8

I'm using libpcap as lib to write a C program for catching up coming IPs. my code snippet as following:

struct bpf_program filter;
pcap_compile(pcap_handle, &filter, "icmp[icmptype]=0 and '(dst 16.11.26.100 or dst 16.11.27.100)'", 1, 0);
pcap_setfilter(pcap_handle, &filter);

But it didn't work, I still could see other dest Ips rather than only the above two Ips.

Jack
  • 5,540
  • 13
  • 65
  • 113

2 Answers2

1

I fixed the problem, the right answer is here:

"icmp[icmptype]=0 and (dst 16.11.26.100 or dst 16.11.27.100)"

Just removed the single quota.

Jack
  • 5,540
  • 13
  • 65
  • 113
1

You should always check for errors from library routine calls. If you'd checked for errors from pcap_compile(), you would have seen that the compile failed (due to the single quotes, although the error message would probably just be "syntax error").

user9065877
  • 193
  • 1
  • 1
  • 2