster(handle->ring,atoi(clusterId), cluster\_per\_flow);

else

pfring\_set\_cluster(handle->ring, atoi(clusterId),cluster\_round\_robin);

pfring\_enable\_ring(handle->ring);

\} else

handle->ring = NULL;

\}else

handle->ring = NULL;

/\*

pfring\_set\_cluster的函数只用于设置cluster\_id，通过调用PF\_RING的setsockopt函数完成：

查找PF\_RING的文档，对这个函数有以下说明，在多cpu的情况下，pfring\_set\_cluster是非常有用的：

This call allows a ring to be added to acluster that can spawn across address spaces. On a nuthsell when two or moresockets are clustered they share incoming packets that are balanced on aper-flow manner.  This  technique is  useful  for exploiting multicore  systems  of for  sharing  packets in  the  same address space across multiple threads.

intpfring\_set\_cluster(pfring \*ring, u\_int clusterId, cluster\_type the\_type) \{

\#ifdef USE\_PCAP

return(-1);

\#else

if(ring->dna\_mapped\_device)

return(-1);

else \{

struct add\_to\_cluster cluster;

cluster.clusterId = clusterId,cluster.the\_type = the\_type;

return(ring ? setsockopt(ring->fd, 0,SO\_ADD\_TO\_CLUSTER,

&cluster, sizeof(cluster)): -1);

\#endif

其中setsockopt/getsockopt函数的作用是：

功能描述：

获取或者设置与某个套接字关联的选项。选项可能存在于多层协议中，它们总会出现在最上面的套接字层。当操作套接字选项时，选项位于的层和选项的名称必须给出。为了操作套接字层的选项，应该将层的值指定为SOL\_SOCKET。为了操作其它层的选项，控制选项的合适协议号必须给出。例如，为了表示一个选项由TCP协议解析，层应该设定为协议号TCP。用法如下：

\#include <sys/types.h>

\#include <sys/socket.h>

int getsockopt(int sock,int level, int optname, void \*optval, socklen\_t \*optlen);

int setsockopt(int sock,int level, int optname, const void \*optval, socklen\_t optlen);

参数说明：

sock：将要被设置或者获取选项的套接字。

level：选项所在的协议层。

optname：需要访问的选项名。//SO\_ADD\_TO\_CLUSTER

optval：对于getsockopt()，指向返回选项值的缓冲。对于setsockopt()，指向包含新选项值的缓冲。

optlen：对于getsockopt()，作为入口参数时，选项值的最大长度。作为出口参数时，选项值的实际长度。对于setsockopt()，现选项的长度。

如果定义了PF\_RING就是调用pfring\_open建立sock，这一部分内容讲解告一段落了。

\*/

if(handle->ring!= NULL) \{

handle->fd = handle->ring->fd;

handle->bufsize = handle->snapshot;

handle->linktype = DLT\_EN10MB;

handle->offset = 2;

/\* printf("OpenHAVE\_PF\_RING(%s)\\n", device); \*/

\}else \{

/\* printf("Open HAVE\_PF\_RING(%s) failed.Fallback to pcap\\n", device); \*/

\#endif

/\*

\* If we're inpromiscuous mode, then we probably want

\* to see when theinterface drops packets too, so get an

\* initial count from/proc/net/dev

\*/

if(handle->opt.promisc)

handle->md.proc\_dropped= linux\_if\_drops(handle->md.device);

/\*

\* Current Linux kernelsuse the protocol family PF\_PACKET to

\* allow direct accessto all packets on the network while

\* older kernels had aspecial socket type SOCK\_PACKET to

\* implement thisfeature.

\* While this oldimplementation is kind of obsolete we need

\* to be compatible witholder kernels for a while so we are

\* trying both methodswith the newer method preferred.

\*/

// 目前的内核是采用PF\_PACKET，而老的内核通过采用SOCK\_PACKET

if((status = activate\_new(handle)) == 1) \{

/\*

\* Try to open a packet socket using the newkernel PF\_PACKET interface.

\* Returns 1 on success, 0 on an error thatmeans the new interface isn't

\* present (so the old SOCK\_PACKET interfaceshould be tried), and a

\* PCAP\_ERROR\_ value on an error that meansthat the old mechanism won't

\* work either (so it shouldn't be tried). Activate\_new函数的作用在没有定义PF\_RING的情况下通过PF\_PACKET接口建立socket，返回1表示成功，可以采用PF\_PACKET建立socket，返回0表示失败，这时可以尝试采用SOCKET\_PACKET接口建立socket，该函数也在pcap-linux.c中可以找到源码；根据status的返回值，确定3种不同的情况，返回1成功，表示采用的是PF\_PACKET建立socket，而返回0的时候，又调用activate\_old函数进行判断，如果activate\_old函数返回1表示调用的是SOCK\_PACKET建立socket，而activate\_old返回0表示失败；第3种情况是status不等于上面的2个值，则表示失败。

\*/

/\*

\* Success.

\* Try to use memory-mapped access.

\*/

switch(activate\_mmap(handle)) \{

case1:

/\*we succeeded; nothing more to do \*/

return0;

case0:

/\*

\* Kernel doesn't support it - just continue

\* with non-memory-mapped access.

\*/

status= 0;

break;

case-1:

/\*

\* We failed to set up to use it, or kernel

\* supports it, but we failed to enable it;

\* return an error.  handle->errbuf contains

\* an error message.

\*/

status= PCAP\_ERROR;

gotofail;

elseif (status == 0) \{

/\*Non-fatal error; try old way \*/

if((status = activate\_old(handle)) != 1) \{

/\*

\* Bothmethods to open the packet socket failed.

\* Tidy upand report our failure (handle->errbuf

\* isexpected to be set by the functions above).

\*/

gotofail;

\}else \{

/\*

\* Fatal errorwith the new way; just fail.

\* status has theerror return; if it's PCAP\_ERROR,

\*handle->errbuf has been set appropriately.

\*/

gotofail;

/\*

\* We set up the socket,but not with memory-mapped access.

\*/

if(handle->opt.buffer\_size != 0) \{

/\*

如果opt.buffer\_size!=0以我的理解就是应用程序调用了pcap\_set\_buffer\_size设置了内核缓冲区的大小，而不是采用默认的内核缓冲区，因此首先通过setsockopt发送设置命令，然后调用malloc分配内存。

\* Set the socket buffersize to the specified value.

