66#include < functional>
77
88#include " IpAddress.h"
9+ #include " Device.h"
910#include " PcapDevice.h"
1011
1112// forward declarations for structs and typedefs that are defined in pcap.h
1213struct pcap_if ;
1314typedef pcap_if pcap_if_t ;
14- struct pcap_addr ;
15- typedef struct pcap_addr pcap_addr_t ;
15+ struct pcap ;
16+ typedef pcap pcap_t ;
17+ struct pcap_pkthdr ;
1618
1719// / @file
1820
1921// / @namespace pcpp
2022// / @brief The main namespace for the PcapPlusPlus lib
2123namespace pcpp
2224{
25+ namespace internal
26+ {
27+ // / @class PcapHandle
28+ // / @brief A wrapper class for pcap_t* which is the libpcap packet capture descriptor.
29+ // / This class is used to manage the lifecycle of the pcap_t* object
30+ class PcapHandle
31+ {
32+ public:
33+ // / @brief Creates an empty handle.
34+ constexpr PcapHandle () noexcept = default;
35+ // / @brief Creates a handle from the provided pcap descriptor.
36+ // / @param pcapDescriptor The pcap descriptor to wrap.
37+ explicit PcapHandle (pcap_t * pcapDescriptor) noexcept ;
38+
39+ PcapHandle (const PcapHandle&) = delete ;
40+ PcapHandle (PcapHandle&& other) noexcept ;
41+
42+ PcapHandle& operator =(const PcapHandle&) = delete ;
43+ PcapHandle& operator =(PcapHandle&& other) noexcept ;
44+ PcapHandle& operator =(std::nullptr_t ) noexcept ;
45+
46+ ~PcapHandle ();
47+
48+ // / @return True if the handle is not null, false otherwise.
49+ bool isValid () const noexcept
50+ {
51+ return m_PcapDescriptor != nullptr ;
52+ }
53+
54+ // / @return The underlying pcap descriptor.
55+ pcap_t * get () const noexcept
56+ {
57+ return m_PcapDescriptor;
58+ }
59+
60+ // / @brief Releases ownership of the handle and returns the pcap descriptor.
61+ // / @return The pcap descriptor or nullptr if no handle is owned.
62+ pcap_t * release () noexcept ;
63+
64+ // / @brief Replaces the managed handle with the provided one.
65+ // / @param pcapDescriptor A new pcap descriptor to manage.
66+ // / @remarks If the handle contains a non-null descriptor it will be closed.
67+ void reset (pcap_t * pcapDescriptor = nullptr ) noexcept ;
68+
69+ // / @brief Helper function to retrieve a view of the last error string for this handle.
70+ // / @return A null-terminated view of the last error string.
71+ // / @remarks The returned view is only valid until the next call to a pcap function.
72+ char const * getLastError () const noexcept ;
73+
74+ // / @brief Sets a filter on the handle. Only packets that match the filter will be captured by the handle.
75+ // /
76+ // / The filter uses Berkeley Packet Filter (BPF) syntax (http://biot.com/capstats/bpf.html).
77+ // /
78+ // / @param[in] filter The filter to set in Berkeley Packet Filter (BPF) syntax.
79+ // / @return True if the filter was set successfully, false otherwise.
80+ bool setFilter (std::string const & filter);
81+
82+ // / @brief Clears the filter currently set on the handle.
83+ // / @return True if the filter was removed successfully or if no filter was set, false otherwise.
84+ bool clearFilter ();
85+
86+ // / @brief Retrieves statistics from the pcap handle.
87+ // /
88+ // / The function internally calls pcap_stats() to retrieve the statistics and only works on live devices.
89+ // /
90+ // / @param stats Structure to store the statistics.
91+ // / @return True if the statistics were retrieved successfully, false otherwise.
92+ bool getStatistics (PcapStats& stats) const ;
93+
94+ // / @return True if the handle is not null, false otherwise.
