pcap-remote.h File Reference

#include "pcap.h"
#include "sockutils.h"

Go to the source code of this file.

Data Structures

struct activehosts

Keeps a list of all the opened connections in the active mode. More...

struct rpcap_header

Common header for all the RPCAP messages. More...

struct rpcap_findalldevs_if

Format of the message for the interface description (findalldevs command). More...

struct rpcap_findalldevs_ifaddr

Format of the message for the address listing (findalldevs command). More...

struct rpcap_openreply

Format of the message of the connection opening reply (open command). More...

struct rpcap_startcapreq

Format of the message that starts a remote capture (startcap command). More...

struct rpcap_startcapreply

Format of the reply message that devoted to start a remote capture (startcap reply command). More...

struct rpcap_pkthdr

Format of the header which encapsulates captured packets when transmitted on the network. More...

struct rpcap_filter

General header used for the pcap_setfilter() command; keeps just the number of BPF instructions. More...

struct rpcap_filterbpf_insn

Structure that keeps a single BPF instuction; it is repeated 'ninsn' times according to the 'rpcap_filterbpf' header. More...

struct rpcap_auth

Structure that keeps the data required for the authentication on the remote host. More...

struct rpcap_stats

Structure that keeps the statistics about the number of packets captured, dropped, etc. More...

struct rpcap_sampling

Structure that is needed to set sampling parameters. More...

Defines

#define RPCAP_DEFAULT_NETPORT   "2002" /*!< Default port on which the RPCAP daemon is waiting for connections. */

#define RPCAP_DEFAULT_NETPORT_ACTIVE   "2003"

#define RPCAP_DEFAULT_NETADDR   "" /*!< Default network address on which the RPCAP daemon binds to. */

#define RPCAP_VERSION   0 /*!< Present version of the RPCAP protocol (0 = Experimental). */

#define RPCAP_TIMEOUT_INIT   90 /*!< Initial timeout for RPCAP connections (default: 90 sec) */

#define RPCAP_TIMEOUT_RUNTIME   180 /*!< Run-time timeout for RPCAP connections (default: 3 min) */

#define RPCAP_ACTIVE_WAIT   30 /*!< Waiting time betweek two attempts to open a connection, in active mode (default: 30 sec) */

#define RPCAP_SUSPEND_WRONGAUTH   1 /*!< If the authentication is wrong, stops 1 sec before accepting a new auth message */

#define RPCAP_NETBUF_SIZE   64000

Buffer used by socket functions to send-receive packets. In case you plan to have messages larger than this value, you have to increase it.

#define RPCAP_HOSTLIST_SEP   " ,;\n\r"

Separators used for the host list.

#define RPCAP_MSG_ERROR   1 /*!< Message that keeps an error notification */

#define RPCAP_MSG_FINDALLIF_REQ   2 /*!< Request to list all the remote interfaces */

#define RPCAP_MSG_OPEN_REQ   3 /*!< Request to open a remote device */

#define RPCAP_MSG_STARTCAP_REQ   4 /*!< Request to start a capture on a remote device */

#define RPCAP_MSG_UPDATEFILTER_REQ   5 /*!< Send a compiled filter into the remote device */

#define RPCAP_MSG_CLOSE   6 /*!< Close the connection with the remote peer */

#define RPCAP_MSG_PACKET   7 /*!< This is a 'data' message, which carries a network packet */

#define RPCAP_MSG_AUTH_REQ   8 /*!< Message that keeps the authentication parameters */

#define RPCAP_MSG_STATS_REQ   9 /*!< It requires to have network statistics */

#define RPCAP_MSG_ENDCAP_REQ   10 /*!< Stops the current capture, keeping the device open */

#define RPCAP_MSG_SETSAMPLING_REQ   11 /*!< Sset sampling parameters */

#define RPCAP_MSG_FINDALLIF_REPLY   (128+RPCAP_MSG_FINDALLIF_REQ) /*!< Keeps the list of all the remote interfaces */

#define RPCAP_MSG_OPEN_REPLY   (128+RPCAP_MSG_OPEN_REQ) /*!< The remote device has been opened correctly */

#define RPCAP_MSG_STARTCAP_REPLY   (128+RPCAP_MSG_STARTCAP_REQ) /*!< The capture is staarting correctly */

