Wincap捕获过滤表达式语法

Question

如何指定用 IP 地址过滤 tcp 服务器端口的语法？

   const char *packet_filter = "tcp src port 2054";

    bpf_u_int32 netmask;
    bpf_program fcode;

    if (d->addresses != NULL)
      /* Retrieve the mask of the first address of the interface */
        netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
    else
       /* If the interface is without an address we suppose to be in a C class network */
        netmask=0xffffff; 


    //compile the filter
    if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) < 0)
    {
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
    }

    //set the filter
    if (pcap_setfilter(adhandle, &fcode) < 0)
    {
        fprintf(stderr,"\nError setting the filter.\n");
        /* Free the device list */
        pcap_freealldevs(alldevs);
        return -1;
}

Answer 1

“tcp 和 dst 主机 YOU_SERVER_IP 和 dst 端口 2054”

您可以在 http 获取更多信息://www.cs.ucr.edu/~marios/ethereal-tcpdump.pdf