95+ explicit operator bool () const noexcept
96+ {
97+ return isValid ();
98+ }
99+
100+ bool operator ==(std::nullptr_t ) const noexcept
101+ {
102+ return !isValid ();
103+ }
104+ bool operator !=(std::nullptr_t ) const noexcept
105+ {
106+ return isValid ();
107+ }
108+
109+ private:
110+ pcap_t * m_PcapDescriptor = nullptr ;
111+ };
112+ } // namespace internal
113+
23114 class PcapLiveDevice ;
24115
25116 // / A callback that is called when a packet is captured by PcapLiveDevice
@@ -39,7 +130,7 @@ namespace pcpp
39130 // / periodic stats collection
40131 // / @param[in] stats A reference to the most updated stats
41132 // / @param[in] userCookie A pointer to the object put by the user when packet capturing stared
42- using OnStatsUpdateCallback = std::function<void (IPcapDevice:: PcapStats&, void *)>;
133+ using OnStatsUpdateCallback = std::function<void (PcapStats&, void *)>;
43134
44135 // / @class PcapLiveDevice
45136 // / A class that wraps a network interface (each of the interfaces listed in ifconfig/ipconfig).
@@ -62,7 +153,7 @@ namespace pcpp
62153 // / by supplying a callback and a timeout to startCapture()
63154 // / - Send packets back to the network. Sending the packets is done on the caller thread. No additional threads are
64155 // / created for this task
65- class PcapLiveDevice : public IPcapDevice
156+ class PcapLiveDevice : public IFilterableDevice , public IPcapStatisticsProvider
66157 {
67158 friend class PcapLiveDeviceList ;
68159
@@ -83,6 +174,7 @@ namespace pcpp
83174 };
84175
85176 bool m_DeviceOpened = false ;
177+ internal::PcapHandle m_PcapDescriptor;
86178
87179 // This is a second descriptor for the same device. It is needed because of a bug
88180 // that occurs in libpcap on Linux (on Windows using WinPcap/Npcap it works well):
@@ -339,6 +431,11 @@ namespace pcpp
339431 // / this list from PcapLiveDevice as well
340432 const std::vector<IPv4Address>& getDnsServers () const ;
341433
434+ // / A static method for retrieving pcap lib (libpcap/WinPcap/etc.) version information. This method is actually
435+ // / a wrapper for [pcap_lib_version()](https://www.tcpdump.org/manpages/pcap_lib_version.3pcap.html)
436+ // / @return A string containing the pcap lib version information
437+ static std::string getPcapLibVersionInfo ();
438+
342439 // / Start capturing packets on this network interface (device). Each time a packet is captured the
343440 // / onPacketArrives callback is called. The capture is done on a new thread created by this method, meaning all
344441 // / callback calls are done in a thread other than the caller thread. Capture process will stop and this capture
@@ -611,7 +708,16 @@ namespace pcpp
611708 // / @return Pointer to the copied class
612709 virtual PcapLiveDevice* clone () const ;
613710
614- void getStatistics (IPcapDevice::PcapStats& stats) const override ;
711+ void getStatistics (PcapStats& stats) const override ;
712+
713+ // / Match a raw packet with a given BPF filter. Notice this method is static which means you don't need any
714+ // / device instance in order to perform this match
715+ // / @param[in] filter A filter class to test against
716+ // / @param[in] rawPacket A pointer to the raw packet to match the filter with
717+ // / @return True if raw packet matches the filter or false otherwise
718+ // / @deprecated This method is deprecated, use GeneralFilter::matches(...) method directly.
719+ PCPP_DEPRECATED (" Prefer GeneralFilter::matches(...) method directly." )
720+ static bool matchPacketWithFilter (GeneralFilter& filter, RawPacket* rawPacket);
615721
616722 protected:
617723 // / @brief Called before starting a capture to prepare the device for capturing packets.
@@ -688,5 +794,7 @@ namespace pcpp
688794
689795 private:
690796 bool isNflogDevice () const ;
797+
798+ bool doUpdateFilter (std::string const * filterAsString) override ;
691799 };
692800} // namespace pcpp
0 commit comments