pcap analyse

#include <stdio.h>
#include <pcap.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>

#include <netinet/in.h>
#include <arpa/inet.h>

#include <netinet/if_ether.h>
#include <net/ethernet.h>

#include <netinet/ether.h>

#include <netinet/ip.h>
#include <netinet/tcp.h>


//#include <linux/ip.h>
//#include <linux/tcp.h>

void fcb(u_char *arg, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
    printf("-------------------------------------------------------------------------\n");
    struct in_addr addr;
    struct iphdr *ipptr;
    struct tcphdr *tcpptr;
    char *data;

    int *id = (int *)arg;
    ++*id;
    printf("[+] id = %d\n", *id);
    printf("packet len: %d\t\t",pkthdr->len);
    //printf("capture len : %d\n",pkthdr->caplen);
    // printf("Ethernet address header length is %d\n",ETHER_HDR_LEN);

    struct ether_header *eptr;
    int tcpdatalength = -1;

    //struct ether_header
    //{
    //  u_int8_t  ether_dhost[ETH_ALEN];    /* destination eth addr */
    //  u_int8_t  ether_shost[ETH_ALEN];    /* source ether addr    */
    //  u_int16_t ether_type;               /* packet type ID field */
    //} __attribute__ ((__packed__));

    //printf("[+]Ethernet Parser\t\t");
    eptr = (struct ether_header *)packet;
    if( ntohs( eptr->ether_type) ==  ETHERTYPE_IP )
    {
     //   printf("Ethernet type hex:%x dec:%d is an IP packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
        ;
    }
    else if(ntohs(eptr->ether_type) == ETHERTYPE_ARP )
    {
        printf("Ethernet type hex:%x dec:%d is an ARP packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
        return ;
    }
    else 
    {
        printf("Ethernet type hex:%x dec:%d is unknown packet\n",ntohs(eptr->ether_type),ntohs(eptr->ether_type));
        return;

    }

    // ETHERTYPE_IP
    // printf("[+] IP Parser\t\t");
    u_char *ptr;
    int i;
    ptr = eptr->ether_dhost;
    i = ETHER_ADDR_LEN;
    //printf("i=%d\n",i);

    /*
    printf("Destination Addr:");
    do
    {
        printf("%s%x", (i== ETHER_ADDR_LEN)?"":":",*ptr++);
    }while(--i > 0);
    putchar(10);
    */

    //struct iphdr {
    //#if defined(__LITTLE_ENDIAN_BITFIELD)
    //  __u8    ihl:4,
    //      version:4;
    //#elif defined (__BIG_ENDIAN_BITFIELD)
    //  __u8    version:4,
    //          ihl:4;
    //#else
    //#error    "Please fix <asm/byteorder.h>"
    //#endif
    //  __u8    tos;
    //  __be16  tot_len;
    //  __be16  id;
    //  __be16  frag_off;
    //  __u8    ttl;
    //  __u8    protocol;
    //  __sum16 check;
    //  __be32  saddr;
    //  __be32  daddr;
    //  /*The options start here. */
        //};
        //
    ipptr = (struct iphdr*)(packet + sizeof(struct ether_header));
    u_int16_t iplength;
    iplength = ntohs(ipptr->tot_len );
    //printf("ip length = %d\n",iplength);

    addr.s_addr = ipptr->saddr;
    printf("IP: %s --> ",inet_ntoa(addr));
    //printf("Source IP: %s \t",inet_ntoa(addr));
    addr.s_addr = ipptr->daddr;
    //printf("Destination IP: %s\n",inet_ntoa(addr));
    printf("%s\t\t",inet_ntoa(addr));

    if( ipptr->protocol != IPPROTO_TCP  ) return;



    // printf("[+] TCP Parser\t\t");
    tcpptr = (struct tcphdr *)(packet + sizeof(struct ether_header) + sizeof(struct iphdr));
    printf("port:%d-->%d\n",ntohs(tcpptr->th_sport),ntohs(tcpptr->th_dport));

    // printf("Source port: %d  \t",ntohs(tcpptr->th_sport));
    // printf("Destination port: %d\n",ntohs(tcpptr->th_dport));

//  u_int8_t th_flags;
//# define TH_FIN   0x01
//# define TH_SYN   0x02
//# define TH_RST   0x04
//# define TH_PUSH  0x08
//# define TH_ACK   0x10
//# define TH_URG   0x20
    printf("flags:\t");
    if ( tcpptr->th_flags & TH_SYN ){ printf("SYN,"); }
    if ( tcpptr->th_flags & TH_ACK ){ printf("ACK,"); }
    if ( tcpptr->th_flags & TH_PUSH ){ printf("PUSH,"); }
    if ( tcpptr->th_flags & TH_FIN ){ printf("FIN,"); }
    if ( tcpptr->th_flags & TH_RST ){ printf("RST,"); }
    if ( tcpptr->th_flags & TH_URG ){ printf("URG,"); }
    printf("\n");

    printf("SEQ: %u\t\t",ntohl(tcpptr->th_seq));
    printf("ACK: %u\n",ntohl(tcpptr->th_ack));

    printf("Win: %u\n",ntohs(tcpptr->th_win));


    //printf("tcpptr->th_off=%x\n",ntohs(tcpptr->th_off ));
    //printf("tcpptr->th_off=%x\n",tcpptr->th_off);
    // printf("tcp header length = %d\n",4 * ntohs(tcpptr->th_off << 4));


    data = (char *)packet + sizeof(struct ether_header) + sizeof(struct iphdr) + sizeof(struct tcphdr);
    //printf("[+] %lu %lu %lu\n",sizeof(struct ether_header),sizeof(struct iphdr),sizeof(struct tcphdr));

    //tcpdatalength = pkthdr->len - sizeof(struct ether_header) - sizeof(struct iphdr) - sizeof(struct tcphdr);
 //   tcpdatalength = pkthdr->len - sizeof(struct ether_header) - sizeof(struct iphdr) - tcpptr->th_off * 4;
    tcpdatalength = iplength - sizeof(struct iphdr) - tcpptr->th_off * 4;

    printf("data length = %d\n",tcpdatalength);

    if( tcpdatalength > 0 )
    {
        printf("------------------\n");
        printf("Content[%d]: \n%s\n",tcpdatalength,data);
    }

    return;
}

int main(int argc,char *argv[])
{
   // int i;
    char *dev;
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *descr;
    int id = 0;
    //const u_char *packet;
    //struct pcap_pkthdr hdr;
    //struct ether_header *eptr;

    if( argc !=2 )
    {
        fprintf(stdout,"Usage: %s numpackets\n",argv[0]);
        return 0;
    }

    dev = pcap_lookupdev(errbuf);
    if(dev == NULL)
    {
        printf("%s\n",errbuf);
        exit(0);
    }

    descr = pcap_open_live(dev, BUFSIZ, 1, -1, errbuf);
    if( descr==NULL )
    {
        printf("pcap_open_live(): %s\n",errbuf);
        exit(0);
    }


    struct bpf_program filter;
    //pcap_compile(descr, &filter, "(ip host 10.10.10.110) and (dst port 80 or src port 80)",1,0);
    pcap_compile(descr, &filter, "(ip host 10.10.10.110) and (tcp port 80)",1,0);
    pcap_setfilter(descr, &filter);

    pcap_loop(descr, atoi(argv[1]), fcb, (u_char *)&id );

    return 0;
}