经典珍藏小代码（数据包解析）

最新推荐文章于 2023-07-04 22:09:11 发布

huichengongzi

最新推荐文章于 2023-07-04 22:09:11 发布

阅读量1.4k

点赞数

分类专栏： LINUX/C 文章标签： struct header hex filter socket tcp

本文链接：https://blog.csdn.net/huichengongzi/article/details/6285103

版权

LINUX/C 专栏收录该内容

62 篇文章 0 订阅

订阅专栏

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <ctype.h>
#include <time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <netinet/tcp.h>
#include <netinet/if_ether.h> /* For ETH_P_ALL */
#include <net/if_arp.h>

#include "sniffer.h"

#define BUFSIZE 2048
#define SNIFFER_VERSION "sniffer-1.0"

static void hex_print(const u_char *buf, int len, int offset);
static int decode_eth(const u_char *buf);
static int decode_ip(const u_char *buf);
static int decode_arp(const u_char *buf);
static int decode_tcp(const u_char *buf);
static int decode_udp(const u_char *buf);
void show_nowtime();//显示当前时间
void print_usage (int exit_status);//显示命令帮助

static char *destip = NULL;//在命令参数中得到要过滤地目的IP
static char *sourceip = NULL;//在命令参数中得到要过滤源的IP
static int globe_argnum = 0;
static int pag_length = 0;

int main( int argc, char **argv )
{
int listenfd;
int n;
char buf[BUFSIZE];
int arg_num = 1;
int old_arg_num = 0;
globe_argnum = argc;
printf( "command number: %d/n", argc );

while( arg_num < argc )
{
  old_arg_num = arg_num;
  if (strncmp ("-d", argv[arg_num], 2) == 0)
  {
   arg_num++;
   destip = argv[arg_num];
   printf( " /n destIP = %s /n", argv[arg_num] );
  }
  else if (strncmp ("-s", argv[arg_num], 2) == 0)
  {
   arg_num++;
   sourceip = argv[arg_num];
   printf( " /n sourceIP = %s /n", argv[arg_num] );
  }
  else if ((strncmp ("-v", argv[arg_num], 2) == 0)||
    (strncmp("--version", argv[arg_num], strlen ("--version")) == 0) )
  {
   printf ("version: " SNIFFER_VERSION "/n");
   exit (EXIT_SUCCESS);
  }
  else if (old_arg_num == arg_num)
  {
   fprintf (stderr, "ERROR: bad arguments/n");
   print_usage (EXIT_FAILURE);
   //return -1;
  }

  arg_num++;
}

if ((listenfd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
{
  perror("socket");
  exit(1);
}

for (;;)
{
  if ((n = recv(listenfd, buf, BUFSIZE, 0)) > 0)
  {
   //printf( "/n/n------------------------------------------------------/n/n" );
   decode_eth(buf);
   pag_length = n;
   //printf("/nNowTime : %s/n",asctime(timenow));
  }
}

return 0;
}

static int decode_eth(const u_char *buf)
{

struct ethhdr *eth = (struct ethhdr *) buf;
//struct iphdr *ipp = (struct iphdr *) buf;
struct iphdr *ipp = (struct iphdr *) (u_char *)&eth[1];
struct ether_arp *arpp = (struct ether_arp *) buf;
char sip[ 16 ];
char dip[ 16 ];
memset( sip, 0, sizeof( sip ) );
memset( dip, 0, sizeof( dip ) );
//int cpm = 0;