#define RPCAP_MSG_UPDATEFILTER_REPLY   (128+RPCAP_MSG_UPDATEFILTER_REQ) /*!< The filter has been applied correctly on the remote device */

#define RPCAP_MSG_AUTH_REPLY   (128+RPCAP_MSG_AUTH_REQ) /*!< Sends a message that says 'ok, authorization successful' */

#define RPCAP_MSG_STATS_REPLY   (128+RPCAP_MSG_STATS_REQ) /*!< Message that keeps the network statistics */

#define RPCAP_MSG_ENDCAP_REPLY   (128+RPCAP_MSG_ENDCAP_REQ) /*!< Confirms that the capture stopped succesfully */

#define RPCAP_MSG_SETSAMPLING_REPLY   (128+RPCAP_MSG_SETSAMPLING_REQ) /*!< Confirms that the capture stopped succesfully */

#define RPCAP_STARTCAPREQ_FLAG_PROMISC   1 /*!< Enables promiscuous mode (default: disabled) */

#define RPCAP_STARTCAPREQ_FLAG_DGRAM   2 /*!< Use a datagram (i.e. UDP) connection for the data stream (default: use TCP)*/

#define RPCAP_STARTCAPREQ_FLAG_SERVEROPEN   4 /*!< The server has to open the data connection toward the client */

#define RPCAP_STARTCAPREQ_FLAG_INBOUND   8 /*!< Capture only inbound packets (take care: the flag has no effects with promiscuous enabled) */

#define RPCAP_STARTCAPREQ_FLAG_OUTBOUND   16 /*!< Capture only outbound packets (take care: the flag has no effects with promiscuous enabled) */

#define RPCAP_UPDATEFILTER_BPF   1 /*!< This code tells us that the filter is encoded with the BPF/NPF syntax */

#define PCAP_ERR_NETW   1 /*!< Network error */

#define PCAP_ERR_INITTIMEOUT   2 /*!< The RPCAP initial timeout has expired */

#define PCAP_ERR_AUTH   3 /*!< Generic authentication error */

#define PCAP_ERR_FINDALLIF   4 /*!< Generic findalldevs error */

#define PCAP_ERR_NOREMOTEIF   5 /*!< The findalldevs was ok, but the remote end had no interfaces to list */

#define PCAP_ERR_OPEN   6 /*!< Generic pcap_open error */

#define PCAP_ERR_UPDATEFILTER   7 /*!< Generic updatefilter error */

#define PCAP_ERR_GETSTATS   8 /*!< Generic pcap_stats error */

#define PCAP_ERR_READEX   9 /*!< Generic pcap_next_ex error */

#define PCAP_ERR_HOSTNOAUTH   10 /*!< The host is not authorized to connect to this server */

#define PCAP_ERR_REMOTEACCEPT   11 /*!< Generic pcap_remoteaccept error */

#define PCAP_ERR_STARTCAPTURE   12 /*!< Generic pcap_startcapture error */

#define PCAP_ERR_ENDCAPTURE   13 /*!< Generic pcap_endcapture error */

#define PCAP_ERR_RUNTIMETIMEOUT   14 /*!< The RPCAP run-time timeout has expired */

#define PCAP_ERR_SETSAMPLING   15 /*!< Error diring the settings of sampling parameters */

#define PCAP_ERR_WRONGMSG   16 /*!< The other end endpoint sent a message which has not been recognized */

#define PCAP_ERR_WRONGVER   17 /*!< The other end endpoint ahs a version number that is not compatible with our */

Typedefs

typedef unsigned char uint8

Provides an 8-bits unsigned integer.

typedef unsigned short uint16

Provides a 16-bits unsigned integer.

typedef unsigned int uint32

Provides a 32-bits unsigned integer.

typedef int int32

Provides a 32-bits integer.

