我在C ++中运行以下代码来读取PCap文件中的数据包:
#include <iostream>
#include <pcap.h>
using namespace std;
int main()
{
int num, inum,i = 0;
pcap_if_t *alldevs;
pcap_t *adhandle;
struct bpf_program fcode;
bpf_u_int32 net, mask;
char *dev;
string file = "C:\\Users\\AwesomeUser\\Desktop\\dataset.pcap";
char errbuff[PCAP_ERRBUF_SIZE];
pcap_t * pcap = pcap_open_offline(file.c_str(), errbuff);
struct pcap_pkthdr *header;
const u_char *data = NULL;
dev = pcap_lookupdev(errbuff);
if (pcap_lookupnet( dev, &net, &mask, errbuff ) == -1)
{
fprintf(stderr, "Can't get netmask for device %s\n", dev);
net = 0;
mask = 0;
}
u_int packetCount = 0;
cout << "Pre-loop test";
while( int returnValue = pcap_next_ex( pcap , &header, &data) >= 0)
{
cout << "inner loop test";
if (pcap_compile(pcap , &fcode, "ip and tcp", 1, net) < 0)
{
fprintf( stderr, "\nC++ is unable to compile the packet filter. Please check the syntax\n");
pcap_freealldevs(alldevs);
return -1;
}
if ( pcap_setfilter( pcap, &fcode) < 0)
{
fprintf(stderr, "\nThere is an error in setting the filter.\n");
pcap_freealldevs(alldevs);
return -1;
}
printf("Packet number %i\n", ++packetCount);
printf("Packet size: %d bytes\n", header->len);
if ( header->len != header->caplen)
printf("Warning! Packet size different from capture size: %ld bytes\n", header->len);
printf("Epoch time: %d:%d seconds\n\n\n", header->ts.tv_sec, header->ts.tv_usec);
}
cout << packetCount;
cin >> num;
return 0;
}
程序崩溃并输出以下内容:
Pre-loop test
我已经确定在第一次执行while循环的条件时发生了崩溃:
pcap_next_ex( pcap , &header, &data)
据我所知,pcap_next_ex应该读取下一个数据包。我已经使用其他.pcap文件测试了这个确切的代码,它可以完美地运行我从互联网上尝试过的所有内容以及使用Wireshark生成的文件。我所知道的唯一区别是我在这段代码中尝试读取的dataset.pcap文件非常大(8GB)。为了阅读这么大的文件,我需要做些什么特别的事吗?还有什么可能导致崩溃?