slytechs-repos/jnetpcap-wrapper

not-yet-activated pcap_t passed to pcap_compile

Closed this issue · 4 comments

org.jnetpcap.PcapException: not-yet-activated pcap_t passed to pcap_compile
at org.jnetpcap.internal.ForeignDowncall.validateInt(ForeignDowncall.java:249)
at org.jnetpcap.internal.ForeignDowncall.invokeInt(ForeignDowncall.java:83)
at org.jnetpcap.Pcap0_4.compile(Pcap0_4.java:521)
at org.jnetpcap.Pcap.compile(Pcap.java:1815)
at com.yuanqing.probe.listener.JnetpcapListenerThread.run(JnetpcapListenerThread.java:105)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:577)
at java.base/java.util.concurrent.ThreadPerTaskExecutor$ThreadBoundFuture.run(ThreadPerTaskExecutor.java:352)
at java.base/java.lang.VirtualThread.run(VirtualThread.java:287)
at java.base/java.lang.VirtualThread$VThreadContinuation.lambda$new$0(VirtualThread.java:174)
at java.base/jdk.internal.vm.Continuation.enter0(Continuation.java:327)
at java.base/jdk.internal.vm.Continuation.enter(Continuation.java:320)

PcapPro pcap = null;
pcap = PcapPro.create(device);
BpFilter filter = pcap.compile(filterStr, true); // this line error

i see Pcap can add filter, is that PcapPro doesn't support?
this is the example code:
/* Automatically close Pcap resource when done */
try (Pcap pcap = Pcap.openOffline(PCAP_FILE)) {

		/* Compile packet filter to capture TCP packets only */
		BpFilter filter = pcap.compile("tcp", true);

		/* Set our packet filter and start the capture */
		pcap.setFilter(filter);

		/* Number of packets to capture */
		final int PACKET_COUNT = 10;

		/* Send packets to handler. The generic user parameter can be of any type. */
		pcap.dispatch(PACKET_COUNT, this::nextPacket, "Example 3");
	}

change to Pcap is the same.

Pcap pcap = Pcap.create(device);

PcapPro.openOffline supports setFilter();

PcapPro.create doesn't support setFilter()

Are you running the example exactly as is or opening up a live interface with Pcap.create? If live capture you need to call Pcap.activate() before the filter is set.

When I run the example on offline file:

Example 3: timestamp=2011-03-01T20:45:13.266Z, wirelen=74   caplen=74   {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=74   caplen=74   {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=66   caplen=66   {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=200  caplen=200  {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.361Z, wirelen=66   caplen=66   {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=66   caplen=66   {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=66   caplen=66   {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.366Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}

Lets see if I can duplicate the problem you are seeing.

this is also fine...
pcap = PcapPro.openLive(device, snapLen, true, 100, TimeUnit.MINUTES);

thanks.