#include <stdio.h>
#include <pcap.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/if_ether.h>
#include <net/ethernet.h>
#include <netinet/ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
//#include <linux/ip.h>
//#include <linux/tcp.h>
void fcb(u_char *arg, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
struct in_addr addr;
struct iphdr *ipptr;
struct tcphdr *tcpptr;
char *data;
int *id = (int *)arg;
++*id;
printf("[+] id = %d\n", *id);
printf("\npacket len: %d\n",pkthdr->len);
// printf("Ethernet address header length is %d\n",ETHER_HDR_LEN);
struct ether_header *eptr;
//struct ether_header
//{
// u_int8_t ether_dhost[ETH_ALEN]; /* destination eth addr */
// u_int8_t ether_shost[ETH_ALEN]; /* source ether addr */
// u_int16_t ether_type; /* packet type ID field */
//} __attribute__ ((__packed__));
printf("[+]Ethernet Parser\t\t");
eptr = (struct ether_header *)packet;
if( ntohs( eptr->ether_type) == ETHERTYPE_IP )
{
printf("Ethernet type hex:%x dec:%d is an IP packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
}
else if(ntohs(eptr->ether_type) == ETHERTYPE_ARP )
{
printf("Ethernet type hex:%x dec:%d is an ARP packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
return ;
}
else
{
printf("Ethernet type hex:%x dec:%d is unknown packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
return;
}
// ETHERTYPE_IP
printf("[+] IP Parser\t\t");
u_char *ptr;
int i;
ptr = eptr->ether_dhost;
i = ETHER_ADDR_LEN;
//printf("i=%d\n",i);
printf("Destination Addr:");
do
{
printf("%s%x", (i== ETHER_ADDR_LEN)?"":":",*ptr++);
}while(--i > 0);
putchar(10);
//struct iphdr {
//#if defined(__LITTLE_ENDIAN_BITFIELD)
// __u8 ihl:4,
// version:4;
//#elif defined (__BIG_ENDIAN_BITFIELD)
// __u8 version:4,
// ihl:4;
//#else
//#error "Please fix <asm/byteorder.h>"
//#endif
// __u8 tos;
// __be16 tot_len;
// __be16 id;
// __be16 frag_off;
// __u8 ttl;
// __u8 protocol;
// __sum16 check;
// __be32 saddr;
// __be32 daddr;
// /*The options start here. */
//};
//
ipptr = (struct iphdr*)(packet + sizeof(struct ether_header));
// printf("the IP Packets total_length is :%d\n",ipptr->tot_len);
// printf("the IP protocol is %d\n",ipptr->protocol);
addr.s_addr = ipptr->saddr;
printf("Source IP: %s \t",inet_ntoa(addr));
addr.s_addr = ipptr->daddr;
printf("Destination IP: %s\n",inet_ntoa(addr));
if( ipptr->protocol != IPPROTO_TCP ) return;
printf("[+] TCP Parser\t\t");
tcpptr = (struct tcphdr *)(packet + sizeof(struct ether_header) + sizeof(struct iphdr));
printf("Source port: %d \t",ntohs(tcpptr->th_sport));
printf("Destination port: %d\n",ntohs(tcpptr->th_dport));
// printf("the seq of packet is %u\n", tcpptr->seq);
data = (char *)packet + sizeof(struct ether_header) + sizeof(struct iphdr) + sizeof(struct tcphdr);
printf("Content: \n%s\n",data);
return;
}
int main(int argc,char *argv[])
{
// int i;
char *dev;
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *descr;
int id = 0;
//const u_char *packet;
//struct pcap_pkthdr hdr;
//struct ether_header *eptr;
if( argc !=2 )
{
fprintf(stdout,"Usage: %s numpackets\n",argv[0]);
return 0;
}
dev = pcap_lookupdev(errbuf);
if(dev == NULL)
{
printf("%s\n",errbuf);
exit(0);
}
descr = pcap_open_live(dev, BUFSIZ, 1, -1, errbuf);
if( descr==NULL )
{
printf("pcap_open_live(): %s\n",errbuf);
exit(0);
}
struct bpf_program filter;
pcap_compile(descr, &filter, "(ip host 10.10.10.110) and (dst port 80 or src port 80)",1,0);
pcap_setfilter(descr, &filter);
pcap_loop(descr, atoi(argv[1]), fcb, (u_char *)&id );
return 0;
}
一个pcap抓包分析code
最新推荐文章于 2024-04-10 09:22:24 发布