\*/

if(setsockopt(handle->fd, SOL\_SOCKET,SO\_RCVBUF,

&handle->opt.buffer\_size,

sizeof(handle->opt.buffer\_size)) == -1)\{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"SO\_RCVBUF: %s",pcap\_strerror(errno));

status= PCAP\_ERROR;

gotofail;

\#ifdef HAVE\_PF\_RING

\#endif

/\*Allocate the buffer \*/

handle->buffer       = malloc(handle->bufsize +handle->offset);

if(!handle->buffer) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"malloc: %s", pcap\_strerror(errno));

status= PCAP\_ERROR;

gotofail;

/\*

\*"handle->fd" is a socket, so "select()" and"poll()"

\* should work on it.

\*/

handle->selectable\_fd= handle->fd;

returnstatus;

fail:

pcap\_cleanup\_linux(handle);

returnstatus;

pcap\_activate\_linux函数分析完了，按我的理解应该是用PF\_RING代替PF\_PACKET或SOCK\_PACKET。但是我从pcap\_activate\_linux函数，简单的分析下，发现首先采用的pfring\_open建立sock，以我的理解，当定义了pf\_ring时，采用pfring\_open建立socket后应该马上退出函数，不去判断后面的内容了，比如又去判断activate\_new和activate\_old函数，没有搞明白，也不理解作者的意图。所以我再次的对pfring\_open的源码进行分析，继续跟踪代码：首先跟踪的是pfring\_open函数，然后跟踪activate\_new函数，有必要看看这个里面是怎么实现的。前面说过pfring\_open是调用pfring\_open\_consumer函数的，为了分析他们的源码，跟踪到pfring.c文件中，pfring\_open\_consumer函数的源码如下：

pfring\* pfring\_open\_consumer(char \*device\_name, u\_int8\_tpromisc,

u\_int32\_t caplen, u\_int8\_t \_reentrant,

u\_int8\_tconsumer\_plugin\_id,

char\* consumer\_data, u\_intconsumer\_data\_len) \{

\#ifdefUSE\_PCAP

char ebuf\[256\];

pcap\_t \*pcapPtr = pcap\_open\_live(device\_name,

caplen,

1 /\* promiscuous mode \*/,

1000 /\* ms \*/,

ebuf);

return((pfring\*)pcapPtr);

\#else

int err = 0;

pfring \*ring =(pfring\*)malloc(sizeof(pfring));             //申请pfring结构体大小的内存

if(ring == NULL)

return(NULL);

else

memset(ring, 0, sizeof(pfring));                                    //将缓冲区清0

ring->reentrant = \_reentrant;

ring->fd = socket(PF\_RING, SOCK\_RAW,htons(ETH\_P\_ALL));  //建立socket

\#ifdef RING\_DEBUG

printf("OpenRING \[fd=%d\]\\n", ring->fd);

\#endif

if(ring->fd > 0) \{

int rc;

u\_int memSlotsLen;

if(caplen > MAX\_CAPLEN) caplen = MAX\_CAPLEN;

//在pfring.h中定义 MAX\_CAPLEN，\#define MAX\_CAPLEN       16384

setsockopt(ring->fd, 0, SO\_RING\_BUCKET\_LEN, &caplen, sizeof(caplen));

//设置caplen，caplen为捕获包的大小在pfring.h中定义它的最大大小为16384

/\* printf("channel\_id=%d\\n",channel\_id); \*/

if(device\_name == NULL /\* any \*/) \{

device\_name = "any";

rc = pfring\_bind(ring, device\_name);                    //绑定ring

\} else if(!strcmp(device\_name,"none")) \{

/\* No binding yet \*/

rc = 0;

\} else

rc = pfring\_bind(ring, device\_name);

if(rc == 0) \{

if(consumer\_plugin\_id > 0) \{

ring->kernel\_packet\_consumer =consumer\_plugin\_id;

rc = pfring\_set\_packet\_consumer\_mode(ring,consumer\_plugin\_id,

consumer\_data, consumer\_data\_len);

if(rc < 0) \{

free(ring);

return(NULL);

\} else

ring->kernel\_packet\_consumer = 0;

ring->buffer = (char \*)mmap(NULL,PAGE\_SIZE, PROT\_READ|PROT\_WRITE,

MAP\_SHARED, ring->fd, 0);

//mmap 内存映射其中PAGE\_SIZE=4096

/\*

内存映射mmap函数原型如下：函数：void \*mmap(void\*start,size\_t length,int prot,int flags,int fd,off\_t offsize);

参数start：指向欲映射的内存起始地址，通常设为 NULL，代表让系统自动选定地址，映射成功后返回该地址。

参数length：代表将文件中多大的部分映射到内存。

参数prot：映射区域的保护方式。可以为以下几种方式的组合：  
PROT\_EXEC 映射区域可被执行，PROT\_READ映射区域可被读取，PROT\_WRITE映射区域可被写入  
PROT\_NONE 映射区域不能存取；

参数flags：影响映射区域的各种特性。在调用mmap()时必须要指定MAP\_SHARED或MAP\_PRIVATE。  
MAP\_FIXED 如果参数start所指的地址无法成功建立映射时，则放弃映射，不对地址做修正。通常不鼓励用此旗标。  
MAP\_SHARED对映射区域的写入数据会复制回文件内，而且允许其他映射该文件的进程共享。  
MAP\_PRIVATE 对映射区域的写入操作会产生一个映射文件的复制，即私人的“写入时复制”（copy on write）对此区域作的任何修改都不会写回原来的文件内容。  
MAP\_ANONYMOUS建立匿名映射。此时会忽略参数fd，不涉及文件，而且映射区域无法和其他进程共享。  
MAP\_DENYWRITE只允许对映射区域的写入操作，其他对文件直接写入的操作将会被拒绝。  
MAP\_LOCKED 将映射区域锁定住，这表示该区域不会被置换(swap)。

参数fd：要映射到内存中的文件描述符(ring->fd为socket函数的返回值)。如果使用匿名内存映射时，即flags中设置了MAP\_ANONYMOUS，fd设为\-1。有些系统不支持匿名内存映射，则可以使用fopen打开/dev/zero文件，然后对该文件进行映射，可以同样达到匿名内存映射的效果。

