/* * to compile type: * gcc -lpcap bpf_comp.c -o bpf_comp */ #include #include #include #include int main(int argc, char *argv[]) { struct bpf_program bp; unsigned int i; if (argc != 2) errx(EX_USAGE, "Usage %s 'filter expression'", argv[0]); if(pcap_compile_nopcap(65535, DLT_RAW, &bp, argv[1], 1, 0)) { errx(EX_USAGE, "filter syntax error"); } printf("bpf_prog_len=%d bpf_prog=[ ", bp.bf_len); for (i = 0; i < bp.bf_len; i ++) { printf("{ code=%d jt=%d jf=%d k=%d } ", bp.bf_insns[i].code, bp.bf_insns[i].jt, bp.bf_insns[i].jf, bp.bf_insns[i].k); } printf("]\n"); return 0; }