使用 libpcap 测量上传/下载速率
我在 C 应用程序中使用 libpcap（以及 Windows 上的 winpcap）来监视网络流量。我需要区分每个网络适配器上的上传和下载流量，以生成连接速度统计信息，但库使用的过滤器表达式似乎不太容易支持这一点（即没有“传入”/“传出”运算符）。
我考虑过的一种方法是查询每个适配器的 IP 地址，然后使用过滤器，例如 src host 1.2.3.4 （用于测量上传）和 dst host 1.2.3.4 code>（衡量下载量）。
我的问题是：
是否有比上面的方法更好/更简单的方法（让我对每个适配器使用相同的过滤器表达式会很好）？
如果采用上述方法，那么单个适配器是否有可能拥有多个与其关联的 IP 地址？我问的原因是，保存单个适配器的地址详细信息的 pcap_addr 结构（在 struct pcap_if 中）有一个“下一个”成员，表明这是可能的。
I'm using libpcap (and winpcap on Windows) in a C application to monitor network traffic. I need to differentiate between upload and download traffic on each network adapter, to produce connection speed stats, but the filter expressions used by the library don't seem to support this very easily (ie there are no 'incoming'/'outgoing' operators).
One approach that I have considered is to query the IP address of each adapter, and then use filters such as src host 1.2.3.4 (to measure uploads) and dst host 1.2.3.4 (to measure downloads).
My questions are:
Is there a better/simpler approach than the one above (something that would let me use the same filter expression for each adapter would be nice)?
If the above approach is the way to go, then is there any chance that a single adapter could have more than 1 IP address associated with it? The reason I ask is that the pcap_addr struct which holds the address details of a single adapter (in struct pcap_if) has a 'next' member suggesting that this is possible.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您是否考虑过查看 pmacct - 我个人过去曾对此做出过贡献。这是一个 C 工具，使用 libpcap 被动监控网络流量以进行记账。
Have you considered looking at pmacct - I have personally contributed to this in time past. This is a C tool that uses libpcap to passively monitor network traffic for accounting purposes.
尝试
tcpdumpTry
tcpdump首先，请记住，pcap 只能看到数据包。它看不到“传出”或“传入”——只是数据包。所以是的，您必须使用 ip 标头中的
src/dst进行过滤。没有其他方法可以判断数据包是传入还是传出。其次，是的，没有什么可以阻止适配器拥有多个 IP 地址。因此，您需要获取从该适配器配置的 IP 地址。
pcap_findalldevs()（WinPCap 文档）应该可以在这里帮助您，您应该能够从中推断出您想要监控哪些设备。Firstly, remember, pcap sees only packets. It doesn't see "outgoing" or "incoming" - simply packets. So yes, you must filter using the
src/dstin the ip headers. There is no other way to tell whether the packet is incoming or outgoing.Secondly, yes, there is nothing stopping an adapter having multiple IP addresses. So you need to grab the IP addresses configured from that adapter.
pcap_findalldevs()(WinPCap Documentation) ought to help you here, from which you should be able to deduce which devices you want to monitor.