参数offset：文件映射的偏移量，通常设置为0，代表从文件最前方开始对应，offset必须是分页大小的整数倍。

返回值：

若映射成功则返回映射区的内存起始地址，否则返回MAP\_FAILED(－1)，错误原因存于errno中。

\*/

if(ring->buffer == MAP\_FAILED) \{

printf("mmap()failed: try with a smaller snaplen\\n");

free(ring);

return(NULL);

ring->slots\_info = (FlowSlotInfo \*)ring->buffer;

//其中ring->buffer为mmap内存映射的缓冲区，ring->slot\_info指向ring->buffer的开始位置；

if(ring->slots\_info->version != RING\_FLOWSLOT\_VERSION) \{

printf("WrongRING version: "

"kernel is %i, libpfring wascompiled with %i\\n",

ring->slots\_info->version,RING\_FLOWSLOT\_VERSION);

free(ring);

return(NULL);

memSlotsLen = ring->slots\_info->tot\_mem;          //

munmap(ring->buffer,PAGE\_SIZE);                          //删除映射

ring->buffer = (char\*)mmap(NULL, memSlotsLen,

PROT\_READ|PROT\_WRITE,

MAP\_SHARED, ring->fd, 0);

/\*

感觉前面的mmap就是为了得到memSlotsLen，然后就用munmap删除映射了，接着使用mmap重新内存映射。

\*/

if(ring->buffer == MAP\_FAILED) \{

printf("mmap() failed");

free(ring);

return(NULL);

ring->slots\_info   = (FlowSlotInfo \*)ring->buffer;             //得到环状缓冲区指针

ring->slots = (char\*)(ring->buffer+sizeof(FlowSlotInfo));

//跳过环状缓冲区前面的机构体的大小，后面就是用来接收数据了。

/\* Set defaults \*/

ring->device\_name = strdup(device\_name? device\_name : "");

\#ifdefRING\_DEBUG

printf("RING (%s):tot\_mem=%u/min\_tot\_slots=%u/max\_slot\_len=%u/"

"insert\_off=%u/remove\_off=%u/dropped=%llu\\n",

device\_name,

ring->slots\_info->tot\_mem,

ring->slots\_info->tot\_slots,

ring->slots\_info->slot\_len,

ring->slots\_info->insert\_off,

ring->slots\_info->remove\_off,

ring->slots\_info->tot\_lost);

\#endif

if(promisc) \{

if(set\_if\_promisc(device\_name, 1) == 0)

ring->clear\_promisc = 1;

\#ifdef ENABLE\_HW\_TIMESTAMP

pfring\_enable\_hw\_timestamp(ring,device\_name);

\#endif

\} else \{

close(ring->fd);

err = -1;

\} else \{

err = -1;

free(ring);

if(err == 0) \{

if(ring->reentrant)

pthread\_spin\_init(&ring->spinlock,PTHREAD\_PROCESS\_PRIVATE);

return(ring);

\} else

return(NULL);

\#endif

//pfring\_bind函数的作用是调用bind绑定socket； rc = bind(ring->fd,(struct sockaddr \*)&sa, sizeof(sa));

int pfring\_bind(pfring \*ring, char \*device\_name) \{

struct sockaddr sa;                                               //定义一个socket地址变量

char \*at;

int32\_t channel\_id = -1;

int rc = 0;

if((device\_name == NULL) ||(strcmp(device\_name, "none") == 0))

return(-1);

at = strchr(device\_name, '@');

if(at != NULL) \{

char \*tok, \*pos = NULL;

at\[0\] = '\\0';

/\* Syntax

ethX@1,5       channel 1 and 5

ethX@1-5       channel 1,2...5

ethX@1-3,5-7   channel 1,2,3,5,6,7

\*/

tok = strtok\_r(&at\[1\], ",",&pos);

channel\_id = 0;

while(tok != NULL) \{

char \*dash = strchr(tok, '-');

int32\_t min\_val, max\_val, i;

if(dash) \{

dash\[0\] = '\\0';

min\_val = atoi(tok);

max\_val = atoi(&dash\[1\]);

\} else

min\_val = max\_val = atoi(tok);

for(i = min\_val; i <= max\_val; i++)

channel\_id |= 1 << i;

tok = strtok\_r(NULL, ",",&pos);

/\* Setup TX \*/

ring->sock\_tx.sll\_family = PF\_PACKET;

ring->sock\_tx.sll\_protocol =htons(ETH\_P\_ALL);

sa.sa\_family = PF\_RING;

snprintf(sa.sa\_data, sizeof(sa.sa\_data),"%s", device\_name);

rc = bind(ring->fd, (struct sockaddr\*)&sa, sizeof(sa));

/\*

Bind函数：

<table> 
 <tbody> 
 <tr> 
 <td> 头文件 </td> 
 <td colspan="2"> #include &lt;sys/types.h&gt;&nbsp; #include &lt;sys/socket.h&gt; </td> 
 </tr> 
 <tr> 
 <td> 函数原型 </td> 
 <td colspan="2"> int bind(int sockfd, const struct sockaddr *my_addr, socklen_t addrlen); </td> 
 </tr> 
 <tr> 
 <td> 返回值 </td> 
 <td> 成功 </td> 
 <td> 失败 </td> 
 </tr> 
 <tr> 
 <td> 0 </td> 
 <td> 1 </td> 
 </tr> 
 </tbody> 
</table>

\*/

if(rc == 0) \{

if(channel\_id != -1) \{

int rc = pfring\_set\_channel\_id(ring,channel\_id);

if(rc != 0)

printf("pfring\_set\_channel\_id()failed: %d\\n", rc);

return(rc);

在这里又将pfring\_open\_consumer源码分析完了，确实跟我理解的一样。就是通过内存映射建立一个ring缓冲区，然后调用pfring\_bind对socket进行绑定。再前面我们说了以我的个人理解，PF\_RING的补丁，就是要采用新的socket代替原来的PF\_PACKET和SOCK\_PACKET，但是我开始分析源码时，发现既然建立了PF\_RING，为什么pcap\_activate\_linux不直接返回呢，诧异，诧异。再次返回pcap\_activate\_linux函数看看，有什么没有看懂的吗？首先分析下pcap\_activate\_linux带的参数pcap\_t \*handle，这个[数据结构][Link 3]吧，大家知道[算法][Link 3]\+数据结构=程序，可见数据结构的重要性。在pcap-int.h中找到了定义ring的地方，如下：

