回复 #10 wxpz 的帖子

就是你写的代码啊

#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
int main(int argc, char *argv[])
{
      pcap_t *handle;                      /* Session handle */
      char *dev;                      /* The device to sniff on */
      char errbuf[PCAP_ERRBUF_SIZE];       /* Error string */
      struct bpf_program fp;             /* The compiled filter */
      //char filter_exp[] = "port 23";       /* The filter expression */
      char filter_exp[] = "";
      bpf_u_int32 mask;             /* Our netmask */
      bpf_u_int32 net;             /* Our IP */
      struct pcap_pkthdr *header;       /* The header that pcap gives us */
      const u_char *packet;             /* The actual packet */

      pcap_dumper_t *fileInfo;//file handle
      u_char *pkt_data;

      /* Define the device */
      dev = pcap_lookupdev(errbuf);
      if (dev == NULL)
      {
            fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
            return(2);
      }

      /* Find the properties for the device */
      if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1)
      {
            fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf);
            net = 0;
            mask = 0;
      }

      /* Open the session in promiscuous mode */
      handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
      if (handle == NULL)
      {
            fprintf(stderr, "Couldn't open device: %s\n",  errbuf);
            return(2);
      }

      /* Compile and apply the filter */
      if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1)
      {
            fprintf(stderr, "Couldn't parse filter %s: %s\n",filter_exp, pcap_geterr(handle));
            return(2);
      }
      if (pcap_setfilter(handle, &fp) == -1)
      {
            fprintf(stderr, "Couldn't install filter %s: %s\n",filter_exp, pcap_geterr(handle));
            return(2);
      }

      /* Grab a packet */
//       packet = pcap_next(handle, &header);

      if((fileInfo=pcap_dump_open(handle, "pcapinfom"))==NULL)
            {perror("pcap_dump_open");
            exit(1);
            }

      while(1)
      {
               if ( pcap_next_ex(handle ,&header, (const u_char**)&pkt_data) < 0 )
                     break;
            //  packet = pcap_next(handle,&header);
               pcap_dump((u_char*)(fileInfo), header, pkt_data);
      //       pcap_dump((u_char*)(fileInfo),&header,packet);
      }/*
      if( (pcap_loop(handle, -1, pkt_callback,NULL)) == -1 )
      {
            perror("pcap_loop");
            return(2);
         }
*/

      //close file
         pcap_dump_close(fileInfo);

      /* And close the session */
      pcap_close(handle);
      return(0);
}