为什么我的程序报告捕获的数据包比 Wireshark 多？

Question

我正在使用 pcap 和 visual studio 编写数据包嗅探器。我已经获取了 offline capturing and combined it with code that looks for an interface and captures packets live. This is what I have to display the packets information gotten from 1.

的示例代码

    while (int returnValue = pcap_next_ex(pcap, &header, &data) >= 0)
{
    // Print using printf. See printf reference:
    // http://www.cplusplus.com/reference/clibrary/cstdio/printf/

    // Show the packet number
    printf("Packet # %i\n", ++packetCount);

    // Show the size in bytes of the packet
    printf("Packet size: %d bytes\n", header->len);

    // Show a warning if the length captured is different
    if (header->len != header->caplen)
        printf("Warning! Capture size different than packet size: %ld bytes\n", header->len);

    // Show Epoch Time
    printf("Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);

    // loop through the packet and print it as hexidecimal representations of octets
    // We also have a function that does this similarly below: PrintData()
    for (u_int i=0; (i < header->caplen ) ; i++)
    {
        // Start printing on the next after every 16 octets
        if ( (i % 16) == 0) printf("\n");

        // Print each octet as hex (x), make sure there is always two characters (.2).
        printf("%.2x ", data[i]);
    }

    // Add two lines between packets
    printf("\n\n");
}

我遇到的问题是，如果我运行 WireShark 实时捕获以及运行我的程序，两者都实时捕获数据包，但 WireShark 将显示它正在捕获数据包 20 和 VS将显示 packetCount = 200。（注意：选择任意数字来显示 Wireshark 没有捕获很多数据包，但 VS 计数非常快。）

据我所知，似乎 while 循环只是运行ning 比数据包进来快得多，所以它只是一遍又一遍地打印它收到的最后一个数据包的信息，直到一个新的一个进来。我怎样才能让 VS 只在数据包进来时捕获它们？

Answer 1

我不知道 Visual Studio 包含数据包嗅探器；你是说 "how can I get my application, which I'm building with Visual Studio, to only capture packets as they come in?"

如果这就是你的意思，那么这就是你的代码正在做的事情。

不幸的是，不是做的是"checking whether a packet has actually come in"。

引用 pcap_next_ex() 的手册页（是的，UN*X，但这也适用于 Windows 和 WinPcap）：

   pcap_next_ex() returns 1 if the packet was read without  problems,
   0  if  packets are being read from a live capture, and the timeout
   expired, -1 if an error occurred while reading the packet, and  -2
   if  packets  are  being read from a ``savefile'', and there are no
   more packets to read  from  the  savefile.   If  -1  is  returned,
   pcap_geterr() or pcap_perror() may be called with p as an argument
   to fetch or display the error text.

强调“0，如果正在从实时捕获中读取数据包，并且超时已过期”； 0 表示您没有收到数据包。

如果 pcap_next_ex() 返回 0，不要表现得好像捕获了一个数据包，仅当它返回 1 时才这样做：

while (int returnValue = pcap_next_ex(pcap, &header, &data) >= 0)
{
    if (returnValue == 1) {
        // Print using printf. See printf reference:
        // http://www.cplusplus.com/reference/clibrary/cstdio/printf/

        // Show the packet number
        printf("Packet # %i\n", ++packetCount);

             ...

        // Add two lines between packets
        printf("\n\n");
    }
}

Answer 2

解决方案：显然，在参数周围添加括号可以解决问题。

while ( (( int returnValue = pcap_next_ex(pcap, &header, &data) ) >= 0 ) )

为什么我的程序报告捕获的数据包比 Wireshark 多？

Why is my program reporting more captured packets than Wireshark?

wireshark

packet-capture