linux下用socket的抓包程序

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <arpa/inet.h>  
#include <netinet/ip.h> 
#include <string.h> 
#include <netdb.h> 
#include <netinet/tcp.h> 
#include <netinet/udp.h>
#include <stdlib.h> 
#include <unistd.h> 
#include <signal.h> 
#include <net/if.h> 
#include <sys/ioctl.h> 
#include <sys/stat.h> 
#include <fcntl.h> 
#include <linux/if_ether.h>
#include <net/ethernet.h>


void die(char *why, int n) 

  perror(why); 
  exit(n); 

int do_promisc(char *nif, int sock ) 

struct ifreq ifr; 
               
strncpy(ifr.ifr_name, nif,strlen(nif)+1); 
   if((ioctl(sock, SIOCGIFFLAGS, &ifr) == -1))  //获得flag
   {        
     die("ioctl", 2); 
   } 
  
   ifr.ifr_flags |= IFF_PROMISC;  //重置flag标志
 
   if(ioctl(sock, SIOCSIFFLAGS, &ifr) == -1 )  //改变模式
   {
     die("ioctl", 3); 
   } 

//修改网卡成PROMISC(混杂)模式

char buf[40960]; 

main() 

struct sockaddr_in addr;
struct ether_header *peth;
struct iphdr *pip;        
struct tcphdr *ptcp;
struct udphdr *pudp;

char mac[16];
int i,sock, r, len;        
char *data;
char *ptemp;
char ss[32],dd[32];

if((sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) == -1)  //建立socket
//man socket可以看到上面几个宏的意思
{
        die("socket", 1); 
}

do_promisc("eth0", sock);    //eth0为网卡名称

system("ifconfig");

for(;;) 

     len = sizeof(addr); 

     r = recvfrom(sock,(char *)buf,sizeof(buf), 0, (struct sockaddr *)&addr,&len); 
     //调试的时候可以增加一个输出r的语句判断是否抓到包
     buf[r] = 0; 
     ptemp = buf;
     peth = (struct ether_header *)ptemp;

     ptemp += sizeof(struct ether_header); //指针后移eth头的长度
     pip = (struct ip *)ptemp; //pip指向ip层的包头

     ptemp += sizeof(struct ip);//指针后移ip头的长度 

     switch(pip->protocol)   //根据不同协议判断指针类型
     {
         case IPPROTO_TCP:
         ptcp = (struct tcphdr *)ptemp;       //ptcp指向tcp头部
         printf("TCP pkt :FORM:[%s]:[%d]/n",inet_ntoa(*(struct in_addr*)&(pip->saddr)),ntohs(ptcp->source));
         printf("TCP pkt :TO:[%s]:[%d]/n",inet_ntoa(*(struct in_addr*)&(pip->daddr)),ntohs(ptcp->dest));
        
         break;
        
         case IPPROTO_UDP:
         pudp = (struct udphdr *)ptemp;      //ptcp指向udp头部 
              printf("UDP pkt:/n len:%d payload len:%d from %s:%d to %s:%d/n", 
             r, 
             ntohs(pudp->len),
             inet_ntoa(*(struct in_addr*)&(pip->saddr)),
             ntohs(pudp->source),
             inet_ntoa(*(struct in_addr*)&(pip->daddr)),
             ntohs(pudp->dest)
         ); 
         break;
        
         case  IPPROTO_ICMP:
         printf("ICMP pkt:%s/n",inet_ntoa(*(struct in_addr*)&(pip->saddr)));
         break;
        
         case  IPPROTO_IGMP:
         printf("IGMP pkt:/n");
         break;
        
         default:
         printf("Unkown pkt, protocl:%d/n", pip->protocol);
         break;
    } //end switch

perror("dump");
 }
 
}

/*
[playmud@fc3 test]$ gcc -v
Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.2/specs
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux
Thread model: posix
gcc version 3.4.2 20041017 (Red Hat 3.4.2-6.fc3)

************************eth的结构**************************************
struct ether_header
{
  u_int8_t  ether_dhost[ETH_ALEN];      // destination eth addr
  u_int8_t  ether_shost[ETH_ALEN];      // source ether addr   
  u_int16_t ether_type;                 // packet type ID field
} __attribute__ ((__packed__));

***********************IP的结构***********************************
struct iphdr
  {
#if __BYTE_ORDER == __LITTLE_ENDIAN
    unsigned int ihl:4;
    unsigned int version:4;
#elif __BYTE_ORDER == __BIG_ENDIAN
    unsigned int version:4;
    unsigned int ihl:4;
#else
# error "Please fix <bits/endian.h>"
#endif
    u_int8_t tos;
    u_int16_t tot_len;
    u_int16_t id;
    u_int16_t frag_off;
    u_int8_t ttl;
    u_int8_t protocol;
    u_int16_t check;
    u_int32_t saddr;
    u_int32_t daddr;
  };