\#ifdefHAVE\_PF\_RING

pfring \*ring;

\#endif

下面要看看，既然采用了pfring\_open建立和绑定了socket，后面的activate\_new函数的作用是什么呢？跟踪一下activate\_new函数吧，

static int activate\_new(pcap\_t\*handle)

\#ifdef HAVE\_PF\_PACKET\_SOCKETS

// HAVE\_PF\_PACKET\_SOCKETS首先判断是不是PF\_PACKETsocket类型，是的就执行这个里面的操作，不是的话，相当于直接返回0，就可以去调用activate\_old去判断是不是SOCK\_PACKET类型了。

const char              \*device = handle->opt.source;

int                 is\_any\_device= (strcmp(device, "any") == 0);

int                 sock\_fd= -1, arptype;

\#ifdef HAVE\_PACKET\_AUXDATA

int                 val;

\#endif

int                 err= 0;

struct packet\_mreq mr;

/\*

\* Open a socket with protocol family packet.If the

\* "any" device was specified, weopen a SOCK\_DGRAM

\* socket for the cooked interface, otherwisewe first

\* try a SOCK\_RAW socket for the raw interface.

\*/

sock\_fd = is\_any\_device ?

socket(PF\_PACKET, SOCK\_DGRAM,htons(ETH\_P\_ALL)) :

socket(PF\_PACKET, SOCK\_RAW,htons(ETH\_P\_ALL));

//socket函数的作用是建立socket，下面是不是会出现绑定的函数呢，仔细看看

if (sock\_fd == -1) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE, "socket: %s",

pcap\_strerror(errno) );

return 0;  /\* try old mechanism \*/

/\* It seems the kernel supports the newinterface. \*/

handle->md.sock\_packet = 0;

/\*

\* Get the interface index of the loopbackdevice.

\* If the attempt fails, don't fail, just setthe

\* "md.lo\_ifindex" to -1.

\* XXX - can there be more than one device thatloops

\* packets back, i.e. devices other than"lo"?  If so,

\* we'd need to find them all, and have anarray of

\* indices for them, and check all of them in

\* "pcap\_read\_packet()".

\*/

handle->md.lo\_ifindex =iface\_get\_id(sock\_fd, "lo", handle->errbuf);

/\*

\* Default value for offset to align link-layerpayload

\* on a 4-byte boundary.

\*/

handle->offset = 0;

/\*

\* What kind of frames do we have to deal with?Fall back

\* to cooked mode if we have an unknowninterface type

\* or a type we know doesn't work well in rawmode.

\*/

if (!is\_any\_device) \{

/\* Assume for now we don't needcooked mode. \*/

handle->md.cooked = 0;

if (handle->opt.rfmon) \{

/\*

\* We were asked to turn on monitor mode.

\* Do so before we get the link-layer type,

\* because entering monitor mode could change

\* the link-layer type.

\*/

err =enter\_rfmon\_mode(handle, sock\_fd, device);

if (err < 0) \{

/\* Hard failure \*/

close(sock\_fd);

return err;

if (err == 0) \{

/\*

\* Nothing worked for turning monitor mode

\* on.

\*/

close(sock\_fd);

returnPCAP\_ERROR\_RFMON\_NOTSUP;

/\*

\* Either monitor mode has been turned on for

\* the device, or we've been given a different

\* device to open for monitor mode.  If we've

\* been given a different device, use it.

\*/

if (handle->md.mondevice!= NULL)

device =handle->md.mondevice;

arptype    = iface\_get\_arptype(sock\_fd, device, handle->errbuf);

if (arptype < 0) \{

close(sock\_fd);

return arptype;

map\_arphrd\_to\_dlt(handle, arptype,1);

if (handle->linktype == -1 ||

handle->linktype == DLT\_LINUX\_SLL ||

handle->linktype == DLT\_LINUX\_IRDA ||

handle->linktype == DLT\_LINUX\_LAPD ||

(handle->linktype == DLT\_EN10MB &&

(strncmp("isdn", device, 4) == 0||

strncmp("isdY", device, 4) ==0))) \{

if (close(sock\_fd) == -1) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"close: %s", pcap\_strerror(errno));

return PCAP\_ERROR;

sock\_fd = socket(PF\_PACKET,SOCK\_DGRAM,

htons(ETH\_P\_ALL));

if (sock\_fd == -1) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"socket: %s",pcap\_strerror(errno));

return PCAP\_ERROR;

handle->md.cooked = 1;

/\*

\* Get rid of any link-layer type list

\* we allocated - this only supports cooked

\* capture.

\*/

if (handle->dlt\_list !=NULL) \{

free(handle->dlt\_list);

handle->dlt\_list= NULL;

handle->dlt\_count= 0;

if (handle->linktype ==-1) \{

/\*

\* Warn that we're falling back on

\* cooked mode; we may want to

\* update "map\_arphrd\_to\_dlt()"

\* to handle the new type.

\*/

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"arptype%d not "

"supportedby libpcap - "

"fallingback to cooked "

"socket",

arptype);

/\*

\* IrDA capture is not a real"cooked" capture,

\* it's IrLAP frames, not IP packets.  The

\* same applies to LAPD capture.

\*/

if (handle->linktype !=DLT\_LINUX\_IRDA &&

handle->linktype != DLT\_LINUX\_LAPD)

handle->linktype= DLT\_LINUX\_SLL;

handle->md.ifindex =iface\_get\_id(sock\_fd, device,

handle->errbuf);

if (handle->md.ifindex == -1) \{

close(sock\_fd);

return PCAP\_ERROR;

// 在上面我们分析盼望已久的绑定函数终于出现了iface\_bind函数就是绑定函数，这个函数我猜里面也是调用的bind函数吧，带着这个预期，我去跟踪下iface\_bind的代码，再来给答案，看了iface\_bind代码，果然和我预测的结果一样，是调用的bind函数进行绑定。

if ((err =iface\_bind(sock\_fd, handle->md.ifindex,

handle->errbuf)) != 1) \{

close(sock\_fd);

if (err < 0)

return err;

else

return 0;  /\* try old mechanism \*/

\} else \{

/\*

\* The "any" device.

