我在我们的Ubuntu服务器上捕获了一些带有pcapplusplus的包,并写入了.pcap文件,然后我读取了.pcap文件,它工作得很好;但是当我用BPF语法设置过滤器时,它不能从.pcap文件中读取,过滤器只是一个tcp字符串,它在示例input.pcap中工作得很好,但是不能处理我的pcap,
pcpp::IFileReaderDevice* reader = pcpp::IFileReaderDevice::getReader("input.pcap");
// verify that a reader interface was indeed created
if (reader == NULL)
{
printf("Cannot determine reader for file type\n");
exit(1);
}
// open the reader for reading
if (!reader->open())
{
printf("Cannot open input.pcap for reading\n");
exit(1);
}
// create a pcap file writer. Specify file name and link type of all packets that
// will be written to it
pcpp::PcapFileWriterDevice pcapWriter("output.pcap", pcpp::LINKTYPE_ETHERNET);
// try to open the file for writing
if (!pcapWriter.open())
{
printf("Cannot open output.pcap for writing\n");
exit(1);
}
// create a pcap-ng file writer. Specify file name. Link type is not necessary because
// pcap-ng files can store multiple link types in the same file
pcpp::PcapNgFileWriterDevice pcapNgWriter("output.pcapng");
// try to open the file for writing
if (!pcapNgWriter.open())
{
printf("Cannot open output.pcapng for writing\n");
exit(1);
}
// set a BPF filter for the reader - only packets that match the filter will be read
if (!reader->setFilter("tcp"))
{
printf("Cannot set filter for file reader\n");
exit(1);
}
// the packet container
pcpp::RawPacket rawPacket;
// a while loop that will continue as long as there are packets in the input file
// matching the BPF filter
while (reader->getNextPacket(rawPacket))
{
// write each packet to both writers
printf("matched ...\n");
pcapWriter.writePacket(rawPacket);
pcapNgWriter.writePacket(rawPacket);
}下面是一些数据包:在这里输入图像描述
1:https://i.stack.imgur.com/phYA0.png,有人能帮忙吗?
https://stackoverflow.com/questions/71248686
复制相似问题