Add a binding for pcap_dispatch

[cicku]

Closes #388

[RazorBest]

Hi cicku! Thanks for submitting this PR! Your effort is appreciated!

Testing

I tried testing this starting from @rikonaka's demo, and changed it: https://github.com/RazorBest/pcap-issues

There are 3 scenarios:

• pcap-rs with the old next_packet (implemented in src/main.rs::pcap_test_old)
• pcap-rs with your new dispatch (implemented in src/main.rs::pcap_test_new)
• C version that uses pcap_dispatch (in sniffer.c)

The test environment assumes:

• sudo access to both C and rust sniffers
• a Docker container running on 172.17.0.2, accessible through the docker0 interface
• the host can send packets to 172.17.0.2

To run the Docker container:

docker build -f Dockerfile_echo . -t echo
docker run -ti --rm echo

To run the packet capture:

cargo run # Change src/main.rs depending on which scenario you want

Or, for the C version:

gcc sniffer.c -lpcap && sudo ./a.out

While the container is up and the sniffer is capturing, run:

sudo nmap --max-rate 2000 -sS -p 22-8192 172.17.0.2

Then, hit Ctrl+C in the packet capture terminal. This doesn't immediately stop the process. An additional packet needs to be received. You can run nc 172.17.0.2 8080 to trigger that.

Result

With your PR, there are still missing ports:

With sniffer.c, there are no missing ports. This indicates that pcap_dispatch is able to catch all the packets. So the issue might be somewhere in the Rust implementation.

Edit: Actually, there was a difference between the C and Rust version. The C version was using a bigger buffer. Now, that the Rust version has a big enough buffer, your PR passes.