pcap_t

认识pcap_t

实例

handle = {
  fd = 7,  　　　　　　// 文件描述符
  snapshot = 8192,  // 可以接收的最大长度
  linktype = 1,    // LINKTYPE_ETHERNET 1 链路层的类型
  tzoff = 0,  　　/* timezone offset */
  offset = 2,      /* offset for proper alignment */
  sf = {　　　　// struct pcap_sf sf; sf =  savefile
    rfile = 0x0,  // File *
    swapped = 0,
    version_major = 0,
    version_minor = 0,
    base = 0x0
  },
  md = {   // struct pcap_md md; more detail
    stat = { //  struct pcap_stat stat; As returned by the pcap_stats()
      ps_recv = 0,  /* number of packets received */
      ps_drop = 0, /* number of packets dropped */
      ps_ifdrop = 0 /* drops by interface XXX not yet supported */
    },
    use_bpf = 0,  //
    TotPkts = 0,  /* can't oflow for 79 hrs on ether */
    TotAccepted = 0,  /* count accepted by filter */
    TotDrops = 0,      /* count of dropped packets */
    TotMissed = 0,    /* missed by i/f during this run */
    OrigMissed = 0,  /* missed by i/f before this run */
    pad = 0,
    skip = 0,
    device = 0x80627a8 "eth0" // 使用哪个设备
  },
  bufsize = 1564, 　　// buf的大小
  buffer = 0x8062180 "",  // buffer的指向
  bp = 0x0,  // buffer 指针
  cc = 0,  // capture counter ?
  pkt = 0x0, 　　　　//  Place holder for pcap_next().
  fcode = {   // Placeholder for filter code if bpf not in kernel.
    bf_len = 0,  // 有多少条指令
    bf_insns = 0x0 // 指令数组
  },
  errbuf = '00' <repeats 255 times> // 错误信息
}