not-yet-activated pcap_t passed to pcap_compile
Closed this issue · 4 comments
org.jnetpcap.PcapException: not-yet-activated pcap_t passed to pcap_compile
at org.jnetpcap.internal.ForeignDowncall.validateInt(ForeignDowncall.java:249)
at org.jnetpcap.internal.ForeignDowncall.invokeInt(ForeignDowncall.java:83)
at org.jnetpcap.Pcap0_4.compile(Pcap0_4.java:521)
at org.jnetpcap.Pcap.compile(Pcap.java:1815)
at com.yuanqing.probe.listener.JnetpcapListenerThread.run(JnetpcapListenerThread.java:105)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:577)
at java.base/java.util.concurrent.ThreadPerTaskExecutor$ThreadBoundFuture.run(ThreadPerTaskExecutor.java:352)
at java.base/java.lang.VirtualThread.run(VirtualThread.java:287)
at java.base/java.lang.VirtualThread$VThreadContinuation.lambda$new$0(VirtualThread.java:174)
at java.base/jdk.internal.vm.Continuation.enter0(Continuation.java:327)
at java.base/jdk.internal.vm.Continuation.enter(Continuation.java:320)
PcapPro pcap = null;
pcap = PcapPro.create(device);
BpFilter filter = pcap.compile(filterStr, true); // this line error
i see Pcap can add filter, is that PcapPro doesn't support?
this is the example code:
/* Automatically close Pcap resource when done */
try (Pcap pcap = Pcap.openOffline(PCAP_FILE)) {
/* Compile packet filter to capture TCP packets only */
BpFilter filter = pcap.compile("tcp", true);
/* Set our packet filter and start the capture */
pcap.setFilter(filter);
/* Number of packets to capture */
final int PACKET_COUNT = 10;
/* Send packets to handler. The generic user parameter can be of any type. */
pcap.dispatch(PACKET_COUNT, this::nextPacket, "Example 3");
}
change to Pcap is the same.
Pcap pcap = Pcap.create(device);
PcapPro.openOffline supports setFilter();
PcapPro.create doesn't support setFilter()
Are you running the example exactly as is or opening up a live interface with Pcap.create? If live capture you need to call Pcap.activate()
before the filter is set.
When I run the example on offline file:
Example 3: timestamp=2011-03-01T20:45:13.266Z, wirelen=74 caplen=74 {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=74 caplen=74 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=66 caplen=66 {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.313Z, wirelen=200 caplen=200 {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.361Z, wirelen=66 caplen=66 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=66 caplen=66 {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}
Example 3: timestamp=2011-03-01T20:45:13.363Z, wirelen=66 caplen=66 {00:26:62:2f:47:87}
Example 3: timestamp=2011-03-01T20:45:13.366Z, wirelen=1514 caplen=1514 {00:1d:60:b3:01:84}
Lets see if I can duplicate the problem you are seeing.
this is also fine...
pcap = PcapPro.openLive(device, snapLen, true, 100, TimeUnit.MINUTES);
thanks.