为什么分组的以太网和IP报头，其通过libpcap的功能捕获，被扭曲

Question

我使用的libpcap函数pcap_next（）来捕获来自其他主机 一些TCP包我检查捕获的数据包 的字节并注意 数据包的以太网和IP报头是扭曲的，在很多0的乱七八糟，但TCP头很好

这是什么原因？

代码：

pcap_t* create_pcap_handler() 
{ 
    pcap_t *handle;     /* Session handle */ 
    char *dev;      /* The device to sniff on */ 
    char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */ 
    struct bpf_program fp;   /* The compiled filter */ 
    char filter_exp[] = "port 32000"; /* The filter expression */ 
    bpf_u_int32 mask;    /* Our netmask */ 
    bpf_u_int32 net;    /* Our IP subnet*/ 

    /* Define the device */ 
    dev = pcap_lookupdev(errbuf); 
    if (dev == NULL) { 
      fprintf(stderr, "Couldn't find default device: %s\n", errbuf); 
      exit(2); 
    } 
    /* Find the properties for the device */ 
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) { 
      fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf); 
      net = 0; 
      mask = 0; 
    } 

    struct in_addr tmp; 
    tmp.s_addr=net; 
    char IPdotdec[20]; 
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16); 
    printf("net is %s\n", IPdotdec); 
    tmp.s_addr=mask; 
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16); 
    printf("mask is %s\n", IPdotdec); 
    printf("dev is %s\n",dev); 

    handle = pcap_open_live(dev, BUFSIZ, 0, 0, errbuf); 
    if (handle == NULL) { 
      fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf); 
      exit(2) ; 
    } 
    /* Compile and apply the filter */ 
    if (pcap_compile(handle, &fp, filter_exp, 0, mask) == -1) { 
      fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle)); 
      exit(2); 
    } 
    if (pcap_setfilter(handle, &fp) == -1) { 
      fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle)); 
      exit(2); 
    } 

    return handle; 
} 

和主要功能

int main() 
{ 
    pcap_t * pcap_handler=create_pcap_handler(); 
    struct pcap_pkthdr pcap_header;  /* The header that pcap gives us */ 
    const u_char *pcap_packet;   /* The actual packet */ 
    pcap_packet = pcap_next(pcap_handler, &pcap_header); 
    if(pcap_packet !=NULL) 
      printf("capture one packet with length of %d\n", pcap_header.len); 
    pcap_close(pcap_handler); 


    return 0; 
} 

Answer 1

pcap_packet = pcap_next(pcap_handler, &pcap_header); 
if(pcap_packet !=NULL) 
     printf("capture one packet with length of %d\n", pcap_header.len); 
pcap_close(pcap_handler); 
parse_pkt(pcap_packet,pcap_header.len); 

这是行不通的。

当您关闭pcap_handler，也不能保证通过调用与pcap_handler回到pcap_next()或pcap_next_ex()任何指针将继续有效。

尝试

pcap_packet = pcap_next(pcap_handler, &pcap_header); 
if(pcap_packet !=NULL) 
     printf("capture one packet with length of %d\n", pcap_header.len); 
parse_pkt(pcap_packet,pcap_header.len); 
pcap_close(pcap_handler); 

代替。