Wincap capture filtering expression syntax
Posted
by
cpx
on Stack Overflow
See other posts from Stack Overflow
or by cpx
Published on 2010-12-23T01:49:41Z
Indexed on
2010/12/23
1:54 UTC
Read the original article
Hit count: 594
How would specify a syntax for filtering tcp server port with its ip address?
const char *packet_filter = "tcp src port 2054";
bpf_u_int32 netmask;
bpf_program fcode;
if (d->addresses != NULL)
/* Retrieve the mask of the first address of the interface */
netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
else
/* If the interface is without an address we suppose to be in a C class network */
netmask=0xffffff;
//compile the filter
if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0)
{
fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
//set the filter
if (pcap_setfilter(adhandle, &fcode) < 0)
{
fprintf(stderr,"\nError setting the filter.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
return -1;
}
© Stack Overflow or respective owner