Functions

pcap_t * pcap_opensource_remote (const char *source, struct pcap_rmtauth *auth, char *errbuf)

int pcap_startcapture_remote (pcap_t *fp)

int pcap_read_nocb_remote (pcap_t *p, struct pcap_pkthdr **pkt_header, u_char **pkt_data)

int pcap_read_remote (pcap_t *p, int cnt, pcap_handler callback, u_char *user)

int pcap_updatefilter_remote (pcap_t *fp, struct bpf_program *prog)

int pcap_setfilter_remote (pcap_t *fp, struct bpf_program *prog)

int pcap_stats_remote (pcap_t *p, struct pcap_stat *ps)

int pcap_setsampling_remote (pcap_t *p)

pcap_stat * pcap_stats_ex_remote (pcap_t *p)

void pcap_close_remote (pcap_t *p)

void rpcap_createhdr (struct rpcap_header *header, uint8 type, uint16 value, uint32 length)

int rpcap_deseraddr (struct sockaddr_storage *sockaddrin, struct sockaddr_storage **sockaddrout, char *errbuf)

int rpcap_checkmsg (char *errbuf, SOCKET sock, struct rpcap_header *header, uint8 first,...)

int rpcap_senderror (SOCKET sock, char *error, unsigned short errcode, char *errbuf)

int rpcap_sendauth (SOCKET sock, struct pcap_rmtauth *auth, char *errbuf)

int rpcap_remoteact_getsock (const char *host, char *errbuf)

Detailed Description

This file keeps all the new definitions and typedefs that are exported to the user and that are needed for the RPCAP protocol.

Warning:

All the RPCAP functions that are allowed to return a buffer containing the error description can return max PCAP_ERRBUF_SIZE characters. However there is no guarantees that the string will be zero-terminated. Best practice is to define the errbuf variable as a char of size 'PCAP_ERRBUF_SIZE+1' and to insert manually the termination char at the end of the buffer. This will guarantee that no buffer overflows occur even if we use the printf() to show the error on the screen.

This file declares some typedefs that MUST be of a specific size. These definitions (i.e. typedefs) could need to be changed on other platforms than Intel IA32.

This file defines some structures that are used to transfer data on the network. Be careful that you compiler MUST not insert padding into these structures for better alignment. These structures have been created in order to be correctly aligned to a 32 bits boundary, but be careful in any case.

Definition in file pcap-remote.h.

Function Documentation

void pcap_close_remote ( pcap_t * p )

pcap_t* pcap_opensource_remote ( const char * source,

struct pcap_rmtauth * auth,

char * errbuf

)

int pcap_read_nocb_remote ( pcap_t * p,

struct pcap_pkthdr ** pkt_header,

u_char ** pkt_data

)

int pcap_read_remote ( pcap_t * p,

int cnt,

pcap_handler callback,

u_char * user

)

int pcap_setfilter_remote ( pcap_t * fp,

struct bpf_program * prog

)

int pcap_setsampling_remote ( pcap_t * p )

int pcap_startcapture_remote ( pcap_t * fp )

struct pcap_stat* pcap_stats_ex_remote ( pcap_t * p )

int pcap_stats_remote ( pcap_t * p,

struct pcap_stat * ps

)

int pcap_updatefilter_remote ( pcap_t * fp,

struct bpf_program * prog

)

int rpcap_checkmsg ( char * errbuf,

SOCKET sock,

struct rpcap_header * header,

uint8 first,

...

)

void rpcap_createhdr ( struct rpcap_header * header,

uint8 type,

uint16 value,

uint32 length

)

int rpcap_deseraddr ( struct sockaddr_storage * sockaddrin,

struct sockaddr_storage ** sockaddrout,

char * errbuf

)

int rpcap_remoteact_getsock ( const char * host,

char * errbuf

)

int rpcap_sendauth ( SOCKET sock,

struct pcap_rmtauth * auth,

char * errbuf

)

int rpcap_senderror ( SOCKET sock,

char * error,

unsigned short errcode,

char * errbuf

)


