PCAP Linux

    strcpy(filter, "(host 89.218.117.254 or 192.168.240.2 or 192.168.253.10 or ");
    strcat(filter, argv[2]);
    strcat(filter, ")");
 
        if(pcap_compile(descr, &fp, filter, 0, netp) == -1)
        {
            log1("Error calling pcap_compile\n");
            return 0;
        }
 
        if(pcap_setfilter(descr,&fp) == -1)
        {
            log1("Error setting filter\n");
            return 0;
        }
 
    pcap_loop(descr,-1,packet_handler,NULL);

void packet_handler(u_char *args,
                    const struct pcap_pkthdr* pkthdr,
                    const u_char* packet
                    )
{
 
    struct sniff_ethernet *ethernet;
    struct sniff_ip *ip;
    struct sniff_tcp *tcp;
    char *payload;
 
 
    ethernet = (struct sniff_ethernet*)( packet );
    ip   = (struct sniff_ip*)( packet + size_ethernet );
    tcp  = (struct sniff_tcp*)( packet + size_ethernet + size_ip );
    payload  = (char *)( packet + size_ethernet + size_ip + size_tcp );
 
 
    if (ip->ip_p != 6)
        return;
 
    char src[16];
    char dst[16];
 
    strcpy(src, (const char *)inet_ntoa(ip->ip_src));
    strcpy(dst, (const char *)inet_ntoa(ip->ip_dst));
 
    u_short sport = ntohs(tcp->th_sport);
    u_short dport = ntohs(tcp->th_dport);
    u_short ip_len = ntohs(ip->ip_len);
    u_short tcp_off;
 
    u_short tcp_len = ip_len - (ip->ip_hl*4) - (tcp->th_off*4);
 
 
    unsigned char *p;
    char flags[7] = "123456", *pf;
    int i, idx, cnt = 0, dir;
 
 
    if (dport==22 || sport==22)
        return;
 
std::cout << src << ":" << sport << " - "<< dst << ":" << dport << " - ip_len: " << (1 * ip->ip_len) << "  ip_hlen: "<< (ip->ip_hl*4) << "  tcp_offset: " << (tcp->th_off*4) << "   tcp_len: " << tcp_len << "\r\n";
 
 
    char buf[16] = {0}; 
 
    int tmp_id;
 
 
            p = (unsigned char  *)(packet);
 
            tcp_off = (tcp->th_off-5)*4;
 
            pf = flags;
            *(pf+5) = (tcp->th_flags & TH_FIN  ? 'F' : '.');
            *(pf+4) = (tcp->th_flags & TH_SYN  ? 'S' : '.');
            *(pf+3) = (tcp->th_flags & TH_RST  ? 'R' : '.');
            *(pf+2) = (tcp->th_flags & TH_PSH  ? 'P' : '.');
            *(pf+1) = (tcp->th_flags & TH_ACK  ? 'A' : '.');
            *(pf+0) = (tcp->th_flags & TH_URG  ? 'U' : '.');
 
std::cout << src << " - " << dst << " f:" << flags << " seq:" << tcp->th_seq << " ask:" << tcp->th_ack << "\r\n";
 
            if ( (tcp->th_flags & TH_SYN) || (tcp->th_flags & TH_FIN) )
            {
//printf( "%s:%d - %s:%d f:%s %d %lu %lu \r\n",  src, sport, dst, dport, flags , tcp_len, tcp->th_seq , tcp->th_ack );
            }
 
}

#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS \
    (TH_FIN|TH_SYN|TH_RST|\
     TH_ACK|TH_URG|TH_ECE|TH_CWR)