pcap读写pcap文件

 1 #include <stdio.h>
2 #include <stdint.h>
3 #include <stdlib.h>
4
5 #include <pcap.h>
6
7 ////////////////////////////////////////////////////////////////////////////////
8
9 // ./a.out [源文件]
10 int main(int argc, char **argv)
11 {
12 pcap_t *pcap = NULL;
13 struct pcap_pkthdr *pcaphdr = NULL;
14 pcap_dumper_t *dump;
15 const uint8_t *pktdata = NULL;
16 int ret = -1;
17
18 if (argc < 2)
19 {
20 fprintf(stderr, "arg err\n");
21 exit(1);
22 }
23
24 pcap = pcap_open_offline(argv[1], NULL);
25 dump = pcap_dump_open(pcap, argv[2]);
26
27 ret = pcap_next_ex(pcap, &pcaphdr, &pktdata);
28 for (; ret == 1; ret = pcap_next_ex(pcap, &pcaphdr, &pktdata) )
29 {
30 pcap_dump((uint8_t *)dump, pcaphdr, pktdata);
31 }
32
33 pcap_close(pcap);
34 pcap_dump_flush(dump);
35 pcap_dump_close(dump);
36
37 return EXIT_SUCCESS;
38 };



原文地址:https://www.cnblogs.com/tiantao/p/2398572.html