IOS多网卡抓包

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

linux下libpcap支持从多网卡抓包,设置为any即可

在IOS或者mac上就无法通过次方法抓取所有网卡报文

1.通过设置libevent事件回调，每个网卡注册读事件， fd通过

pd = pcap_open_live(device, snaplen, dopromisc, timeout, ebuf);

获得。

#ifdef IOS
static int add_event(pcap_t *p)
{
if(!p)
return -;
//event_init();
if(!base)
base = event_base_new(); struct event *ev = NULL; int fd = pcap_fileno(p);
printf("---------fd:%d \n", fd); //event_set(&evListen, fd, EV_READ, user_pcap_run, p );
ev = event_new(base,fd, EV_READ | EV_PERSIST, user_pcap_run,p); struct timeval timeout;
timeout.tv_sec = ;
timeout.tv_usec = ;
//event_base_set(base,&evListen);
event_add(ev, NULL); return ;
}#endif

2.开线程调用事件循环

void *mt_vqmon_thread(void *param)
{
#ifdef ANDROID mmap_cap_run();#elif defined IOS event_base_dispatch(base);
printf("exit monitor thread\n");#else pcap_t *p = (pcap_t *)param;
user_pcap_loop(p);#endif return NULL;
}

3.其他读取报文，处理和pcap之前类似

#ifdef IOS
void user_pcap_run(evutil_socket_t s, short t, void *arg)
{
if(!arg)
return; pcap_t *p = (pcap_t *)arg; const uint8_t *packet;
struct pcap_pkthdr *pcap_header;
int32_t retval;
static uint64_t recv_bytes = ;
static unsigned long start_time = ;
unsigned long end_time, diff_time;
int link_type; link_type = pcap_datalink(p); while()
{
retval = pcap_next_ex(p, &pcap_header, &packet); if(retval >= && packet)
{
//handle_dissector(link_type,packet,pcap_header->caplen,&pcap_header->ts);
recv_bytes += pcap_header->caplen;
}
else if(retval == ) //time out
{
printf("call user_pcap_run failed : No packets arrived before the timeout expired,try again!!!\n");
break;
}
else if(retval == - ) // error
{
printf("No more packets to read from the file !\n");
return ;
}
else
{
printf("call pcap_next_ex failed : %s\n",pcap_geterr(p));
return ;
} static uint32_t last_drop_num = ;
struct pcap_stat stat;
pcap_stats(p,&stat); if(stat.ps_drop && stat.ps_drop != last_drop_num)
{
printf("========>total packet = %u drop packet = %u \n",stat.ps_recv,stat.ps_drop);
last_drop_num = stat.ps_drop;
}
// Print debug info.
end_time = time(); if(start_time == )
{
start_time = end_time;
}
diff_time = end_time - start_time; if(diff_time >= )
{
float mbps; mbps = recv_bytes * 1.0 / ( * * diff_time);
start_time = end_time;
recv_bytes = ; printf("==================================================> captured speed = %.2f Mbps !!!\n",mbps);
} /*
* Check for savagely closed TCP connections.
*/
tcp_check_timeouts(&pcap_header->ts);
}
return ;
}#endif