Data Structures
struct	activehosts
	Keeps a list of all the opened connections in the active mode. More...
struct	rpcap_header
	Common header for all the RPCAP messages. More...
struct	rpcap_findalldevs_if
	Format of the message for the interface description (findalldevs command). More...
struct	rpcap_findalldevs_ifaddr
	Format of the message for the address listing (findalldevs command). More...
struct	rpcap_openreply
	Format of the message of the connection opening reply (open command). More...
struct	rpcap_startcapreq
	Format of the message that starts a remote capture (startcap command). More...
struct	rpcap_startcapreply
	Format of the reply message that devoted to start a remote capture (startcap reply command). More...
struct	rpcap_pkthdr
	Format of the header which encapsulates captured packets when transmitted on the network. More...
struct	rpcap_filter
	General header used for the pcap_setfilter() command; keeps just the number of BPF instructions. More...
struct	rpcap_filterbpf_insn
	Structure that keeps a single BPF instuction; it is repeated 'ninsn' times according to the 'rpcap_filterbpf' header. More...
struct	rpcap_auth
	Structure that keeps the data required for the authentication on the remote host. More...
struct	rpcap_stats
	Structure that keeps the statistics about the number of packets captured, dropped, etc. More...
struct	rpcap_sampling
	Structure that is needed to set sampling parameters. More...
Defines
#define	RPCAP_DEFAULT_NETPORT "2002" /!< Default port on which the RPCAP daemon is waiting for connections. /
#define	RPCAP_DEFAULT_NETPORT_ACTIVE "2003"
#define	RPCAP_DEFAULT_NETADDR "" /!< Default network address on which the RPCAP daemon binds to. /
#define	RPCAP_VERSION 0 /!< Present version of the RPCAP protocol (0 = Experimental). /
#define	RPCAP_TIMEOUT_INIT 90 /!< Initial timeout for RPCAP connections (default: 90 sec) /
#define	RPCAP_TIMEOUT_RUNTIME 180 /!< Run-time timeout for RPCAP connections (default: 3 min) /
#define	RPCAP_ACTIVE_WAIT 30 /!< Waiting time betweek two attempts to open a connection, in active mode (default: 30 sec) /
#define	RPCAP_SUSPEND_WRONGAUTH 1 /!< If the authentication is wrong, stops 1 sec before accepting a new auth message /
#define	RPCAP_NETBUF_SIZE 64000
	Buffer used by socket functions to send-receive packets. In case you plan to have messages larger than this value, you have to increase it.
#define	RPCAP_HOSTLIST_SEP " ,;\n\r"
	Separators used for the host list.
#define	RPCAP_MSG_ERROR 1 /!< Message that keeps an error notification /
#define	RPCAP_MSG_FINDALLIF_REQ 2 /!< Request to list all the remote interfaces /
#define	RPCAP_MSG_OPEN_REQ 3 /!< Request to open a remote device /
#define	RPCAP_MSG_STARTCAP_REQ 4 /!< Request to start a capture on a remote device /
#define	RPCAP_MSG_UPDATEFILTER_REQ 5 /!< Send a compiled filter into the remote device /
#define	RPCAP_MSG_CLOSE 6 /!< Close the connection with the remote peer /
#define	RPCAP_MSG_PACKET 7 /!< This is a 'data' message, which carries a network packet /
#define	RPCAP_MSG_AUTH_REQ 8 /!< Message that keeps the authentication parameters /
#define	RPCAP_MSG_STATS_REQ 9 /!< It requires to have network statistics /
#define	RPCAP_MSG_ENDCAP_REQ 10 /!< Stops the current capture, keeping the device open /
#define	RPCAP_MSG_SETSAMPLING_REQ 11 /!< Sset sampling parameters /
#define	RPCAP_MSG_FINDALLIF_REPLY (128+RPCAP_MSG_FINDALLIF_REQ) /!< Keeps the list of all the remote interfaces /
#define	RPCAP_MSG_OPEN_REPLY (128+RPCAP_MSG_OPEN_REQ) /!< The remote device has been opened correctly /
#define	RPCAP_MSG_STARTCAP_REPLY (128+RPCAP_MSG_STARTCAP_REQ) /!< The capture is staarting correctly /
#define	RPCAP_MSG_UPDATEFILTER_REPLY (128+RPCAP_MSG_UPDATEFILTER_REQ) /!< The filter has been applied correctly on the remote device /
