首页
学习
活动
专区
圈层
工具
发布
首页
学习
活动
专区
圈层
工具
MCP广场
社区首页 >问答首页 >BPF过滤器不适用于vlan数据包

BPF过滤器不适用于vlan数据包
EN

Stack Overflow用户
提问于 2022-02-24 07:50:19
回答 2查看 253关注 0票数 1

我在我们的Ubuntu服务器上捕获了一些带有pcapplusplus的包,并写入了.pcap文件,然后我读取了.pcap文件,它工作得很好;但是当我用BPF语法设置过滤器时,它不能从.pcap文件中读取,过滤器只是一个tcp字符串,它在示例input.pcap中工作得很好,但是不能处理我的pcap,

代码语言:javascript
运行
复制
pcpp::IFileReaderDevice* reader = pcpp::IFileReaderDevice::getReader("input.pcap");

// verify that a reader interface was indeed created
if (reader == NULL)
{   
    printf("Cannot determine reader for file type\n");
    exit(1);
}   

// open the reader for reading
if (!reader->open())
{   
    printf("Cannot open input.pcap for reading\n");
    exit(1);
}   

// create a pcap file writer. Specify file name and link type of all packets that
// will be written to it
pcpp::PcapFileWriterDevice pcapWriter("output.pcap", pcpp::LINKTYPE_ETHERNET);

// try to open the file for writing
if (!pcapWriter.open())
{   
    printf("Cannot open output.pcap for writing\n");
    exit(1);
}   

// create a pcap-ng file writer. Specify file name. Link type is not necessary because
// pcap-ng files can store multiple link types in the same file
pcpp::PcapNgFileWriterDevice pcapNgWriter("output.pcapng");

// try to open the file for writing
if (!pcapNgWriter.open())
{   
    printf("Cannot open output.pcapng for writing\n");
    exit(1);
}   

// set a BPF filter for the reader - only packets that match the filter will be read
if (!reader->setFilter("tcp"))
{   
    printf("Cannot set filter for file reader\n");
    exit(1);
}   

// the packet container
pcpp::RawPacket rawPacket;

// a while loop that will continue as long as there are packets in the input file
// matching the BPF filter
while (reader->getNextPacket(rawPacket))
{
    // write each packet to both writers
    printf("matched ...\n");
    pcapWriter.writePacket(rawPacket);
    pcapNgWriter.writePacket(rawPacket);
}

下面是一些数据包:在这里输入图像描述

1:https://i.stack.imgur.com/phYA0.png,有人能帮忙吗?

EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接:

https://stackoverflow.com/questions/71248686

复制
相关文章

相似问题

领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档