/// <summary> /// Constructor /// </summary> /// <param name="linkLayerType"> /// A <see cref="PacketDotNet.LinkLayers"/> /// </param> /// <param name="snapshotLength"> /// A <see cref="System.Nullable<System.Int32>"/> /// </param> /// <param name="captureFilename"> /// A <see cref="System.String"/> /// </param> /// <param name="mode"> /// A <see cref="FileMode"/> /// </param> public CaptureFileWriterDevice(PacketDotNet.LinkLayers linkLayerType, int?snapshotLength, string captureFilename, FileMode mode) { m_pcapFile = captureFilename; // append isn't possible without some difficulty and not implemented yet if (mode == FileMode.Append) { throw new System.InvalidOperationException("FileMode.Append is not supported, please contact the developers if you are interested in helping to implementing it"); } if (!snapshotLength.HasValue) { snapshotLength = Pcap.MAX_PACKET_SIZE; } else if (snapshotLength > Pcap.MAX_PACKET_SIZE) { throw new System.InvalidOperationException("snapshotLength > Pcap.MAX_PACKET_SIZE"); } // set the device handle PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)linkLayerType, snapshotLength.Value); m_pcapDumpHandle = LibPcapSafeNativeMethods.pcap_dump_open(PcapHandle, captureFilename); if (m_pcapDumpHandle == IntPtr.Zero) { throw new PcapException("Error opening dump file '" + LastError + "'"); } }
/// <summary> /// Open the device /// </summary> public override void Open(DeviceConfiguration configuration) { // set the device handle var has_open_dead_with_tstamp_precision_support = Pcap.LibpcapVersion >= new Version(1, 5, 1); var resolution = configuration.TimestampResolution ?? TimestampResolution.Microsecond; if (has_open_dead_with_tstamp_precision_support) { PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead_with_tstamp_precision((int)configuration.LinkLayerType, configuration.Snaplen, (uint)resolution); } else { if (resolution != TimestampResolution.Microsecond) { configuration.RaiseConfigurationFailed( nameof(configuration.TimestampResolution), (int)PcapError.PlatformNotSupported, "pcap version is < 1.5.1, needs pcap_open_dead_with_tstamp_precision()" ); } PcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)configuration.LinkLayerType, configuration.Snaplen); } m_pcapDumpHandle = LibPcapSafeNativeMethods.pcap_dump_open(PcapHandle, m_pcapFile); if (m_pcapDumpHandle == IntPtr.Zero) { throw new PcapException("Error opening dump file '" + LastError + "'"); } Active = true; }
public static BpfProgram Create(LinkLayers linktype, string filter, int optimize = 1, uint netmask = 0) { using (var handle = LibPcapSafeNativeMethods.pcap_open_dead((int)linktype, Pcap.MAX_PACKET_SIZE)) { return(Create(handle, filter, optimize, netmask)); } }
private static bool GetIsHardwareAccelerated() { using (var handle = LibPcapSafeNativeMethods.pcap_open_dead(1, 60)) { try { pcap_send_queue queue = default; LibPcapSafeNativeMethods.pcap_sendqueue_transmit(handle, ref queue, 0); return(true); } catch (TypeLoadException) { // Function pcap_sendqueue_transmit not found return(false); } } }
/// <summary> /// Returns true if the filter expression was able to be compiled into a /// program without errors /// </summary> public static bool CheckFilter(string filterExpression, out string errorString) { IntPtr fakePcap = LibPcapSafeNativeMethods.pcap_open_dead((int)PacketDotNet.LinkLayers.Ethernet, Pcap.MAX_PACKET_SIZE); uint mask = 0; if (!CompileFilter(fakePcap, filterExpression, mask, out IntPtr bpfProgram, out errorString)) { LibPcapSafeNativeMethods.pcap_close(fakePcap); return(false); } FreeBpfProgram(bpfProgram); LibPcapSafeNativeMethods.pcap_close(fakePcap); return(true); }
/// <summary> /// Returns true if the filter expression was able to be compiled into a /// program without errors /// </summary> public static bool CheckFilter(string filterExpression, out string errorString) { errorString = null; using (var pcapHandle = LibPcapSafeNativeMethods.pcap_open_dead((int)PacketDotNet.LinkLayers.Ethernet, Pcap.MAX_PACKET_SIZE)) { var bpfProgram = BpfProgram.TryCreate(pcapHandle, filterExpression); if (bpfProgram == null) { errorString = GetLastError(pcapHandle); return(false); } else { bpfProgram.Dispose(); return(true); } } }