switch (ntohs(eth->h_proto))
{

  case ETH_P_IP:
   //printf("/nSource IP Address: %d.%d.%d.%d", NIPQUAD(iph->saddr));
   //printf("/nDestination IP Address: %d.%d.%d.%d", NIPQUAD(iph->daddr));
   sprintf( sip, "%d.%d.%d.%d", NIPQUAD(ipp->saddr));
   sprintf( dip, "%d.%d.%d.%d", NIPQUAD(ipp->daddr));
   sip[ 15 ] = '/0';
   dip[ 15 ] = '/0';
   //printf( "filter sip %s dip %s /n", sip, dip );
   if ( globe_argnum == 1 )
   {
    printf( " --------------------start--------------------/n" );
    printf("/nMAC header");
    printf("/nDestination Address: %02X:%02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_dest));
    printf("/nSource Address:%02X: %02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_source));
    printf("/nType: %02X-%02X", PWORD(eth->h_proto));
    return decode_ip((u_char *)&eth[1]);
   }
   else if ( globe_argnum == 3 )
   {
    //printf( "globe_argnum %d/n ", globe_argnum );
    if( destip )
    {
     //cpm = strcmp( dip, destip );
     //printf( "cmp == %d dip : %s /t destip:%s/n", cpm );
     if( 0 == strcmp( dip, destip ) )
     {
      printf( "/n--------------------start--------------------/n" );
      printf("/nMAC header");
      printf("/nDestination Address: %02X:%02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_dest));
      printf("/nSource Address:%02X: %02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_source));
      printf("/nType: %02X-%02X", PWORD(eth->h_proto));
      return decode_ip((u_char *)&eth[1]);
     }
    }
    else if( sourceip )
    {
     if( 0 == strcmp( sip, sourceip ) )
     {
      printf( "/n--------------------start--------------------/n" );
      printf("/nMAC header");
      printf("/nDestination Address: %02X:%02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_dest));
      printf("/nSource Address:%02X: %02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_source));
      printf("/nType: %02X-%02X", PWORD(eth->h_proto));
      return decode_ip((u_char *)&eth[1]);
     }
    }
   }
   else if ( globe_argnum == 5 )
   {
    if( ( 0 == strcmp( sip, destip ) ) && ( 0 == strcmp( sip, sourceip ) ) )
    {
     printf( "/n--------------------start--------------------/n" );
     printf("/nMAC header");
     printf("/nDestination Address: %02X:%02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_dest));
     printf("/nSource Address:%02X: %02X:%02X:%02X:%02X:%02X", HWADDR(eth->h_source));
     printf("/nType: %02X-%02X", PWORD(eth->h_proto));
     return decode_ip((u_char *)&eth[1]);
    }
   }
   break;
  case ETH_P_ARP:
   //sprintf( sip, "%d.%d.%d.%d", NIPQUAD(arpp->saddr));
   //sprintf( dip, "%d.%d.%d.%d", NIPQUAD(arpp->daddr));
   return decode_arp((u_char *)&eth[1]);
  default:
   return -1;
}

return 0;
}

static int decode_arp(const u_char *buf)
{
struct ether_arp *arph = (struct ether_arp *) buf;

printf("/nAddress Resolution Protocol");
printf("/nHardware Type: %d", ntohs(arph->arp_hrd));
printf("/nProtocol Type: %02X-%02X", PWORD(arph->arp_pro));
printf("/nLength of Hardware Address: %d", arph->arp_hln);
printf("/nLength of Protocol Address: %d", arph->arp_pln);
printf("/nOperation Code: %d", ntohs(arph->arp_op));
printf("/nSender`s Hardware Address: %02X:%02X:%02X:%02X:%02X:%02X",
HWADDR(arph->arp_sha));
printf("/nSender`s IP Address: %d.%d.%d.%d", NIPQUAD(arph->arp_spa));
printf("/nTarget`s Hardware Address: %02X:%02X:%02X:%02X:%02X:%02X",
HWADDR(arph->arp_tha));
printf("/nTarget`s IP Address: %d.%d.%d.%d", NIPQUAD(arph->arp_tpa));
hex_print(buf, pag_length, 0);
return 0;
}

static int decode_ip(const u_char *buf)
{
struct iphdr *iph = (struct iphdr *) buf;

printf("/nIPv4 header");
printf("/nVersion: %d", iph->version);
printf("/nHeader length: %d (%d bytes)", iph->ihl, iph->ihl*4);
printf("/nType of service (TOS):0x%02X", iph->tos);
printf("/nTotal length: %d", ntohs(iph->tot_len));
printf("/nIdentification: %d", ntohs(iph->id));
printf("/nFlags: %02X %02X", PWORD(iph->frag_off));
printf("/nTime to Live (TTL): %d hops", iph->ttl);
printf("/nProtocol: %d", iph->protocol);
printf("/nChecksum: 0x%02X%02X", PWORD(iph->check));
printf("/nSource IP Address: %d.%d.%d.%d", NIPQUAD(iph->saddr));
printf("/nDestination IP Address: %d.%d.%d.%d", NIPQUAD(iph->daddr));