#define	RPCAP_MSG_AUTH_REPLY (128+RPCAP_MSG_AUTH_REQ) /!< Sends a message that says 'ok, authorization successful' /
#define	RPCAP_MSG_STATS_REPLY (128+RPCAP_MSG_STATS_REQ) /!< Message that keeps the network statistics /
#define	RPCAP_MSG_ENDCAP_REPLY (128+RPCAP_MSG_ENDCAP_REQ) /!< Confirms that the capture stopped succesfully /
#define	RPCAP_MSG_SETSAMPLING_REPLY (128+RPCAP_MSG_SETSAMPLING_REQ) /!< Confirms that the capture stopped succesfully /
#define	RPCAP_STARTCAPREQ_FLAG_PROMISC 1 /!< Enables promiscuous mode (default: disabled) /
#define	RPCAP_STARTCAPREQ_FLAG_DGRAM 2 /!< Use a datagram (i.e. UDP) connection for the data stream (default: use TCP)/
#define	RPCAP_STARTCAPREQ_FLAG_SERVEROPEN 4 /!< The server has to open the data connection toward the client /
#define	RPCAP_STARTCAPREQ_FLAG_INBOUND 8 /!< Capture only inbound packets (take care: the flag has no effects with promiscuous enabled) /
#define	RPCAP_STARTCAPREQ_FLAG_OUTBOUND 16 /!< Capture only outbound packets (take care: the flag has no effects with promiscuous enabled) /
#define	RPCAP_UPDATEFILTER_BPF 1 /!< This code tells us that the filter is encoded with the BPF/NPF syntax /
#define	PCAP_ERR_NETW 1 /!< Network error /
#define	PCAP_ERR_INITTIMEOUT 2 /!< The RPCAP initial timeout has expired /
#define	PCAP_ERR_AUTH 3 /!< Generic authentication error /
#define	PCAP_ERR_FINDALLIF 4 /!< Generic findalldevs error /
#define	PCAP_ERR_NOREMOTEIF 5 /!< The findalldevs was ok, but the remote end had no interfaces to list /
#define	PCAP_ERR_OPEN 6 /!< Generic pcap_open error /
#define	PCAP_ERR_UPDATEFILTER 7 /!< Generic updatefilter error /
#define	PCAP_ERR_GETSTATS 8 /!< Generic pcap_stats error /
#define	PCAP_ERR_READEX 9 /!< Generic pcap_next_ex error /
#define	PCAP_ERR_HOSTNOAUTH 10 /!< The host is not authorized to connect to this server /
#define	PCAP_ERR_REMOTEACCEPT 11 /!< Generic pcap_remoteaccept error /
#define	PCAP_ERR_STARTCAPTURE 12 /!< Generic pcap_startcapture error /
#define	PCAP_ERR_ENDCAPTURE 13 /!< Generic pcap_endcapture error /
#define	PCAP_ERR_RUNTIMETIMEOUT 14 /!< The RPCAP run-time timeout has expired /
#define	PCAP_ERR_SETSAMPLING 15 /!< Error diring the settings of sampling parameters /
#define	PCAP_ERR_WRONGMSG 16 /!< The other end endpoint sent a message which has not been recognized /
#define	PCAP_ERR_WRONGVER 17 /!< The other end endpoint ahs a version number that is not compatible with our /
Typedefs
typedef unsigned char	uint8
	Provides an 8-bits unsigned integer.
typedef unsigned short	uint16
	Provides a 16-bits unsigned integer.
typedef unsigned int	uint32
	Provides a 32-bits unsigned integer.
typedef int	int32
	Provides a 32-bits integer.
Functions
pcap_t *	pcap_opensource_remote (const char source, struct pcap_rmtauth auth, char *errbuf)
int	pcap_startcapture_remote (pcap_t *fp)
int	pcap_read_nocb_remote (pcap_t p, struct pcap_pkthdr pkt_header, u_char *pkt_data)
int	pcap_read_remote (pcap_t p, int cnt, pcap_handler callback, u_char user)
int	pcap_updatefilter_remote (pcap_t fp, struct bpf_program prog)
int	pcap_setfilter_remote (pcap_t fp, struct bpf_program prog)
int	pcap_stats_remote (pcap_t p, struct pcap_stat ps)
int	pcap_setsampling_remote (pcap_t *p)
pcap_stat *	pcap_stats_ex_remote (pcap_t *p)
void	pcap_close_remote (pcap_t *p)
void	rpcap_createhdr (struct rpcap_header *header, uint8 type, uint16 value, uint32 length)
int	rpcap_deseraddr (struct sockaddr_storage sockaddrin, struct sockaddr_storage sockaddrout, char errbuf)
int	rpcap_checkmsg (char errbuf, SOCKET sock, struct rpcap_header header, uint8 first,...)
int	rpcap_senderror (SOCKET sock, char error, unsigned short errcode, char errbuf)
int	rpcap_sendauth (SOCKET sock, struct pcap_rmtauth auth, char errbuf)
int	rpcap_remoteact_getsock (const char host, char errbuf)