reading a pcap file in c++

Question

I'm trying to read a pcap file in c++ (I'm using VS 2008) and I'm having the following errors:

1) error C2011: 'bpf_program' : 'struct' type redefinition.

2) error C2011: 'bpf_insn' : 'struct' type redefinition

I guess the problem is that in one file I include the Packet32.h and in another file I include pcap.h (I need Packet32.h functions in a certain class and I need pcap.h to read a pcap file in another class). I have header guards in every file.

In the main class I include both of the prementioned classes. If I switch the include order I get another error. Here's a simple code that looks like mine:

in class1.h:

.
.
.
#include <Packet32.h>
#include <windows.h>
#include <process.h>
.
.
.

in class2.h:

.
.
.
#include <pcap.h>
.
.
.

in main.cpp:

#include "stdafx.h"
#include "class1.h"
#include "class2.h"
.
.
.

I wonder if anyone could help me about this. It would be appreciated very much.

Answer 1

Try adding this before including pcap.h:

#define PCAP_DONT_INCLUDE_PCAP_BPF_H

From what I can see, this will stop pcap.h from including pcap-bpf.h, which is where those definitions are coming from (in addition to Packet32.h).

You may also need to add an include of Packet32.h in the same place, to make sure the definitions are always available before pcap.h is included.

Answer 2

For reading pcap file use pcap_generator library sources

Example reading

PCAPFILE  * pfr = lpcap_open("./pcaplibtestfile.pcap");
  pcap_hdr_t   phdr;
  if( lpcap_read_header( pfr, &phdr ))
  {
    int rese_rec_read = 0 ;
    pcaprec_hdr_and_data_t  p_rec_data;
    do{   
       rese_rec_read = lpcap_read_frame_record( pfr , &p_rec_data);
    }while(rese_rec_read>0);