switch (iph->protocol)
{
  case IPPROTO_TCP:
   return decode_tcp((u_char *)&iph[1]);
  case IPPROTO_UDP:
   return decode_udp((u_char *)&iph[1]);
  case IPPROTO_ICMP:
   printf("/ICMP header");
   printf("/nICMP pkt:%s/n",inet_ntoa(*(struct in_addr*)&(iph->saddr)));
   hex_print(buf, pag_length, 0);
   show_nowtime();
   break;

  case IPPROTO_IGMP:
   printf("/nIGMP pkt:/n");
   hex_print(buf, pag_length, 0);
   show_nowtime();
   break;
  default:
   return -1;
}
return 0;
}

static int decode_tcp(const u_char *buf)
{
struct tcphdr *tcph = (struct tcphdr *) buf;

printf("/nTCP header");
printf("/nSource port: %d", ntohs(tcph->source));
printf("/nDestination port: %d", ntohs(tcph->dest));
printf("/nSequence number: %u", ntohl(tcph->seq));
printf("/nAcknowledegment number: %u", ntohl(tcph->ack_seq));
printf("/nHeader length: %d (%d bytes)", tcph->doff, tcph->doff*4);
printf("/nReserved: 0x%X", tcph->res1);
printf("/nFlags: r:%d,u:%d,a:%d,p:%d,r:%d,s:%d,f:%d",
tcph->res2, tcph->urg, tcph->ack, tcph->psh,
tcph->rst, tcph->syn, tcph->fin);
printf("/nWindow size: %d", ntohs(tcph->window));
printf("/nChecksum: 0x%02X%02X", PWORD(tcph->check));
printf("/nUrgent pointer: %d", ntohs(tcph->urg_ptr));

hex_print(buf, pag_length, 0);
show_nowtime();

return 0;
}

static int decode_udp(const u_char *buf)
{
struct udphdr *udph = (struct udphdr *) buf;

printf("/nUDP header");
printf("/nSource Port: %d", ntohs(udph->source));
printf("/nDestination Port: %d", ntohs(udph->dest));
printf("/nLength: %d bytes", ntohs(udph->len));
printf("/nChecksum: 0x%X", udph->check);
hex_print(buf, pag_length, 0);
show_nowtime();

return 0;
}

static void hex_print(const u_char *buf, int len, int offset)
{

u_int i, j, jm;
int c;

printf("/n");
for (i = 0; i < len; i += 0x10)
{
  printf(" %04x: ", (u_int)(i + offset));
  jm = len - i;
  jm = jm > 16 ? 16 : jm;

  for (j = 0; j < jm; j++)
  {
   if ((j % 2) == 1)
   {
    printf("%02x ", (u_int) buf[i+j]);
   }

   else
   {
    printf("%02x", (u_int) buf[i+j]);
   }
  }

  for (; j < 16; j++)
  {
   if ((j % 2) == 1)
   {
    printf("   ");
   }
   else
   {
    printf(" ");
   }
  }

  printf(" ");

  for (j = 0; j < jm; j++)
  {
   c = buf[i+j];
   c = isprint(c) ? c : '.';
   printf("%c", c);
  }

  printf("/n");
}
}
void print_usage (int exit_status)
{
fprintf (stdout, "/n/t usage: sniffer [-d destip] [-s sourip] /n/
  -d destip           Filter Destination IP Address/n/
  -s sipaddress       Filter Source IP Address/n/n");
exit(exit_status);
}

void show_nowtime()
{
time_t now;
struct tm *timenow;
time(&now);
timenow = localtime(&now);
printf("%s/n",asctime(timenow));
printf( "--------------------end--------------------/n" );
}