pcap 仅接收新连接
我编写了一个非常简单的 C 程序来使用 pcap 进行数据包捕获。事实是，它只接收我网络活动的一小部分。 （我认为这种模式是它只接收新的 TCP 连接。）
例如，当我使用浏览器或 wget 执行 GET 请求时，或者当我启动 X-Chat 时，它会接收一堆数据包IRC 客户端并连接。
但是，当我让 IRC 客户端运行时，它不会接收与文本消息相对应的数据包。同样，它不会接收我家庭网络上的 ARP 广播，也不会接收我 ping 网站时的 ping 数据包。
我想知道为什么它只接收我发送/接收的一小部分数据包。这是我的代码。我很感激任何反馈。
I wrote a very simple C program to do a packet capture using pcap. Thing is, it only picks up on a small subset of my network activity. (I think the pattern is that it only picks up on new TCP connections.)
For instance, it picks up on a bunch of packets when I do a GET request with a browser or with wget, or when I start up my X-Chat IRC client and connect.
However, when I leave my IRC client running it doesn't pick up on the packets corresponding to text messages. Similarly, it doesn't pick up on ARP broadcasts on my home network, or ping packets when I ping a website.
I am wondering why it is only picking up on this small subset of the packets I am sending/receiving. Here is my code. I am grateful for any feedback.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
可能发生的情况是，您运行的平台上的超时行为与 BPF（*BSD、OS X）、Solaris 或带有 WInPcap 的 Windows 的超时行为相同，其中底层数据包捕获机制pcap 使用的不会立即传送数据包，而是缓冲一批数据包，并在缓冲区填满或超时到期时将它们传送给 pcap，-1 被解释为“无超时”或“非常超时”。长时间超时”。
在这种情况下，如果有足够的数据包到达来填满缓冲区，例如您执行 HTTP get 并返回足够大的回复，或者如果 IRC 会话涉及大量要连接的数据包，则数据包将显示但如果只是偶尔有数据包到达，例如大部分安静的网络上的 ARP 数据包，则数据包将保留在缓冲区中，直到有足够的数据包到达填满缓冲区（这可能需要无限长的时间）或非常长的超时过期，这可能需要相当长的时间。
降低超时（tcpdump 使用 1000，即 1 秒，Wireshark 使用 100，即 1/10 秒）意味着数据包将在相当短的时间内出现，即使没有足够的数据包到达来填满缓冲区。
What's probably happening is that you're running on a platform where the timeout behaves the way it does with BPF (*BSD, OS X), Solaris, or Windows with WInPcap, wherein the underlying packet capture mechanism that pcap is using does not deliver packets immediately, but buffers up a batch of packets and delivers them to pcap either when the buffer fills up or when the timeout expires, and -1 is either being interpreted as "no timeout" or "a very long timeout".
In that case, if enough packets arrive to fill up the buffer, as might be the case if you do an HTTP get and a sufficiently large reply comes back, or if the IRC session involves a lot of packets to connect, the packets will show up, but if only occasional packets arrive, such as ARP packets on a mostly quiet network, the packets will remain in the buffer until either enough packets arrive to fill up the buffer, which could take an indefinitely long time, or the very long timeout expires, which could take quite a while.
Lowering the timeout (tcpdump uses 1000, i.e. 1 second, and Wireshark uses 100, i.e. 1/10 second) means that packets will show up within a reasonably short period of time, even if not enough packets arrive to fill up the buffer.
修好了。当我将超时值从 -1 更改为其他值时，它会起作用（即它会捕获所有网络活动）。真的不知道那里发生了什么（还没有想太多）所以如果有人知道的话请打招呼。
Fixed it. When I change my TIMEOUT value from -1 to something else it works (ie it picks up on all network activity). Don't really know what's going on there (haven't thought about it much yet) so if someone does please holla.