noobie - using WinPCap

cmwDev

@aha_1980 @hskoglund Thanks for the suggestions.

I've been playing with this for a while. I used the 'add library' in right clicking the main project file. I also did the 'cast' side.

Tons of complaints about the cast and constants, so I went back to the original findalldevs code. Complaints on things are gone but.. (why does there always have to be a but? lol)

In the pcap folders, there is the Lib folder (totally forgot about that side of things) which contains libpacket.a libwpcap.a Packet.lib and wpcap.lib, as well as a x64 folder that only has the 2 lib's in it. I tried adding in the 2 different dot a files and the 2 lib files, one at a time. Always complained during compile that there was no "d" file for debug. I had a DOH moment, went back in and unchecked the debug version (since there are no debug files in the lib) and that got rid of those errors. But it still failed to compile.

So I used the wpcap.lib in the x64 directory and hot damn, if it didn't work. I ran it (of course, the findalldevs function hasn't been coded yet, just {} there) and there it was on the screen.

This is getting exciting! Yet I also have a concern. I am guessing that any code I make will only run in a win64 platform. There wasn't an option during install to select a plain 32 bit version of mingw...

The project is C:\Users\Gary\Documents\build-rcap-Desktop_Qt_5_12_0_MinGW_64_bit-Debug and the make is mingw32-make.exe -j8 in C:\Users\Gary\Documents\build-rcap-Desktop_Qt_5_12_0_MinGW_64_bit-Debug

The code the 'add library' put into the pro file was:
win32: LIBS += -LF:/WinpCapDeveloperPack_4_1_2/WpdPack/Lib/x64/ -lwpcap

INCLUDEPATH += F:/WinpCapDeveloperPack_4_1_2/WpdPack/Lib/x64
DEPENDPATH += F:/WinpCapDeveloperPack_4_1_2/WpdPack/Lib/x64

(which I am sure makes no difference to you but I thought I would post it in case someone else searches the forums)

hskoglund

Nice! And docs on how you built your app, useful for some other hapless soul that comes along.

Only want to add, re. adding code for the findalldevs() function, that the if statement tests for -1, which I remember meant "error", so that the next step, say to enumerate the interfaces, you could do (like in in my example above):

if(pcap_findalldevs(&alldevs, errbuf) == -1)
{
    printf("Error");
    exit(1);
}

int i = 0;
for(d=alldevs; d != nullptr; d=d->next)
{
    printf("%d. %s", ++i, d->name);
    if (d->description)
        printf(" (%s)\n", d->description);
    else
        printf(" (No description available)\n");
}

cmwDev

still working on things :) The main form goes out to collect all of the network devices and stuffs the english name into a combo box. The values there are identical to the pktdump_ex example file that runs in console mode in Visual Studio. In the example, it prints out the device ID and the name. Since the combo box only holds the one value, I do some code in a button (start capture) that loops through all of the devices again, matches up the english name, gets the device name, and then breaks out of the loop. All of that works fine. I know the device is accurate because I put that value into a label on the form and it matches exactly what the VS code uses.

VS code:

	/* Open the adapter */
	if ((fp = pcap_open_live(d->name, 65536, 1, 1000,	errbuf)) == NULL)
	{
		fprintf(stderr,"\nError opening adapter\n");
		return -1;
	}

my code:

    if ((fp = pcap_open_live(d->name, 65536, 1, 1000, errbuf)) == nullptr)
    {
        QMessageBox::about(this,"Error", "Failed to open adapter");
        return;
    }

QT complained about the NULL side but was happy with the nullptr. Anyway, I wanted to check the value "to be sure" so I set a break point on the IF statement and ran debug mode. Everything worked right, got the devices, selected the right device. When I went into the button click code (where my code is at) it hit the break point and on the right hand side of the QT interface the debug window was there with a listing of items on the form. Unlike VS where I can mouse over a variable and get the details, in QT all I seem to get is generics. So I went to the right hand window, and went to expand out the plus sign on "d".. little twirly thing came up, and then an error. Out of all of the things on "the right" this is the only one that causes this error:

0_1547487464710_qt debug error.jpg
With all of that said, I did/do have code after that, which loops through the interface waiting for data, and when it gets some I was trying to do a simple append text to a text box like "got data"... I could see stuff happening in my current router log program, but nothing was coming into the text box. Then after a few seconds I got the dreaded "the program is not responding" message at the top of the form. All of that lead me to doing this debug side so I could explore and compare with what VS was doing...

