阅读大型PCap文件时崩溃

时间:2016-10-05 13:47:04

标签: c++ pcap

我在C ++中运行以下代码来读取PCap文件中的数据包:

#include <iostream>
#include <pcap.h>

using namespace std;

int main()
{
    int num, inum,i  = 0;
    pcap_if_t *alldevs;
    pcap_t *adhandle;
    struct bpf_program fcode;
    bpf_u_int32 net, mask;
    char *dev;
    string file = "C:\\Users\\AwesomeUser\\Desktop\\dataset.pcap";
    char errbuff[PCAP_ERRBUF_SIZE];
    pcap_t * pcap = pcap_open_offline(file.c_str(), errbuff);
    struct pcap_pkthdr *header;
    const u_char *data = NULL;
    dev = pcap_lookupdev(errbuff);


    if (pcap_lookupnet( dev, &net, &mask, errbuff ) == -1)
    {
        fprintf(stderr, "Can't get netmask for device %s\n", dev);
        net = 0;
        mask = 0;
    }


    u_int packetCount = 0;

    cout << "Pre-loop test";
    while( int returnValue = pcap_next_ex( pcap , &header, &data) >= 0)
    {
        cout << "inner loop test";
        if (pcap_compile(pcap , &fcode, "ip and tcp", 1, net) < 0)
        {
            fprintf( stderr, "\nC++ is unable to compile the packet filter. Please check the syntax\n");
            pcap_freealldevs(alldevs);
            return -1;
        }

        if ( pcap_setfilter( pcap, &fcode) < 0)
        {
            fprintf(stderr, "\nThere is an error in setting the filter.\n");
            pcap_freealldevs(alldevs);
            return -1;
        }

        printf("Packet number %i\n", ++packetCount);
        printf("Packet size: %d bytes\n", header->len);
        if ( header->len != header->caplen)
            printf("Warning! Packet size different from capture size: %ld bytes\n", header->len);

        printf("Epoch time: %d:%d seconds\n\n\n", header->ts.tv_sec, header->ts.tv_usec);

    }
    cout << packetCount;
    cin >> num;

    return 0;
}

程序崩溃并输出以下内容:

Pre-loop test

我已经确定在第一次执行while循环的条件时发生了崩溃:

pcap_next_ex( pcap , &header, &data)

据我所知,pcap_next_ex应该读取下一个数据包。我已经使用其他.pcap文件测试了这个确切的代码,它可以完美地运行我从互联网上尝试过的所有内容以及使用Wireshark生成的文件。我所知道的唯一区别是我在这段代码中尝试读取的dataset.pcap文件非常大(8GB)。为了阅读这么大的文件,我需要做些什么特别的事吗?还有什么可能导致崩溃?

0 个答案:

没有答案