Search code examples
pcappacket-snifferssniffingbpf

BPF program is not valid - pcap sniffing


Hey everyone I'm trying to sniff packets using the pcap library. I have just one problem that I can not figure out: ERROR: BPF program is not valid.

BPF program is not valid

I'm trying to start the sniffing but this error is blocking me I searched on the web and found nothing.

My code is based after this program: https://github.com/levans248/packetSniffingAndSpoofing/blob/master/sniff.c

It is due to SEED labs I know people do not help when it is homework but I just need to figure why this is happening I have no clue.

#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <arpa/inet.h>

void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
    printf("Got a packet \n");
}

int main()
{
    pcap_t *handle;
    char errbuf[PCAP_ERRBUF_SIZE];
    struct bpf_program fp;
    char filter_exp[] = "ip proto icmp";
    bpf_u_int32 net;

    // Open live pcap session
    handle = pcap_open_live("enp0s3", BUFSIZ, 1, 1000, errbuf);
    // Compile Filter into the Berkeley Packet Filter (BPF)
    pcap_compile(handle, &fp, filter_exp, 0, net);

    if (pcap_setfilter(handle, &fp) == -1)
    {
        pcap_perror(handle, "ERROR");
        exit(EXIT_FAILURE);
    }

    // Sniffing..
    pcap_loop(handle, -1, got_packet, NULL);
    pcap_close(handle);

    return 0;
}


Solution

  • ip proto doc - C-shell

    There was a SYNTAX mistake in the filter_exp , I was working on C-Shell so was needed to change to ip proto \icmp

    Thank you very much everyone !