学习libpcap库，写例子代码－－ether.hpp

最新推荐文章于 2025-07-10 12:46:44 发布

原创最新推荐文章于 2025-07-10 12:46:44 发布 · 639 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#struct #header #string #null

C++ 专栏收录该内容

49 篇文章

订阅专栏

本文详细介绍了如何解析以太网报文，并针对不同类型的以太网帧进行处理，包括IP协议帧和ARP协议帧。通过解析以太网头部，获取源和目标MAC地址，并根据不同类型的帧调用相应的处理函数。

#ifndef ETHER_HPP
#define ETHER_HPP
#include <iostream>
#include <string>
#include <netinet/ether.h>
#include "ip.hpp"
#include "arp.hpp"

void del_ether(u_char *args, const struct pcap_pkthdr* ptr_header, const u_char* ptr_packet)
{
//only 10Mb/s ether
const struct ether_header* ptr_ethernet = NULL;
const struct ip* ptr_ip;

ptr_ethernet = (struct ether_header*)ptr_packet;
if (ptr_ethernet != NULL)
{
    std::string dest_mac_addr(ether_ntoa((const ether_addr*)ptr_ethernet->ether_dhost));
    std::string src_mac_addr(ether_ntoa((const ether_addr*)ptr_ethernet->ether_shost));
    std::cout<<src_mac_addr<<_("---->")<<dest_mac_addr<<std::endl;
    std::string protocol;
    switch (ntohs(ptr_ethernet->ether_type))
    {
       case ETHERTYPE_IP://[RFC791]
    //ptr_ip = (struct ip*)(ptr_ethernet+sizeof(struct ether_header));is error,i donot know why?
    //ptr_ip = (struct ip*)(ptr_packet+sizeof(struct ether_header));
          del_ip(ptr_packet, sizeof(struct ether_header));
          protocol = _("IP");
          break;
       case ETHERTYPE_ARP://[RFC826]
    del_arp(ptr_packet, sizeof(struct ether_header));
    protocol = _("ARP");
          break;
       case ETHERTYPE_REVARP:
    del_rarp(ptr_packet, sizeof(struct ether_header));
    protocol = _("RARP");
          break;
       case ETHERTYPE_PUP:
    protocol = _("Xerox PUP");
          break;
       default:
    protocol = _("undefined protocol");
          break;
     }
    std::cout<<_("protocol: ")<<protocol<<std::endl;
}
}
#endif