MAC OS X 下怎么安装 libpcap？

[FireCat]

我 sudo ./configure;sudo make;sudo make install;后
运行测试程序。

#include<stdio.h>
#include<pcap.h>
#include<string>
using namespace std;
static const unsigned int ETHER_ADDR_LEN = 6;
void call_back(u_char * args, const struct pcap_pkthdr * header, const u_char * packet);
string generate_mac_address(char macChars[ETHER_ADDR_LEN]);
int main(){
    pcap_t * handle; // Sesion handle
    char dev[] = "eth2";  //device to sniff on
    char errbuf[PCAP_ERRBUF_SIZE]; // error string
    char filter_exp[] = "";  //filter expression
    bpf_u_int32 mask;  //The netmask of our sniffing device
    bpf_u_int32 net;   //The IP of our sniffing device
    struct bpf_program fp;  //the compiled filter expression
    //查询 device 的 mask 和 ip
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1){
        fprintf(stderr, "Can't get netmask for device %s\n", dev);
        net = 0;
        mask = 0;
        }
    handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
    if(handle == NULL){
        fprintf(stderr, "Can't open device %s\n", dev);
        return 2;
        }
    // before apply filter exp, compile it
    if(pcap_compile(handle, &fp, filter_exp, 0, net) == -1){
        fprintf(stderr, "can't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 2;
        }
    //apply filter to this session
    if(pcap_setfilter(handle, &fp) == -1){
        fprintf(stderr, "can't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 2;
        }
    // now the device is prepared to sniff under the filter condition
    struct pcap_pkthdr header; // packet header struct
    const u_char * packet;  // actual packet
    //5 表示积累 5 个包 pcap_loop 才返回，但每个包都会调一次 call_back
    while(!pcap_loop(handle, 5, call_back, NULL)){
        printf("-------\n");  //每 8 行才会输出一次这个
        }
    pcap_close(handle);
    }
struct sniff_ethernet {
    char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
    char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
    u_short ether_type; /* IP? ARP? RARP? etc */
    };
// call_back function 的统一原型
void call_back(u_char * args, const struct pcap_pkthdr * header, const u_char * packet){
    static int count = 0;
    struct sniff_ethernet * ethernet;  //ethernet header
    ethernet = (struct sniff_ethernet*)(packet);  
    //把 6 字节的字符串转换成 mac 地址的表示形式
    std::string source_mac_address = generate_mac_address(ethernet->ether_shost);
    std::string dst_mac_address = generate_mac_address(ethernet->ether_dhost);  
    printf("wy: call_back called %d,  %s->%s,   packet length:%d\n", count++, source_mac_address.c_str(), dst_mac_address.c_str(),  header->len);
    }
//由字节为单位字符串生成 mac 地址， 16 进制数的字串
    string generate_mac_address(char macChars[ETHER_ADDR_LEN]){
    string macAddr;
    char temp[2];
    for(int i = 0; i < ETHER_ADDR_LEN; i++){
        //把一个字节转化成 16 进制表示形式
        sprintf(temp, "%x", macChars[i]);
        if(i != 0){
            macAddr.append(":");
            }
        macAddr.append(temp, 2);
        }
    return macAddr;
}

报了好多链接错误。

"_pcap_close", referenced from:
_main in main.o
"_pcap_compile", referenced from:
_main in main.o
"_pcap_geterr", referenced from:
_main in main.o
"_pcap_lookupnet", referenced from:
_main in main.o
"_pcap_loop", referenced from:
_main in main.o
"_pcap_open_live", referenced from:
_main in main.o
"_pcap_setfilter", referenced from:
_main in main.o