In the program I use the libpcap library to intercept packets from a card that does not have an IP address (the router sends packets to this port).

Same code on debian 7 (kernel 3.2.0-4-amd64) , and on ubuntu 14.04 (kernel 3.13.0-24-generic) and on debian 8.1 (kernel 3.16.0) .

At the same time, on debian 7 and on ubuntu 12.04 (kernel 3.11.0-19-generic) , using the pcap_next_ex () function, I can get the package, but on ubuntu 14.04 and debian 8.1 I can't.

What could be the problem?

code

#include <pcap.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> void intranet_packages(u_char *user, const struct pcap_pkthdr *header, const u_char *packet); int main() { char errbuf[PCAP_ERRBUF_SIZE]; char *dev = pcap_lookupdev(errbuf); pcap_t *handle = pcap_open_live(dev, 1600, 1, -1, errbuf); const unsigned char *packet; if (handle == NULL) { printf("1 fasfas %s\n", errbuf); return -1; } char filter[] = ""; struct bpf_program fp; memset((void*)&fp, 0, sizeof(struct bpf_program)); int result = pcap_compile(handle, &fp, filter, 0, 0); if (result < 0) { printf("2 fasfas\n"); return -1; } result = pcap_setfilter(handle, &fp); if (result < 0) { printf("3 fasfas\n"); return -1; } struct pcap_pkthdr header; int i; while (1) { packet = pcap_next(handle, &header); printf("%d ", header.len); if (result < 0) { return -1; } } pcap_close(handle); }

PS wireshark and tcpdump using the same library for some reason receive the packets, and with the help of this code, as written above, on debian 8.1 and ubuntu 14.04 I can not get the packets.

  • one
    Your question looks something like this: “I do something, and it does not always work. What am I doing wrong? ” - VladD

1 answer 1

Starting with libpcap 1.5 kernel version ~ 3.2, TPACKET_V3 has appeared.

Read more and the "medicine" here: https://github.com/the-tcpdump-group/libpcap/issues/354#issuecomment-42146519 .

Those. to replace

 pcap_t *handle = pcap_open_live(dev, 1600, 1, -1, errbuf);

on

 pcap_t *handle = pcap_create(dev, errbuf); if(!handle){ printf("1 fasfas %s\n", errbuf); return -1; } pcap_set_promisc(handle, 1); pcap_set_snaplen(handle, 1600); pcap_set_immediate_mode(handle, 1); pcap_activate(handle);

Note that pcap_set_immediate_mode(handle, 1) replaces timeout . Tested by me on debian-8.5 , libpcap-1.7.4 .

  • Please try to publish detailed answers containing a specific example of the minimum solution, supplementing them with a link to the source. Answers –references (as well as comments) do not add knowledge to the Runet. - Nicolas Chabanovsky ♦