\*/

if (handle->opt.rfmon) \{

/\*

\* It doesn't support monitor mode.

\*/

returnPCAP\_ERROR\_RFMON\_NOTSUP;

/\*

\* It uses cooked mode.

\*/

handle->md.cooked = 1;

handle->linktype =DLT\_LINUX\_SLL;

/\*

\* We're not bound to a device.

\* For now, we're using this as an indication

\* that we can't transmit; stop doing that only

\* if we figure out how to transmit in cooked

\* mode.

\*/

handle->md.ifindex = -1;

if (!is\_any\_device &&handle->opt.promisc) \{

memset(&mr, 0, sizeof(mr));

mr.mr\_ifindex =handle->md.ifindex;

mr.mr\_type    = PACKET\_MR\_PROMISC;

if (setsockopt(sock\_fd,SOL\_PACKET, PACKET\_ADD\_MEMBERSHIP,

&mr, sizeof(mr)) == -1) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"setsockopt:%s", pcap\_strerror(errno));

close(sock\_fd);

return PCAP\_ERROR;

/\* Enableauxillary data if supported and reserve room for

\* reconstructing VLAN headers. \*/

\#ifdef HAVE\_PACKET\_AUXDATA

val = 1;

if (setsockopt(sock\_fd, SOL\_PACKET,PACKET\_AUXDATA, &val,

sizeof(val)) == -1 && errno !=ENOPROTOOPT) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"setsockopt: %s", pcap\_strerror(errno));

close(sock\_fd);

return PCAP\_ERROR;

handle->offset += VLAN\_TAG\_LEN;

\#endif /\* HAVE\_PACKET\_AUXDATA \*/

if (handle->md.cooked) \{

if (handle->snapshot <SLL\_HDR\_LEN + 1)

handle->snapshot =SLL\_HDR\_LEN + 1;

handle->bufsize = handle->snapshot;

/\* Save the socket FD in the pcapstructure \*/

handle->fd = sock\_fd;

return 1;

\#else

//如果不是PF\_PACKET类型，就直接返回0了，呵呵

strncpy(ebuf,

"New packet capturinginterface not supported by build "

"environment",PCAP\_ERRBUF\_SIZE);

return 0;

\#endif

从activate\_new函数的源码中也没有解决我要解决的那个问题，如果是PF\_RING，就应该不去判断后面两种socket类型了，我又回到了pcap\_activate\_linux函数的源码，仔细看了看，这一次真的看出来了，就是一个handle->ring != NULL开始没有注意到，害我分析好久的其它代码不过也学到一些东西，

if(handle->ring != NULL) \{

handle->fd = handle->ring->fd;

handle->bufsize = handle->snapshot;

handle->linktype = DLT\_EN10MB;

handle->offset = 2;

/\* printf("OpenHAVE\_PF\_RING(%s)\\n", device); \*/

\}else \{

/\* printf("Open HAVE\_PF\_RING(%s) failed.Fallback to pcap\\n", device); \*/

。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

｝

当handle->ring！=NULL的时候，就会跳过activate\_new等代码的，也就是说执行了PF\_RING成功后，就不会去判断后面2种socket类型了，和我预测的一样。呵呵，终于明白pcap\_activate\_linux这个函数的功能了。

2011-4-18补充。并不是所有的情况pfring\_open都会返回成功的，对应pcap\_activate\_linux里面当pfring\_open调用后，比如我在实验时，将PF\_RING补丁打入内核就出现错误"WrongRING version: " "kernel is 10, libpfring was compiled with 13" ，但是提示这个错误后，程序还能正确的跑，我后面再ring.h中看到内核pf\_ring的版本定义为：

\#defineRING\_FLOWSLOT\_VERSION          10

同时在pf\_ring.h中发现：

\#defineRING\_FLOWSLOT\_VERSION          13

在pfring\_open的源码pfring\_open\_consumer中发现如果版本不一致，就会提示错误，pfring\_open\_consumer直接返回，这样pfring\_open的返回值为NULL，但是为什么程序还能继续运行呢，这就是因为执行到了handle->ring!=NULL时的else部分，随后就会调用原始的libpcap收包函数获取数据包了，也就是说采用PF\_PACKET的方式读取数据包，所以还是能够正常运行的。

同时在没有加载insmodpf\_ring.ko时候，pfring\_open也会返回为NULL，此时，程序也会调用libpcap原来的PF\_PACKET进行收包的。

另外另一问题，当采用PF\_RING读取数据包时，cpu占用率从原来的37%上升到47%，原来240Mbit/s的速度发包，大约2分钟丢3个包，采用PF\_RING后可以提高到3分钟丢2个包，包长为1514个字节。

pcap\_activate\_linux定义的这些回调函数也是值得注意的。这里把他们都列出来。

device = handle->opt.source;

handle->inject\_op = pcap\_inject\_linux;

handle->setfilter\_op = pcap\_setfilter\_linux;

handle->setdirection\_op = pcap\_setdirection\_linux;

handle->set\_datalink\_op = NULL; /\* can't change data link type \*/

handle->getnonblock\_op = pcap\_getnonblock\_fd;

handle->setnonblock\_op = pcap\_setnonblock\_fd;

handle->cleanup\_op = pcap\_cleanup\_linux;

handle->read\_op = pcap\_read\_linux;

handle->stats\_op = pcap\_stats\_linux;

其它的回调函数我就不多说了，这里重点要讲解的是pcap\_read\_linux函数，函数源码如下：

/\*

\*  Readat most max\_packets from the capture stream and call the callback

\*  foreach of them. Returns the number of packets handled or -1 if an

\*  erroroccured.

\*/

static int

pcap\_read\_linux(pcap\_t \*handle, intmax\_packets, pcap\_handler callback, u\_char \*user)

/\*

\* Currently, on Linuxonly one packet is delivered per read,

\* so we don't loop.

