Question

如何指定使用其ip地址过滤tcp服务器端口的语法？

   const char *packet_filter = "tcp src port 2054";

    bpf_u_int32 netmask;
    bpf_program fcode;

    if (d->addresses != NULL)
      /* Retrieve the mask of the first address of the interface */
        netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
    else
       /* If the interface is without an address we suppose to be in a C class network */
        netmask=0xffffff; 


    //compile the filter
    if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0)
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
    }

    //set the filter
    if (pcap_setfilter(adhandle, &fcode) < 0)
    {
        fprintf(stderr,"\nError setting the filter.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
}

Answer 1

“tcp和dst主机YOU_SERVER_IP和dst端口2054”

您可以在http://www.cs.ucr.edu/~marios/ethereal-tcpdump.pdf

获取更多信息

Wincap捕获过滤表达式语法

1 个答案: