#include <WinPcapLiveDevice.h>

Inheritance diagram for pcpp::WinPcapLiveDevice:

Public Member Functions
virtual LiveDeviceType	getDeviceType () const

bool	startCapture (OnPacketArrivesCallback onPacketArrives, void onPacketArrivesUserCookie, int intervalInSecondsToUpdateStats, OnStatsUpdateCallback onStatsUpdate, void onStatsUpdateUserCookie)

bool	startCapture (int intervalInSecondsToUpdateStats, OnStatsUpdateCallback onStatsUpdate, void *onStatsUpdateUserCookie)

bool	startCapture (RawPacketVector &capturedPacketsVector)

bool	setMinAmountOfDataToCopyFromKernelToApplication (int size)

int	getMinAmountOfDataToCopyFromKernelToApplication () const

virtual int	sendPackets (RawPacket *rawPacketsArr, int arrLength, bool checkMtu=false)

virtual int	sendPackets (Packet **packetsArr, int arrLength, bool checkMtu=true)

virtual int	sendPackets (const RawPacketVector &rawPackets, bool checkMtu=false)

Public Member Functions inherited from pcpp::PcapLiveDevice
	~PcapLiveDevice () override

std::string	getName () const

std::string	getDesc () const

bool	getLoopback () const

virtual uint32_t	getMtu () const

virtual LinkLayerType	getLinkType () const

const std::vector< pcap_addr_t > &	getAddresses () const

std::vector< IPAddress >	getIPAddresses () const

virtual MacAddress	getMacAddress () const

IPv4Address	getIPv4Address () const

IPv6Address	getIPv6Address () const

IPv4Address	getDefaultGateway () const

const std::vector< IPv4Address > &	getDnsServers () const

virtual bool	startCapture (OnPacketArrivesCallback onPacketArrives, void *onPacketArrivesUserCookie)

virtual int	startCaptureBlockingMode (OnPacketArrivesStopBlocking onPacketArrives, void *userCookie, const double timeout)

void	stopCapture ()

bool	captureActive ()

bool	doMtuCheck (int packetPayloadLength) const

bool	sendPacket (RawPacket const &rawPacket, bool checkMtu=false)

bool	sendPacket (const uint8_t *packetData, int packetDataLength, int packetPayloadLength)

bool	sendPacket (const uint8_t *packetData, int packetDataLength, bool checkMtu=false, pcpp::LinkLayerType linkType=pcpp::LINKTYPE_ETHERNET)

bool	sendPacket (Packet *packet, bool checkMtu=true)

virtual int	sendPackets (RawPacket *rawPacketsArr, int arrLength, bool checkMtu=false)

virtual int	sendPackets (Packet **packetsArr, int arrLength, bool checkMtu=true)

virtual int	sendPackets (const RawPacketVector &rawPackets, bool checkMtu=false)

bool	open () override

bool	open (const DeviceConfiguration &config)

void	close () override

PcapLiveDevice *	clone () const

void	getStatistics (IPcapDevice::PcapStats &stats) const override

Public Member Functions inherited from pcpp::IPcapDevice
virtual bool	setFilter (std::string filterAsString)

bool	clearFilter ()

virtual bool	setFilter (GeneralFilter &filter)

virtual bool	setFilter (std::string filterAsString)=0

Public Member Functions inherited from pcpp::IDevice
bool	isOpened ()

Public Member Functions inherited from pcpp::IFilterableDevice
virtual bool	setFilter (GeneralFilter &filter)

Additional Inherited Members
Public Types inherited from pcpp::PcapLiveDevice
enum	LiveDeviceType { LibPcapDevice , WinPcapDevice , RemoteDevice }

enum	DeviceMode { Normal = 0 , Promiscuous = 1 }

enum	PcapDirection { PCPP_INOUT = 0 , PCPP_IN , PCPP_OUT }

Static Public Member Functions inherited from pcpp::IPcapDevice
static std::string	getPcapLibVersionInfo ()

static bool	matchPacketWithFilter (GeneralFilter &filter, RawPacket *rawPacket)

Detailed Description

A class that wraps a Windows network interface (each of the interfaces listed in ipconfig). This class is almost similar in its capabilities to PcapLiveDevice (its parent class) with some small changes that mainly result from differences between libpcap and WinPcap/Npcap. Please see the reference for PcapLiveDevice for more details

Member Function Documentation

◆ getDeviceType()

virtual LiveDeviceType pcpp::WinPcapLiveDevice::getDeviceType ( ) const

inlinevirtual

Returns: The type of the device (libPcap, WinPcap/Npcap or a remote device)

Reimplemented from pcpp::PcapLiveDevice.

◆ getMinAmountOfDataToCopyFromKernelToApplication()

int pcpp::WinPcapLiveDevice::getMinAmountOfDataToCopyFromKernelToApplication ( ) const

inline

Returns: The current amount of data in the kernel buffer that causes a read from the application to return (see also setMinAmountOfDataToCopyFromKernelToApplication())

◆ sendPackets() [1/3]

virtual int pcpp::PcapLiveDevice::sendPackets

Send a vector of pointers to RawPacket objects to the network

Parameters

[in]	rawPackets	The array of pointers to RawPacket objects to send. This method treats all packets as read-only, it doesn't change anything in them
[in]	checkMtu	Whether to check the size of the packet payload against MTU size. Incurs a parsing overhead. Default value is false to avoid performance overhead. Set to true if you don't know whether packets fit the live device's MTU and you can afford the overhead.

Returns

The number of packets sent successfully. Sending a packet can fail if:

Device is not opened. In this case no packets will be sent, return value will be 0
Packet length is 0
Packet length is larger than device MTU and checkMtu is true
Packet could not be sent due to some error in libpcap/WinPcap/Npcap

◆ sendPackets() [2/3]

virtual int pcpp::PcapLiveDevice::sendPackets

Send an array of pointers to Packet objects to the network

Parameters

[in]	packetsArr	The array of pointers to Packet objects to send. This method treats all packets as read-only, it doesn't change anything in them
[in]	arrLength	The length of the array
[in]	checkMtu	Whether to check the size of the packet payload against MTU size. Default value is true, since the packets being passed in has already been parsed, so checking the MTU does not incur significant processing overhead.

Returns

The number of packets sent successfully. Sending a packet can fail if:

Device is not opened. In this case no packets will be sent, return value will be 0
Packet length is 0
Packet length is larger than device MTU and checkMtu is true
Packet could not be sent due to some error in libpcap/WinPcap/Npcap

◆ sendPackets() [3/3]

virtual int pcpp::PcapLiveDevice::sendPackets

Send an array of RawPacket objects to the network

Parameters

[in]	rawPacketsArr	The array of RawPacket objects to send. This method treats all packets as read-only, it doesn't change anything in them
[in]	arrLength	The length of the array
[in]	checkMtu	Whether to check the size of the packet payload against MTU size. Incurs a parsing overhead. Default value is false to avoid performance overhead. Set to true if you don't know whether packets fit the live device's MTU and you can afford the overhead.

Returns

The number of packets sent successfully. Sending a packet can fail if:

Device is not opened. In this case no packets will be sent, return value will be 0
Packet length is 0
Packet length is larger than device MTU and checkMtu is true
Packet could not be sent due to some error in libpcap/WinPcap/Npcap

◆ setMinAmountOfDataToCopyFromKernelToApplication()

bool pcpp::WinPcapLiveDevice::setMinAmountOfDataToCopyFromKernelToApplication ( int size )

WinPcap/Npcap have a feature (that doesn't exist in libpcap) to change the minimum amount of data in the kernel buffer that causes a read from the application to return (unless the timeout expires). Please see documentation for pcap_setmintocopy for more info. This method enables the user to change this size. Note the device must be open for this method to work

Parameters

[in] size The size to set in bytes

Returns: True if set succeeded, false if the device is closed or if pcap_setmintocopy failed

◆ startCapture() [1/3]

bool pcpp::WinPcapLiveDevice::startCapture	(	int	intervalInSecondsToUpdateStats,
		OnStatsUpdateCallback	onStatsUpdate,
		void *	onStatsUpdateUserCookie
	)

virtual

Start capturing packets on this network interface (device) with periodic stats collection only. This means that packets arriving to the network interface aren't delivered to the user but only counted. Each intervalInSecondsToUpdateStats seconds stats are collected from the device and the onStatsUpdate callback is called with the updated counters. The periodic stats collection is done on a new thread created by this method, meaning all callback calls are done in threads other than the caller thread. Stats collection will stop and threads will be terminated when calling stopCapture(). This method must be called after the device is opened (i.e the open() method was called), otherwise an error will be returned.

Parameters

[in]	intervalInSecondsToUpdateStats	The interval in seconds to activate periodic stats collection
[in]	onStatsUpdate	A callback that will be called each time intervalInSecondsToUpdateStats expires and stats are collected. This callback will contain the collected stats
[in]	onStatsUpdateUserCookie	A pointer to a user provided object. This object will be transferred to the onStatsUpdate callback each time it is called

Returns

True if capture started successfully, false if (relevant log error is printed in any case):

Capture is already running
Device is not opened
Stats collection thread could not be created

Reimplemented from pcpp::PcapLiveDevice.

◆ startCapture() [2/3]

bool pcpp::WinPcapLiveDevice::startCapture	(	OnPacketArrivesCallback	onPacketArrives,
		void *	onPacketArrivesUserCookie,
		int	intervalInSecondsToUpdateStats,
		OnStatsUpdateCallback	onStatsUpdate,
		void *	onStatsUpdateUserCookie
	)

virtual

Start capturing packets on this network interface (device) with periodic stats collection. Each time a packet is captured the onPacketArrives callback is called. In addition, each intervalInSecondsToUpdateStats seconds stats are collected from the device and the onStatsUpdate callback is called. Both the capture and periodic stats collection are done on new threads created by this method, each on a different thread, meaning all callback calls are done in threads other than the caller thread. Capture process and stats collection will stop and threads will be terminated when calling stopCapture(). This method must be called after the device is opened (i.e the open() method was called), otherwise an error will be returned.

Parameters

[in]	onPacketArrives	A callback that is called each time a packet is captured
[in]	onPacketArrivesUserCookie	A pointer to a user provided object. This object will be transferred to the onPacketArrives callback each time it is called. This cookie is very useful for transferring objects that give context to the capture callback, for example: objects that counts packets, manages flow state or manages the application state according to the packet that was captured
[in]	intervalInSecondsToUpdateStats	The interval in seconds to activate periodic stats collection
[in]	onStatsUpdate	A callback that will be called each time intervalInSecondsToUpdateStats expires and stats are collected. This callback will contain the collected stats
[in]	onStatsUpdateUserCookie	A pointer to a user provided object. This object will be transferred to the onStatsUpdate callback each time it is called

Returns

True if capture started successfully, false if (relevant log error is printed in any case):

Capture is already running
Device is not opened
Capture thread could not be created
Stats collection thread could not be created

Reimplemented from pcpp::PcapLiveDevice.

◆ startCapture() [3/3]

bool pcpp::WinPcapLiveDevice::startCapture ( RawPacketVector & capturedPacketsVector )

inlinevirtual

Start capturing packets on this network interface (device). All captured packets are added to capturedPacketsVector, so at the end of the capture (when calling stopCapture()) this vector contains pointers to all captured packets in the form of RawPacket. The capture is done on a new thread created by this method, meaning capturedPacketsVector is updated from another thread other than the caller thread (so user should avoid changing or iterating this vector while capture is on). Capture process will stop and this capture thread will be terminated when calling stopCapture(). This method must be called after the device is opened (i.e the open() method was called), otherwise an error will be returned.

Parameters

[in] capturedPacketsVector A reference to a RawPacketVector, meaning a vector of pointer to RawPacket objects

Returns

True if capture started successfully, false if (relevant log error is printed in any case):

Capture is already running
Device is not opened
Capture thread could not be created

Reimplemented from pcpp::PcapLiveDevice.

Public Member Functions

Additional Inherited Members

Detailed Description

Member Function Documentation

◆ getDeviceType()

◆ getMinAmountOfDataToCopyFromKernelToApplication()

◆ sendPackets() [1/3]

◆ sendPackets() [2/3]

◆ sendPackets() [3/3]

◆ setMinAmountOfDataToCopyFromKernelToApplication()

◆ startCapture() [1/3]

◆ startCapture() [2/3]

◆ startCapture() [3/3]