1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<title>WinPcap: Filtering the traffic</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<link href="style.css" rel="stylesheet" type="text/css"/>
</head>
<body>
<!-- Generated by Doxygen 1.6.1 -->
<div class="navigation" id="top">
<div class="tabs">
<ul>
<li><a href="main.html"><span>Main Page</span></a></li>
<li><a href="pages.html"><span>Related Pages</span></a></li>
<li><a href="modules.html"><span>Modules</span></a></li>
<li><a href="annotated.html"><span>Data Structures</span></a></li>
<li><a href="files.html"><span>Files</span></a></li>
</ul>
</div>
</div>
<div class="contents">
<h1>Filtering the traffic</h1><table border="0" cellpadding="0" cellspacing="0">
</table>
<p>One of the most powerful features offered by WinPcap (and by libpcap as well) is the filtering engine. It provides a very efficient way to receive subsets of the network traffic, and is (usually) integrated with the capture mechanism provided by WinPcap. The functions used to filter packets are <a class="el" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile()</a> and <a class="el" href="group__wpcapfunc.html#gaf5f9cfe85dad0967ff607e5159b1ba61" title="Associate a filter to a capture.">pcap_setfilter()</a>.</p>
<p><a class="el" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile()</a> takes a string containing a high-level Boolean (filter) expression and produces a low-level byte code that can be interpreted by the fileter engine in the packet driver. The syntax of the boolean expression can be found in the <a class="el" href="group__language.html">Filtering expression syntax</a> section of this documentation.</p>
<p><a class="el" href="group__wpcapfunc.html#gaf5f9cfe85dad0967ff607e5159b1ba61" title="Associate a filter to a capture.">pcap_setfilter()</a> associates a filter with a capture session in the kernel driver. Once <a class="el" href="group__wpcapfunc.html#gaf5f9cfe85dad0967ff607e5159b1ba61" title="Associate a filter to a capture.">pcap_setfilter()</a> is called, the associated filter will be applied to all the packets coming from the network, and all the conformant packets (i.e., packets for which the Boolean expression evaluates to true) will be actually copied to the application.</p>
<p>The following code shows how to compile and set a filter. Note that we must retrieve the netmask from the <a class="el" href="structpcap__if.html" title="Item in a list of interfaces, used by pcap_findalldevs().">pcap_if</a> structure that describes the adapter, because some filters created by <a class="el" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile()</a> require it.</p>
<p>The filter passed to <a class="el" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile()</a> in this code snippet is "ip and tcp", which means to "keep only the packets that are both IPv4 and TCP and deliver them to the application".</p>
<div class="fragment"><pre class="fragment"> <span class="keywordflow">if</span> (d-><a class="code" href="structpcap__if.html#a3910004677550db6d9b09792ba3e2cca" title="a pointer to the first element of a list of addresses for the interface">addresses</a> != NULL)
<span class="comment">/* Retrieve the mask of the first address of the interface */</span>
netmask=((<span class="keyword">struct </span>sockaddr_in *)(d-><a class="code" href="structpcap__if.html#a3910004677550db6d9b09792ba3e2cca" title="a pointer to the first element of a list of addresses for the interface">addresses</a>-><a class="code" href="structpcap__addr.html#ac43963e42e4d901e55e433ab9c3ea686" title="if not NULL, a pointer to a struct sockaddr that contains the netmask corresponding...">netmask</a>))->sin_addr.S_un.S_addr;
<span class="keywordflow">else</span>
<span class="comment">/* If the interface is without an address we suppose to be in a C class network */</span>
netmask=0xffffff;
compile the filter
if (<a class="code" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile</a>(adhandle, &fcode, <span class="stringliteral">"ip and tcp"</span>, 1, netmask) < 0)
{
fprintf(stderr,<span class="stringliteral">"\nUnable to compile the packet filter. Check the syntax.\n"</span>);
<span class="comment">/* Free the device list */</span>
<a class="code" href="group__wpcapfunc.html#ga346b4b0b7fd1cda4abb9a39f767dbeb1" title="Free an interface list returned by pcap_findalldevs().">pcap_freealldevs</a>(alldevs);
<span class="keywordflow">return</span> -1;
}
<span class="keyword">set</span> the filter
<span class="keywordflow">if</span> (<a class="code" href="group__wpcapfunc.html#gaf5f9cfe85dad0967ff607e5159b1ba61" title="Associate a filter to a capture.">pcap_setfilter</a>(adhandle, &fcode) < 0)
{
fprintf(stderr,<span class="stringliteral">"\nError setting the filter.\n"</span>);
<span class="comment">/* Free the device list */</span>
<a class="code" href="group__wpcapfunc.html#ga346b4b0b7fd1cda4abb9a39f767dbeb1" title="Free an interface list returned by pcap_findalldevs().">pcap_freealldevs</a>(alldevs);
<span class="keywordflow">return</span> -1;
}
</pre></div><p>If you want to see some code that uses the filtering functions shown in this lesson, look at the example presented in the next Lesson, <a class="el" href="group__wpcap__tut6.html">Interpreting the packets</a>.</p>
<p><a class="el" href="group__wpcap__tut4.html"><<< Previous</a> <a class="el" href="group__wpcap__tut6.html">Next >>></a> </p>
</div>
<hr>
<p align="right"><img border="0" src="winpcap_small.gif" align="absbottom" width="91" height="27">
documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2009
CACE Technologies. All rights reserved.</p>
|