\*/

returnpcap\_read\_packet(handle, callback, user);

函数体就相当简答了，晕，只有一句，就是调用pcap\_read\_packet函数读取数据包。

pcap\_read\_packet函数；这个函数可长了，一步一步看吧，既然开始分析了，就一定要把这些源码吃透，这里才能理解libpcap为什么丢包，而加上pf-ring补丁后的libpcap就不丢包了呢。不多说了，看源码吧。还有这个回调函数什么时候调用的呢，我现在猜想应该是应用程序调用pcap\_next, pcap\_next\_ex, pcap\_dispatch, pcap\_loop这几个函数时读包时调用的吧，现在只是猜想，还没有分析这部分读包的源码，呵呵，好了，还是来看pcap\_read\_packet函数吧。

/\*

\*  Read a packet from the socket calling thehandler provided by

\*  the user. Returns the number of packetsreceived or -1 if an

\*  error occured.

\*/

staticint

pcap\_read\_packet(pcap\_t\*handle, pcap\_handler callback, u\_char \*userdata)

u\_char                   \*bp;

int                 offset;

\#ifdef HAVE\_PF\_PACKET\_SOCKETS

struct sockaddr\_ll   from;

struct sll\_header     \*hdrp;

\#else

struct sockaddr              from;

\#endif

\#if defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI)

struct iovec            iov;

struct msghdr         msg;

struct cmsghdr              \*cmsg;

union \{

structcmsghdr       cmsg;

char        buf\[CMSG\_SPACE(sizeof(structtpacket\_auxdata))\];

\} cmsg\_buf;

\#else /\* defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

socklen\_t        fromlen;

\#endif/\* defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

int                 packet\_len,caplen;

\#ifdef HAVE\_PF\_RING

structpfring\_pkthdr    pcap\_header;

\#else

struct pcap\_pkthdr  pcap\_header;

\#endif

// 这里必须讲解下，当定义了HAVE\_PF\_RING时候，pcap\_header指向的是pfring\_pkthdr结构体，去看看它和pcap\_pkthdr结构体有什么不同。Pfring\_pkthdr结构体的定义如下：

/\*

struct pfring\_pkthdr \{

/\* pcap header \*/

struct timeval ts;    /\* timestamp \*/

u\_int32\_t caplen;     /\* length ofportion present \*/

u\_int32\_t len;        /\* lengththis packet (off wire) \*/

struct pfring\_extended\_pkthdr extended\_hdr; /\* PF\_RING extended header\*/

\};

\*/

/\*

而pcap\_pkthdr的结构体定义如下：

struct pcap\_pkthdr \{

struct timeval ts;     /\* time stamp \*/

bpf\_u\_int32 caplen;       /\* length of portion present \*/

bpf\_u\_int32 len;     /\* length this packet (off wire) \*/

\};

\*/

//对比发现它们两个相比，pfring\_pkthdr多了一个PF\_RING的扩展头。

\#ifdefHAVE\_PF\_RING

if(handle->ring) \{

do \{

if (handle->break\_loop) \{

/\*

\* Yes - clear the flag that indicates that it

\* has, and return -2 as an indication that we

\* were told to break out of the loop.

\* Patch courtesy of Michael Stiller <ms@2scale[.NET][]>

\*/

handle->break\_loop = 0;

return -2;

packet\_len = pfring\_recv(handle->ring, (char\*)handle->buffer,

handle->bufsize,

&pcap\_header,

1 /\* wait\_for\_incoming\_packet \*/);

/\*如果定义了PF\_RING，就采用pfring\_recv接收数据包，这个函数后面在进行讲解，如果没有定义PF\_RING的话，采用recvmsg或recvfrom来接收数据包了，这两个函数有什么区别呢，大家google一下吧，不讲了。

\*/

if (packet\_len > 0) \{

bp = handle->buffer;

pcap\_header.caplen = min(pcap\_header.caplen, handle->bufsize);

caplen = pcap\_header.caplen, packet\_len = pcap\_header.len;

goto pfring\_pcap\_read\_packet;

\}while (packet\_len == -1 && (errno == EINTR || errno == ENETDOWN));

\#endif

\#ifdefHAVE\_PF\_PACKET\_SOCKETS

/\*

\*If this is a cooked device, leave extra room for a

\*fake packet header.

\*/

if (handle->md.cooked)

offset = SLL\_HDR\_LEN;

else

offset = 0;

\#else

/\*

\*This system doesn't have PF\_PACKET sockets, so it doesn't

\*support cooked devices.

\*/

offset = 0;

\#endif

/\*

\* Receive a single packet from the kernel.

\* We ignore EINTR, as that might just be dueto a signal

\* being delivered - if the signal shouldinterrupt the

\* loop, the signal handler should callpcap\_breakloop()

\* to set handle->break\_loop (we ignore iton other

\* platforms as well).

\* We also ignore ENETDOWN, so that we cancontinue to

\* capture traffic if the interface goes downand comes

\* back up again; comments in the kernelindicate that

\* we'll just block waiting for packets if wetry to

\* receive from a socket that deliveredENETDOWN, and,

\* if we're using a memory-mapped buffer, wewon't even

\* get notified of "network down"events.

\*/

bp = handle->buffer +handle->offset;

\#ifdefined(HAVE\_PACKET\_AUXDATA) && defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI)

msg.msg\_name             = &from;

msg.msg\_namelen         = sizeof(from);

msg.msg\_iov         = &iov;

msg.msg\_iovlen            = 1;

msg.msg\_control           = &cmsg\_buf;

msg.msg\_controllen       = sizeof(cmsg\_buf);

msg.msg\_flags              = 0;

iov.iov\_len            = handle->bufsize - offset;

iov.iov\_base           = bp + offset;

\#endif /\*defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

do \{

/\*

\* Has "pcap\_breakloop()" beencalled?

\*/

if (handle->break\_loop) \{

/\*

\* Yes - clear the flag that indicates that ithas,

\* and return PCAP\_ERROR\_BREAK as an indicationthat

\* we were told to break out of the loop.

\*/

handle->break\_loop = 0;

return PCAP\_ERROR\_BREAK;

\#ifdefined(HAVE\_PACKET\_AUXDATA) && defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI)

packet\_len = recvmsg(handle->fd, &msg, MSG\_TRUNC);

\#else /\*defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

fromlen = sizeof(from);

packet\_len = recvfrom(

handle->fd, bp + offset,

handle->bufsize -offset, MSG\_TRUNC,

(struct sockaddr \*)&from, &fromlen);

\#endif /\* defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

\} while (packet\_len == -1 &&errno == EINTR);

/\* Check if an error occured \*/

if (packet\_len == -1) \{

switch (errno) \{

case EAGAIN:

return 0;  /\* no packet there \*/

case ENETDOWN:

/\*

\* The device on which we're capturing wentaway.

