WinPcap写的在smtp端口抓email包的程序

#define HAVE_REMOTE #include "pcap.h" #include <stdio.h> #pragma comment( lib, "wpcap.lib" ) void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data); int main(int argc, char *argv[]) { pcap_if_t *alldevs; pcap_if_t *d; pcap_t *ad_handle; int inum; int i=0; char errbuf[PCAP_ERRBUF_SIZE]; char filter_app[] = "port 465"; //the port of my email on thunderbird struct bpf_program filter; //The compiled filter expression if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1) { fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf); exit(1); } for(d=alldevs; d; d=d->next) { printf("%d. %s", ++i, d->name); if (d->description) printf("(%s)\n", d->description); else printf(" (No description available)\n"); } if(i==0) { printf("\nNo interfaces found! Install your WinPcap,:).\n"); return -1; } printf("Enter the interface number (only1xD-%d):",i); scanf("%d", &inum); if(inum<1||inum>i) { printf("\nInterface number is out of range.\n"); pcap_freealldevs(alldevs); return -1; } for(d=alldevs, i=0; i<inum-1; d=d->next, i++); if( (ad_handle=pcap_open(d->name,65536,PCAP_OPENFLAG_PROMISCUOUS,1000,NULL,errbuf))==NULL) { fprintf(stderr,"\nUnbale to open the adapter. %s is not supported by WinPcap\n", d->name); pcap_freealldevs(alldevs); return -1; } pcap_compile(ad_handle, &filter, filter_app, 0, NULL); //because I have my own unique cable, so "NULL"ip address==my ip address pcap_setfilter(ad_handle, &filter); printf("\nlistening on %s...\n", d->description); pcap_freealldevs(alldevs); pcap_loop(ad_handle, 0, packet_handler, NULL); return 0; } //the main function implements capturing the email packs and print their lengths void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data) { struct tm *ltime; char timestr[16]; time_t local_tv_sec; //change the timestamp to the form we can understand local_tv_sec = header->ts.tv_sec; ltime=localtime(&local_tv_sec); strftime( timestr, sizeof timestr, "%H:%M:%S", ltime); printf("%s,%.6d packlength:%d\n", timestr, header->ts.tv_usec, header->len); }