linux下用socket的抓包程序

最新推荐文章于 2022-08-27 16:31:17 发布

playmud

最新推荐文章于 2022-08-27 16:31:17 发布

阅读量3.3k

点赞数

分类专栏： network linux/unix 文章标签： socket linux struct header byte tcp

本文链接：https://blog.csdn.net/playmud/article/details/381638

版权

linux/unix 同时被 2 个专栏收录

16 篇文章 0 订阅

订阅专栏

network

5 篇文章 0 订阅

订阅专栏

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/ip.h>
#include <string.h>
#include <netdb.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <net/if.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <linux/if_ether.h>
#include <net/ethernet.h>

void die(char *why, int n)
{
perror(why);
exit(n);
}

int do_promisc(char *nif, int sock )
{
struct ifreq ifr;

strncpy(ifr.ifr_name, nif,strlen(nif)+1);
   if((ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)) //获得flag
   {
     die("ioctl", 2);
   }

   ifr.ifr_flags |= IFF_PROMISC; //重置flag标志

   if(ioctl(sock, SIOCSIFFLAGS, &ifr) == -1 ) //改变模式
   {
     die("ioctl", 3);
   }
}
//修改网卡成PROMISC(混杂)模式

char buf[40960];

main()
{
struct sockaddr_in addr;
struct ether_header *peth;
struct iphdr *pip;
struct tcphdr *ptcp;
struct udphdr *pudp;

char mac[16];
int i,sock, r, len;
char *data;
char *ptemp;
char ss[32],dd[32];

if((sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) == -1) //建立socket
//man socket可以看到上面几个宏的意思
{
die("socket", 1);
}

do_promisc("eth0", sock); //eth0为网卡名称

system("ifconfig");

for(;;)
{
len = sizeof(addr);

     r = recvfrom(sock,(char *)buf,sizeof(buf), 0, (struct sockaddr *)&addr,&len);
     //调试的时候可以增加一个输出r的语句判断是否抓到包
     buf[r] = 0;
     ptemp = buf;
     peth = (struct ether_header *)ptemp;

ptemp += sizeof(struct ether_header); //指针后移eth头的长度
pip = (struct ip *)ptemp; //pip指向ip层的包头

ptemp += sizeof(struct ip);//指针后移ip头的长度

     switch(pip->protocol)   //根据不同协议判断指针类型
     {
         case IPPROTO_TCP:
         ptcp = (struct tcphdr *)ptemp;       //ptcp指向tcp头部
         printf("TCP pkt :FORM:[%s]:[%d]/n",inet_ntoa(*(struct in_addr*)&(pip->saddr)),ntohs(ptcp->source));
         printf("TCP pkt :TO:[%s]:[%d]/n",inet_ntoa(*(struct in_addr*)&(pip->daddr)),ntohs(ptcp->dest));

         break;

         case IPPROTO_UDP:
         pudp = (struct udphdr *)ptemp;      //ptcp指向udp头部
              printf("UDP pkt:/n len:%d payload len:%d from %s:%d to %s:%d/n",
             r,
             ntohs(pudp->len),
             inet_ntoa(*(struct in_addr*)&(pip->saddr)),
             ntohs(pudp->source),
             inet_ntoa(*(struct in_addr*)&(pip->daddr)),
             ntohs(pudp->dest)
         );
         break;

         case IPPROTO_ICMP:
         printf("ICMP pkt:%s/n",inet_ntoa(*(struct in_addr*)&(pip->saddr)));
         break;

         case IPPROTO_IGMP:
         printf("IGMP pkt:/n");
         break;

         default:
         printf("Unkown pkt, protocl:%d/n", pip->protocol);
         break;
    } //end switch

perror("dump");
}

}

/*
[playmud@fc3 test]$ gcc -v
Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.2/specs
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux
Thread model: posix
gcc version 3.4.2 20041017 (Red Hat 3.4.2-6.fc3)

************************eth的结构**************************************
struct ether_header
{
u_int8_t ether_dhost[ETH_ALEN];      // destination eth addr
u_int8_t ether_shost[ETH_ALEN];      // source ether addr
u_int16_t ether_type;                 // packet type ID field
} __attribute__ ((__packed__));

***********************IP的结构***********************************
struct iphdr
{
#if __BYTE_ORDER == __LITTLE_ENDIAN
    unsigned int ihl:4;
    unsigned int version:4;
#elif __BYTE_ORDER == __BIG_ENDIAN
    unsigned int version:4;
    unsigned int ihl:4;
#else
# error "Please fix <bits/endian.h>"
#endif
    u_int8_t tos;
    u_int16_t tot_len;
    u_int16_t id;
    u_int16_t frag_off;
    u_int8_t ttl;
    u_int8_t protocol;
    u_int16_t check;
    u_int32_t saddr;
    u_int32_t daddr;
};

***********************TCP的结构****************************
struct tcphdr
{
    u_int16_t source;
    u_int16_t dest;
    u_int32_t seq;
    u_int32_t ack_seq;
# if __BYTE_ORDER == __LITTLE_ENDIAN
    u_int16_t res1:4;
    u_int16_t doff:4;
    u_int16_t fin:1;
    u_int16_t syn:1;
    u_int16_t rst:1;
    u_int16_t psh:1;
    u_int16_t ack:1;
    u_int16_t urg:1;
    u_int16_t res2:2;
# elif __BYTE_ORDER == __BIG_ENDIAN
    u_int16_t doff:4;
    u_int16_t res1:4;
    u_int16_t res2:2;
    u_int16_t urg:1;
    u_int16_t ack:1;
    u_int16_t psh:1;
    u_int16_t rst:1;
    u_int16_t syn:1;
    u_int16_t fin:1;
# else
#   error "Adjust your <bits/endian.h> defines"
# endif
    u_int16_t window;
    u_int16_t check;
    u_int16_t urg_ptr;
};
***********************UDP的结构*****************************
struct udphdr
{
u_int16_t source;
u_int16_t dest;
u_int16_t len;
u_int16_t check;
};