Wincap capture filtering expression syntax

Posted by cpx on Stack Overflow See other posts from Stack Overflow or by cpx
Published on 2010-12-23T01:49:41Z Indexed on 2010/12/23 1:54 UTC
Read the original article Hit count: 601

Filed under:
|
|

How would specify a syntax for filtering tcp server port with its ip address?

   const char *packet_filter = "tcp src port 2054";

    bpf_u_int32 netmask;
    bpf_program fcode;

    if (d->addresses != NULL)
      /* Retrieve the mask of the first address of the interface */
        netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
    else
       /* If the interface is without an address we suppose to be in a C class network */
        netmask=0xffffff; 


    //compile the filter
    if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0)
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
    }

    //set the filter
    if (pcap_setfilter(adhandle, &fcode) < 0)
    {
        fprintf(stderr,"\nError setting the filter.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
}

© Stack Overflow or respective owner

Related posts about c++

Related posts about packet-capture