Examples/PcapSearch/main.cpp
/**
 * Searches all packet in a given pcap file for a certain search criteria. Returns how many packets matched the search criteria
 */
Searches all packet in a given pcap file for a certain search criteria. Returns how many packets matched the search criteria
Searches all packet in a given pcap file for a certain search criteria . Returns how many packets matched the search criteria
int searchPcap(std::string pcapFilePath, std::string searchCriteria, std::ofstream* detailedReportFile)
{
	pcpp::IFileReaderDevice* reader = pcpp::IFileReaderDevice::getReader(pcapFilePath);
	if (!reader->open())
	{
		if (detailedReportFile != NULL)
		{
			(*detailedReportFile) << "File '" << pcapFilePath << "':" << std::endl;
			(*detailedReportFile) << "    ";
			(*detailedReportFile) << pcpp::Logger::getInstance().getLastError() << std::endl;
		}
		delete reader;
		return 0;
	}
	if (!reader->setFilter(searchCriteria))
	{
		delete reader;
		return 0;
	}
	if (detailedReportFile != NULL)
	{
		(*detailedReportFile) << "File '" << pcapFilePath << "':" << std::endl;
	}
	int packetCount = 0;
	pcpp::RawPacket rawPacket;
	while (reader->getNextPacket(rawPacket))
	{
		if (detailedReportFile != NULL)
		{
			pcpp::Packet parsedPacket(&rawPacket);
			std::vector<std::string> packetLayers;
			parsedPacket.toStringList(packetLayers);
			for (std::vector<std::string>::iterator iter = packetLayers.begin(); iter != packetLayers.end(); iter++)
				(*detailedReportFile) << "\n    " << (*iter);
			(*detailedReportFile) << std::endl;
		}
		packetCount++;
	}
	reader->close();
	if (detailedReportFile != NULL)
	{
		if (packetCount > 0)
			(*detailedReportFile) << "\n";
		(*detailedReportFile) << "    ----> Found " << packetCount << " packets" << std::endl << std::endl;
	}
	delete reader;
	return packetCount;
}
int searchPcap ( std :: string pcapFilePath , std :: string searchCriteria , std :: ofstream * detailedReportFile ) { pcpp :: IFileReaderDevice * reader = pcpp :: IFileReaderDevice :: getReader ( pcapFilePath ) ; if ( ! reader -> open ( ) ) { if ( detailedReportFile != NULL ) { ( * detailedReportFile ) << " " << pcapFilePath << " " << std :: endl ; ( * detailedReportFile ) << " " ; ( * detailedReportFile ) << pcpp :: Logger :: getInstance ( ) . getLastError ( ) << std :: endl ; } delete reader ; return 0 ; } if ( ! reader -> setFilter ( searchCriteria ) ) { delete reader ; return 0 ; } if ( detailedReportFile != NULL ) { ( * detailedReportFile ) << " " << pcapFilePath << " " << std :: endl ; } int packetCount = 0 ; pcpp :: RawPacket rawPacket ; while ( reader -> getNextPacket ( rawPacket ) ) { if ( detailedReportFile != NULL ) { pcpp :: Packet parsedPacket ( & rawPacket ) ; std :: vector < std :: string > packetLayers ; parsedPacket . toStringList ( packetLayers ) ; for ( std :: vector < std :: string > :: iterator iter = packetLayers . begin ( ) ; iter != packetLayers . end ( ) ; iter ++ ) ( * detailedReportFile ) << " \n " << ( * iter ) ; ( * detailedReportFile ) << std :: endl ; } packetCount ++ ; } reader -> close ( ) ; if ( detailedReportFile != NULL ) { if ( packetCount > 0 ) ( * detailedReportFile ) << " \n " ; ( * detailedReportFile ) << " " << packetCount << " " << std :: endl << std :: endl ; } delete reader ; return packetCount ; }
Searches all packet in a given pcap file for a certain search criteria.
Searches all packet in a given pcap file for a certain search criteria .
// create the pcap/pcap-ng reader
 // if the reader fails to open
 // PcapPlusPlus logger saves the last internal error. Write this error to the report file
 // free the reader memory and return
 // set the filter for the file so only packets that match the search criteria will be read
 // free the reader memory and return
 // read packets from the file. Since we already set the filter, only packets that matches the filter will be read
 // if a detailed report is required, parse the packet and print it to the report file
 // parse the packet
 // print layer by layer by layer as we want to add a few spaces before each layer
 // count the packet read
 // close the reader file
 // finalize the report
 // free the reader memory
 // return how many packets matched the search criteria