Course, VS is a console program and all of the 'functions' happening are all within the base code itself so it knows about all of the variables defined. In doing the QT side, those variables are out of scope when I do a function call like the button click thing, so I moved them all up to the top of the code window and made them static.

#include "mainwindow.h"
#include "ui_mainwindow.h"
#include <QMessageBox>
#include <pcap.h>

static pcap_if_t *alldevs, *d;
static pcap_t *fp;
static char errbuf[PCAP_ERRBUF_SIZE];
static int res;
static struct pcap_pkthdr *header;
static const u_char *pkt_data;

Not sure if thats the right way but the values do seem available as each function runs. Anyway, I am kinda stuck with the debugging crashing and not being able to see what is happening.

cmwDev

oh, one other thing (cant seem to edit my post so)..

In debug mode sitting at the break point, I opened the Debugger Console at the bottom of the screen and tried "? d->name" but it came back and said "Can only evaluate during a debug session." ... seems strange, I was in debug but.. still learning the quirks of QT :) :)

cmwDev

I have been making some progress. My loop code is:

    while((res = pcap_next_ex(fp, &header, &pkt_data)) >= 0)
    {
        QCoreApplication::processEvents();
        if(res == 0)
        {
            // timeout elapsed
            continue;
        }
        // print packet timestamp and length
        sprintf(capBuff,"%ld:%ld (%ld)",header->ts.tv_sec, header->ts.tv_usec, header->len);
        sbuf = QString::fromLocal8Bit(capBuff);
        qDebug() << "CapString " << capBuff;

        ui->capText->appendPlainText(sbuf);
        sbuf = "";
        for(i=1; (i < header->caplen + 1); i++)
        {
            sprintf(hexBuff,"%.2x ", pkt_data[i-1]);
            sbuf.append(QString::fromLocal8Bit(hexBuff));
            if ((i % LINE_LEN) == 0){
                qDebug() << sbuf;
                ui->capText->appendPlainText(sbuf);
                sbuf = "";
            }
        }
        qDebug() << sbuf;
        ui->capText->appendPlainText(sbuf);
        qDebug() << "";
    }

Adding in the event processing lets the text box show the right data, it matches 100% to what the VS example processes. I still have a lot of tweaking to do, work on decoding the actual packet into english stuff.

With that said, there is still the issue of running in debug mode and the 'd' value crashing the program. The new issue is most strange though. With the program running, I hit the 'x' close application at the top of the form, and as expected the form window terminates. Yet the program still runs, I still see information being displayed in the Application Output window. I had to click on the 'stop program' button in that window to actually get it to terminate.

Why would it keep running after the main form closes?

SGaist

Hi,

You should have an additional condition that allows you to break the loop manually.

cmwDev

Yes, I do have that... I added it in after I posted the routine, its now while((res = pcap_next_ex(fp, &header, &pkt_data)) >= 0 && capRunning)

My "start capture" button changes to "stop capture" after the packets routine succeeds, and when I click that, it sets capRunning to false. The button is slow to respond, but the process does stop and I can "X" out of the program easily at that point.

QT is... strange. I can run the VS version and the QT code side by side, I can see the resting period when no packets are there and I've done the stop capture at that point, and the button is still slow to respond. Why it still runs after I X out (instead of pressing stop) is just weird. The form closes completely. Still runs though.

SGaist

You might still be in the loop because neither of the stoping condition went true.

cmwDev

I admit I have been spoiled by the VS interfaces and functions. And this is my first ever attempt at QT. I've tried to google the stuff I have problems with before asking, but it hasn't always worked. What is out there on the net can be quite outdated. I did look at a way to find an 'on closing' event for the form and that didn't work out well. In the UI, I have right clicked on the main menu, went to slots... no close function, but there is a destroy function. I tried that but it never gets called. Probably because the program is still running but the form has vanished. Never seen anything keep running after the X has been clicked. Just saying :)

cmwDev

more searching.. I found an interesting tidbit to disable the X button:

setWindowFlags(Qt::Window | Qt::WindowMinimizeButtonHint | Qt::WindowMaximizeButtonHint);

and then I finally came across...

in mainwindow.h I added in the close event

public:
explicit MainWindow(QWidget *parent = nullptr);
~MainWindow();

protected:
void closeEvent(QCloseEvent *event);

and in mainwindow.cpp I added

void MainWindow::closeEvent(QCloseEvent *event)
{
capRunning = false;
event->accept();
}

So at least it does properly stop now. QT is quite the challenge to get used to. Thanks for the assistance and suggestions.