ecapture
ecapture copied to clipboard
feat: Support pcap-filter expression for pcap mode
Fix #474
It's better to use pcap-filter expression to filter packets like tcpdump instead of --port
like options.
There are two ways to use pcap-filter:
-
./bin/ecapture tls -m pcap -i ens33 --pcapfile test.pcapng --pcap-filter="host 142.251.10.100"
-
./bin/ecapture tls -m pcap -i ens33 --pcapfile test.pcapng host 142.251.10.100
So, in this commit:
- Add libpcap as a Git submodule.
-
make
in Makefile will build and install libpcap. - Remove
target_port
in bpf code. - Add
filter_pcap_ebpf_l2()
as a stub to inject pcap-filter. - Use
[email protected]
to inject pcap-filter into bpf program spec withelibpcap
library. - Remove
--port
option. - Add
--pcap-filter
option.