int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header, u_char **pkt_data) { /* Check the capture type */ #ifdef HAVE_REMOTE if (p->rmt_clientside) { /* We are on an remote capture */ if (!p->rmt_capstarted) { // if the capture has not started yet, please start it if (pcap_startcapture_remote(p) ) return -1; p->rmt_capstarted= 1; } return pcap_next_ex_remote(p, pkt_header, pkt_data); } #endif if (p->adapter!=NULL) { /* We are on a live capture */ int cc; int n = 0; register u_char *bp, *ep; cc = p->cc; if (p->cc == 0) { /* capture the packets */ if(PacketReceivePacket(p->adapter, p->Packet, TRUE) == FALSE) { sprintf(p->errbuf, "read error: PacketReceivePacket failed"); return (-1); } cc = p->Packet->ulBytesReceived; bp = p->Packet->Buffer; } else bp = p->bp; /* * Loop through each packet. */ ep = bp + cc; if (bp < ep) { register int caplen, hdrlen; caplen = ((struct bpf_hdr *)bp)->bh_caplen; hdrlen = ((struct bpf_hdr *)bp)->bh_hdrlen; /* * XXX A bpf_hdr matches a pcap_pkthdr. */ *pkt_header = (struct pcap_pkthdr*)bp; *pkt_data = bp + hdrlen; bp += BPF_WORDALIGN(caplen + hdrlen); p->bp = bp; p->cc = ep - bp; return (1); } else{ p->cc = 0; return (0); } } else { /* We are on an offline capture */ struct bpf_insn *fcode = p->fcode.bf_insns; int status; int n = 0; struct pcap_pkthdr *h=(struct pcap_pkthdr*)(p->buffer+p->bufsize-sizeof(struct pcap_pkthdr)); while (1) { status = sf_next_packet(p, h, p->buffer, p->bufsize); if (status==1) /* EOF */ return (-2); if (status==-1) /* Error */ return (-1); if (fcode == NULL || bpf_filter(fcode, p->buffer, h->len, h->caplen)) { *pkt_header = h; *pkt_data = p->buffer; return (1); } } } }
int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { int cc; int n = 0; register u_char *bp, *ep; #ifdef REMOTE if (p->rmt_clientside) { /* We are on an remote capture */ if (!p->rmt_capstarted) { // if the capture has not started yet, please start it if (pcap_startcapture_remote(p) ) return -1; p->rmt_capstarted= 1; } return pcap_read_remote(p, cnt, callback, user); } #endif cc = p->cc; if (p->cc == 0) { /* capture the packets */ if(PacketReceivePacket(p->adapter,p->Packet,TRUE)==FALSE){ snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed"); return (-1); } cc = p->Packet->ulBytesReceived; bp = p->Packet->Buffer; } else bp = p->bp; /* * Loop through each packet. */ #define bhp ((struct bpf_hdr *)bp) ep = bp + cc; while (bp < ep) { register int caplen, hdrlen; caplen = bhp->bh_caplen; hdrlen = bhp->bh_hdrlen; /* * XXX A bpf_hdr matches a pcap_pkthdr. */ (*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen); bp += BPF_WORDALIGN(caplen + hdrlen); if (++n >= cnt && cnt > 0) { p->bp = bp; p->cc = ep - bp; return (n); } } #undef bhp p->cc = 0; return (n); }