\* XXX - we should really return

\* PCAP\_ERROR\_IFACE\_NOT\_UP, but pcap\_dispatch()

\* etc. aren't defined to return that.

\*/

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"The interfacewent down");

return PCAP\_ERROR;

default:

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"recvfrom: %s",pcap\_strerror(errno));

return PCAP\_ERROR;

\#ifdefHAVE\_PF\_PACKET\_SOCKETS

if (!handle->md.sock\_packet) \{

/\*

\* Unfortunately, there is a window betweensocket() and

\* bind() where the kernel may queue packetsfrom any

\* interface. If we're bound to a particular interface,

\* discard packets notfrom that interface.

\* (If socket filters are supported, we coulddo the

\* same thing we do when changing the filter;however,

\* that won't handle packet sockets withoutsocket

\* filter support, and it's a bit more complicated.

\* It would save some instructions per packet,however.)

\*/

if (handle->md.ifindex != -1&&

from.sll\_ifindex != handle->md.ifindex)

return 0;

/\*

\* Do checks based on packet direction.

\* We can only do this if we're usingPF\_PACKET; the

\* address returned for SOCK\_PACKET is a"sockaddr\_pkt"

\* which lacks the relevant packet typeinformation.

\*/

if (from.sll\_pkttype ==PACKET\_OUTGOING) \{

/\*

\* Outgoing packet.

\* If this is from the loopback device, rejectit;

\* we'll see the packet as an incoming packetas well,

\* and we don't want to see it twice.

\*/

if (from.sll\_ifindex ==handle->md.lo\_ifindex)

return 0;

/\*

\* If the user only wants incoming packets,reject it.

\*/

if (handle->direction ==PCAP\_D\_IN)

return 0;

\} else \{

/\*

\* Incoming packet.

\* If the user only wants outgoing packets,reject it.

\*/

if (handle->direction ==PCAP\_D\_OUT)

return 0;

\#endif

\#ifdefHAVE\_PF\_PACKET\_SOCKETS

/\*

\* If this is a cooked device, fill in the fakepacket header.

\*/

if (handle->md.cooked) \{

/\*

\* Add the length of the fake header to thelength

\* of packet data we read.

\*/

packet\_len += SLL\_HDR\_LEN;

hdrp = (struct sll\_header \*)bp;

hdrp->sll\_pkttype =map\_packet\_type\_to\_sll\_type(from.sll\_pkttype);

hdrp->sll\_hatype =htons(from.sll\_hatype);

hdrp->sll\_halen =htons(from.sll\_halen);

memcpy(hdrp->sll\_addr,from.sll\_addr,

(from.sll\_halen > SLL\_ADDRLEN) ?

SLL\_ADDRLEN :

from.sll\_halen);

hdrp->sll\_protocol= from.sll\_protocol;

\#ifdefHAVE\_PF\_RING

pfring\_pcap\_read\_packet:

\#endif

\#ifdefined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI)

for (cmsg = CMSG\_FIRSTHDR(&msg);cmsg; cmsg = CMSG\_NXTHDR(&msg, cmsg)) \{

struct tpacket\_auxdata \*aux;

unsigned int len;

struct vlan\_tag \*tag;

if (cmsg->cmsg\_len <CMSG\_LEN(sizeof(struct tpacket\_auxdata)) ||

cmsg->cmsg\_level != SOL\_PACKET ||

cmsg->cmsg\_type != PACKET\_AUXDATA)

continue;

aux= (struct tpacket\_auxdata \*)CMSG\_DATA(cmsg);

if (aux->tp\_vlan\_tci == 0)

continue;

len = packet\_len > iov.iov\_len? iov.iov\_len : packet\_len;

if (len < 2 \* ETH\_ALEN)

break;

bp -= VLAN\_TAG\_LEN;

memmove(bp, bp + VLAN\_TAG\_LEN, 2 \*ETH\_ALEN);

tag = (struct vlan\_tag \*)(bp + 2 \*ETH\_ALEN);

tag->vlan\_tpid =htons(ETH\_P\_8021Q);

tag->vlan\_tci =htons(aux->tp\_vlan\_tci);

packet\_len += VLAN\_TAG\_LEN;

\#endif /\*defined(HAVE\_PACKET\_AUXDATA) &&defined(HAVE\_LINUX\_TPACKET\_AUXDATA\_TP\_VLAN\_TCI) \*/

\#endif /\*HAVE\_PF\_PACKET\_SOCKETS \*/

/\*

\* XXX: According to the kernel source weshould get the real

\* packet len if calling recvfrom withMSG\_TRUNC set. It does

\* not seem to work here :(, but it issupported by this code

\* anyway.

\* To be honest the code RELIES on that featureso this is really

\* broken with 2.2.x kernels.

\* I spend a day to figure out what's going onand I found out

\* that the following is happening:

\* The packet comes from a random interface andthe packet\_rcv

\* hook is called with a clone of the packet.That code inserts

\* the packet into the receive queue of thepacket socket.

\* If a filter is attached to that socket thatfilter is run

\* first - and there lies the problem. Thedefault filter always

\* cuts the packet at the snaplen:

\* \# tcpdump -d

\* (000) ret      \#68

\* So the packet filter cuts down the packet.The recvfrom call

\* says "hey, it's only 68 bytes, it fitsinto the buffer" with

\* the result that we don't get the real packetlength. This

\* is valid at least until kernel 2.2.17pre6.

\* We currently handle this by making a copy ofthe filter

\* program, fixing all "ret"instructions with non-zero

\* operands to have an operand of 65535 so thatthe filter

\* doesn't truncate the packet, and supplyingthat modified

\* filter to the kernel.