***********************TCP的结构****************************
struct tcphdr
  {
    u_int16_t source;
    u_int16_t dest;
    u_int32_t seq;
    u_int32_t ack_seq;
#  if __BYTE_ORDER == __LITTLE_ENDIAN
    u_int16_t res1:4;
    u_int16_t doff:4;
    u_int16_t fin:1;
    u_int16_t syn:1;
    u_int16_t rst:1;
    u_int16_t psh:1;
    u_int16_t ack:1;
    u_int16_t urg:1;
    u_int16_t res2:2;
#  elif __BYTE_ORDER == __BIG_ENDIAN
    u_int16_t doff:4;
    u_int16_t res1:4;
    u_int16_t res2:2;
    u_int16_t urg:1;
    u_int16_t ack:1;
    u_int16_t psh:1;
    u_int16_t rst:1;
    u_int16_t syn:1;
    u_int16_t fin:1;
#  else
#   error "Adjust your <bits/endian.h> defines"
#  endif
    u_int16_t window;
    u_int16_t check;
    u_int16_t urg_ptr;
};
***********************UDP的结构*****************************
struct udphdr
{
  u_int16_t source;
  u_int16_t dest;
  u_int16_t len;
  u_int16_t check;
};

*************************************************************
*/

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
要使用socket抓包,需要在程序中创建一个原始套接字。下面是一个简单的示例程序,可以抓取指定IP地址和端口号的网络数据包: ```c #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/tcp.h> #define BUFSIZE 65536 int main(int argc, char *argv[]) { int sock_raw, sock_tcp, recv_len; char buffer[BUFSIZE]; struct sockaddr_in saddr; struct iphdr *iph; struct tcphdr *tcph; if (argc != 3) { printf("Usage: %s <source IP> <destination IP>\n", argv[0]); exit(1); } // 创建原始套接字 sock_raw = socket(AF_INET, SOCK_RAW, IPPROTO_TCP); if (sock_raw < 0) { perror("socket() error"); exit(1); } // 绑定原始套接字到指定源IP地址 saddr.sin_family = AF_INET; saddr.sin_addr.s_addr = inet_addr(argv[1]); if (bind(sock_raw, (struct sockaddr *)&saddr, sizeof(saddr)) < 0) { perror("bind() error"); close(sock_raw); exit(1); } // 过滤指定目的IP地址和端口号的数据包 struct sockaddr_in daddr; daddr.sin_family = AF_INET; daddr.sin_addr.s_addr = inet_addr(argv[2]); struct sock_filter filter[] = { {0x28, 0, 0, 0x0000000c}, {0x15, 0, 5, 0x00000800}, {0x20, 0, 0, 0x0000001e}, {0x15, 0, 3, daddr.sin_addr.s_addr}, {0x20, 0, 0, 0x00000022}, {0x15, 0, 1, 0x0000006f}, {0x6, 0, 0, 0x0000ffff}, {0x6, 0, 0, 0x00000000}, }; struct sock_fprog fprog; fprog.len = sizeof(filter)/sizeof(filter[0]); fprog.filter = filter; if (setsockopt(sock_raw, SOL_SOCKET, SO_ATTACH_FILTER, &fprog, sizeof(fprog)) < 0) { perror("setsockopt() error"); close(sock_raw); exit(1); } // 创建TCP套接字 sock_tcp = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (sock_tcp < 0) { perror("socket() error"); close(sock_raw); exit(1); } // 接收网络数据包并分析 while (1) { recv_len = recv(sock_raw, buffer, BUFSIZE, 0); if (recv_len < 0) { perror("recv() error"); close(sock_raw); close(sock_tcp); exit(1); } iph = (struct iphdr *)buffer; if (iph->protocol == IPPROTO_TCP) { tcph = (struct tcphdr *)(buffer + iph->ihl*4); if (ntohs(tcph->dest) == 80) { printf("Source IP: %s\n", inet_ntoa(*(struct in_addr *)&iph->saddr)); printf("Destination IP: %s\n", inet_ntoa(*(struct in_addr *)&iph->daddr)); printf("Source port: %d\n", ntohs(tcph->source)); printf("Destination port: %d\n", ntohs(tcph->dest)); } } } close(sock_raw); close(sock_tcp); return 0; } ``` 该示例程序使用了一个过滤器来过滤指定目的IP地址和端口号的数据包。过滤器是一个由一组过滤规则组成的程序,用于过滤网络数据包。在本示例中,过滤器使用了Linux内核提供的BPF虚拟机进行解释和执行。可以通过修改过滤器规则来实现更复杂的过滤功能。
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值