有时候需要自己编写代码进行抓包,以找出特殊意义的包。
关于目标IP和源IP在各个协议中的位置是不同的,这里只是解析了特殊的IP包报文和ARP包的报文,具体的内容可以参考文章列表中的各种报文介绍;
因为要求注释尽量不用中文,而且我的英文不好,所以请大家谅解;
下面是我的练习:
#include
#include
#include
#include
#include
#include
#include
int main (int argc, char *argv[])
{
int sockfd;
int ret = 0;
char buffer[1518] = {0};
char *eth_head = NULL;
/* PF_PACKET:链路层, SOCK_RAW: 包含 mac头, ETH_P_ALL: 所有协议 */
if ((sockfd = socket (PF_PACKET, SOCK_RAW, htons (ETH_P_ALL))) < 0)
{
printf ("create socket failed\n");
return -1;
}
while (1)
{
memset (buffer, 0x0, sizeof (buffer));
ret = recvfrom (sockfd, buffer, sizeof (buffer), 0, NULL, NULL);
printf ("recview package length : %d\n", ret);
eth_head = buffer;
printf ("PACKAGE START\n");
/* get source and dectination mac address */
printf ("dectination mac:%02x-%02x-%02x-%02x-%02x-%02x,"
"source mac:%02x-%02x-%02x-%02x-%02x-%02x;\n", eth_head[0],
eth_head[1], eth_head[2], eth_head[3], eth_head[4],
eth_head[5], eth_head[6], eth_head[7], eth_head[8],
eth_head[9], eth_head[10], eth_head[11]);
printf ("eth_type:%02x%02x\n", eth_head[12], eth_head[13]);
/* ARP protocol flag */
if (0x08 == eth_head[12] && 0x06 == eth_head[13])
{
printf ("ARP source ip:%d.%d.%d.%d,destination ip:%d.%d.%d.%d;\n",
eth_head[28], eth_head[29], eth_head[30], eth_head[31],
eth_head[38], eth_head[39], eth_head[40], eth_head[41]);
}
/* IPv4 protocol flag , include udp and tcp */
else if (0x08 == eth_head[12] && 0x00 == eth_head[13])
{
if (0x45 == eth_head[14])
{
printf ("IPv4 source ip:%d.%d.%d.%d,destination ip:%d.%d.%d."
"%d;\n", eth_head[26], eth_head[27], eth_head[28],
eth_head[29], eth_head[30], eth_head[31],
eth_head[32], eth_head[33]);
}
else
{
printf ("p_head:%02x\n", eth_head[14]);
}
}
printf ("PACKAGE END\n");
}
return 0; }