\*/

caplen = packet\_len;

if (caplen > handle->snapshot)

caplen = handle->snapshot;

/\* Run the packet filter if not usingkernel filter \*/

if (!handle->md.use\_bpf && handle->fcode.bf\_insns)\{

if(bpf\_filter(handle->fcode.bf\_insns, bp,

packet\_len, caplen) == 0)

/\* rejected by filter \*/

return 0;

/\* Fill in our own header data \*/

\#ifdef HAVE\_PF\_RING

if(!handle->ring) \{

\#endif

if (ioctl(handle->fd,SIOCGSTAMP, &pcap\_header.ts) == -1) \{

snprintf(handle->errbuf,PCAP\_ERRBUF\_SIZE,

"SIOCGSTAMP: %s",pcap\_strerror(errno));

returnPCAP\_ERROR;

pcap\_header.caplen = caplen;

pcap\_header.len             = packet\_len;

\#ifdef HAVE\_PF\_RING

\#endif

/\*

\* Count the packet.

\* Arguably, we should count them before wecheck the filter,

\* as on many other platforms"ps\_recv" counts packets

\* handed to the filter rather than packetsthat passed

\* the filter, but if filtering is done in thekernel, we

\* can't get a count of packets that passed thefilter,

\* and that would mean the meaning of"ps\_recv" wouldn't

\* be the same on all Linux systems.

\* XXX - it's not the same on all systems inany case;

\* ideally, we should have a "get thestatistics" call

\* that supplies more counts and indicateswhich of them

\* it supplies, so that we supply a count ofpackets

\* handed to the filter only on platforms wherethat

\* information is available.

\* We count them here even if we can get thepacket count

\* from the kernel, as we can only determine atrun time

\* whether we'll be able to get it from thekernel (if

\* HAVE\_TPACKET\_STATS isn't defined, we can'tget it from

\* the kernel, but if it is defined, thelibrary might

\* have been built with a 2.4 or later kernel,but we

\* might be running on a 2.2\[.x\] kernel without Alexey

\* Kuznetzov's turbopacket patches, and thusthe kernel

\* might not be able to supply thosestatistics).  We

\* could, I guess, try, when opening thesocket, to get

\* the statistics, and if we can not incrementthe count

\* here, but it's not clear that alwaysincrementing

\* the count is more expensive than alwaystesting a flag

\* in memory.

\* We keep the count in"md.packets\_read", and use that for

\* "ps\_recv" if we can't get thestatistics from the kernel.

\* We do that because, if we \*can\* get thestatistics from

\* the kernel, we use"md.stat.ps\_recv" and "md.stat.ps\_drop"

\* as running counts, as reading the statisticsfrom the

\* kernel resets the kernel statistics, and ifwe directly

\* increment "md.stat.ps\_recv" here,that means it will

\* count packets \*twice\* on systems where wecan get kernel

\* statistics - once here, and once inpcap\_stats\_linux().

\*/

handle->md.packets\_read++;

/\* Call the usersupplied callback function \*/

\#if defined(HAVE\_PF\_RING)

struct myts \{

struct timeval ts;

u\_int32\_t caplen, len;

u\_int64\_t ns;

\};

struct myts myhdr;

myhdr.ts.tv\_sec = pcap\_header.ts.tv\_sec,myhdr.ts.tv\_usec = pcap\_header.ts.tv\_usec;

myhdr.caplen = pcap\_header.caplen, myhdr.len= pcap\_header.len;

myhdr.ns =pcap\_header.extended\_hdr.timestamp\_ns;

callback(userdata, (structpcap\_pkthdr\*)&myhdr, bp);

\#else

callback(userdata,&pcap\_header, bp);

\#endif

/\*这个函数虽然比较长，但是一路看下来，还是比较好理解的，就是在不同的socket下调用不同的函数接收数据包，最后看是否定义了HAVE\_PF\_RING，如果定义了，调用的回调函数callback的头会不一样的，呵呵，上面代码中已经可以看的很清楚了。

\*/

return 1;

讲解了这么多了，pcap\_open\_live还没有讲解完了，这几十页下来就讲解了pcap\_open\_live中调用的一个函数，哈哈，也就是pcap-linux.c中调用的pcap\_create函数，libpcap博大精深，加上了pf-ring就有一种更高深的感觉。既然还没有讲解完，就接着讲解呗，下面讲解pcap\_open\_live中调用的另外一个函数，pcap\_activate。Pcap\_create起的作用是创建和绑定socket，同时定义了一些回调函数。那么pcap\_activate的作用是啥呢，用源码说话，I love linux ，I love open source。

Int pcap\_activate(pcap\_t\*p)

int status;

status = p->activate\_op(p);

/\*activate\_op是个什么函数呢，搜了下原型是个函数指针，这个函数指针在哪里赋值呢，搜源码吧，呵呵。终于在pcap-linux.c下搜到了它的初始化赋值，哈哈，原来就是

handle->activate\_op= pcap\_activate\_linux;

明白了在pcap\_create中定义的pcap\_activate\_linux函数中赋值的回调函数activate\_op终于在这里调用了，其实pcap\_create只赋值定义这个回调函数，而调用就是在这里了。前面分析的一切到现在才调用，呵呵，明白了吗？

\*/

if (status >= 0)                                   //pcap\_activate\_linux的返回值>=0表示成功

p->activated = 1;

else \{

if (p->errbuf\[0\] == '\\0') \{

/\*

\* No error message supplied by the activateroutine;

\* for the benefit of programs that don'tspecially

\* handle errors other than PCAP\_ERROR,return the

\* error message corresponding to the status.

\*/

snprintf(p->errbuf,PCAP\_ERRBUF\_SIZE, "%s",

pcap\_statustostr(status));

/\*

\* Undo any operation pointer setting, etc.done by

\* the activate operation.

\*/

initialize\_ops(p);

return (status);

Pcap\_open\_live终于分析完了，我也要去吃晚饭了，下面还有好多要分析呢，排个队吧，首先分析pcap\_next等函数吧，socket已经建立和绑定了，也是该捕获数据的时候了，呵呵，捕获数据的回调函数也已经定义了，就是那个pcap\_read\_linux函数，即pcap\_read\_packet函数了，我现在猜想，pcap\_open\_live中肯定会调用这个回调函数的，咋们走着瞧。先吃饭，人是铁，饭是刚，一顿不吃饿的慌。稍后见

[Link 1]: http://lib.csdn.net/base/operatingsystem
[Linux]: http://lib.csdn.net/base/linux
[Link 2]: http://lib.csdn.net/base/architecture
[Link 3]: http://lib.csdn.net/base/datastructure
[.NET]: http://lib.csdn.net/base/dotnet