Linux抓包程序
#include <stdio.h>#include <stdlib.h>#include <sys/socket.h>#include <netinet/in.h>#include <arpa/inet.h>#include <netinet/ip.h>#include <string.h>#include <netdb.h>#include <netinet/tcp.h>#include <netinet/udp.h>#include <stdlib.h>#include <unistd.h>#include <signal.h>#include <net/if.h>#include <sys/ioctl.h>#include <sys/stat.h>#include <fcntl.h>#include <linux/if_ether.h>#include <net/ethernet.h>void die(char *why, int n){ perror(why); exit(n);}int do_promisc(char *nif, int sock ){ struct ifreq ifr; strncpy(ifr.ifr_name, nif,strlen(nif)+1); if((ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)) //获得flag { die("ioctl", 2); } ifr.ifr_flags |= IFF_PROMISC; //重置flag标志 if(ioctl(sock, SIOCSIFFLAGS, &ifr) == -1 ) //改变模式 { die("ioctl", 3); } return 0;}//修改网卡成PROMISC(混杂)模式/* =============================================================================================================下面是实现捕获和分析UDP协议数据包的函数定义 =============================================================================================================*/ void udp_protocol_packet_callback( u_char *packet_content) { struct udphdr *udp_protocol; // UDP协议数据变量 u_short source_port; // 源端口号 u_short destination_port; // 目的端口号 udp_protocol = (struct udphdr*)(packet_content + 14+20); // 获得UDP协议数据内容 source_port = ntohs(udp_protocol->source); // 获得源端口号 destination_port = ntohs(udp_protocol->dest); // 获得目的端口号 printf("---------- UDP Protocol (Transport Layer) ----------\n"); printf("Source port:%d\n", source_port); printf("Destination port:%d\n", destination_port); switch (destination_port) //根据端口号判断应用层协议类型 { case 138: printf("NETBIOS Datagram Service\n"); break; // 端口号为138，表示上层协议为NETBIOS 数据报服务 case 137: printf("NETBIOS Name Service\n"); break; // 端口号为137，表示上层协议为NETBIOS 名字服务 case 139: printf("NETBIOS session service\n"); break; // 端口号为139，表示上层协议为NETBIOS 会话服务 case 53: printf("name-domain server \n"); break; // 端口号为53，表示上层协议为域名服务 case 4000: printf("QQ server \n"); break; case 1863: printf("MSN server \n"); break; case 9001: printf("OTHERS \n"); break; default: printf("NOT WELL-KNOWN PROTOCOL.\n"); break; //其他没有分析 } } /* =============================================================================================================下面是实现捕获和分析TCP协议数据包的函数定义 =============================================================================================================*/ void tcp_protocol_packet_callback( u_char *packet_content) { struct tcphdr *tcp_protocol; // TCP协议数据变量 u_short source_port; // 源端口号 u_short destination_port; // 目的端口号 tcp_protocol = (struct tcphdr*)(packet_content + 14+20); // 获得UDP协议数据内容 source_port = ntohs(tcp_protocol->source); // 获得源端口号 destination_port = ntohs(tcp_protocol->dest); // 获得目的端口号 printf("---------- TCP Protocol (Transport Layer) ----------\n"); printf("Source port:%d\n", source_port); printf("Destination port:%d\n", destination_port); switch (destination_port) //根据端口号判断应用层协议类型 { case 7: printf("ECHO server \n"); break; case 21: printf("FTP server \n"); break; case 23: printf("TELNET server \n"); break; case 25: printf("SMTP server \n"); break; case 53: printf("DNS server \n"); break; case 80: printf("HTTP server \n"); break; case 2049: printf("NFS server \n"); break; case 6667: printf("IRCD server \n"); break; default: printf("NOT WELL-KNOWN PROTOCOL.\n"); break; //其他没有分析 } } /* =============================================================================================================下面是分析IP协议的函数的定义 ============================================================================================================= */ void ip_protocol_packet_callback( u_char *packet_content) { struct iphdr *ip_protocol; // IP协议变量 printf("---------- IP Protocol (Network Layer) ----------\n"); ip_protocol = (struct iphdr*)(packet_content + 14); //获得IP协议数据内容 printf("Protocol:%d\n", ip_protocol->protocol); //获得协议类型 switch (ip_protocol->protocol) // 根据协议类型判断 { case IPPROTO_TCP: printf("The Transport Layer Protocol is TCP\n"); break; /* 上层协议为TCP协议 */ case IPPROTO_UDP: printf("The Transport Layer Protocol is UDP\n"); break; /* 上层协议为UDP协议 */ case IPPROTO_ICMP: printf("The Transport Layer Protocol is ICMP\n"); break; /* 上层协议为ICMP协议 */ case IPPROTO_IGMP: printf("The Transport Layer Protocol is IGMP\n"); break; default: break; } printf("TCP pkt :FORM:[%s]\n",inet_ntoa(*(struct in_addr*)&(ip_protocol->saddr))); printf("TCP pkt :TO: [%s]\n",inet_ntoa(*(struct in_addr*)&(ip_protocol->daddr))); switch (ip_protocol->protocol) { case IPPROTO_TCP: tcp_protocol_packet_callback(packet_content); break; case IPPROTO_UDP: udp_protocol_packet_callback(packet_content); break; default: break; } } /*=============================================================================================================下面是分析以太网协议的回调函数的定义 =============================================================================================================*/ void ethernet_protocol_packet_callback( u_char *packet_content) { u_short ethernet_type; /* 以太网类型 */ struct ether_header *ethernet_protocol; /* 以太网协议变量 */ u_char *mac_string; /* 以太网地址 */ static int packet_number = 1; printf("**************************************************\n"); printf("The %d packet is captured.\n", packet_number); printf("-------- Ehternet Protocol (Link Layer) --------\n"); ethernet_protocol = (struct ether_header*)packet_content; /* 获得以太网协议数据内容 */ printf("Ethernet type is :\n"); ethernet_type = ntohs(ethernet_protocol->ether_type); /* 获得以太网类型 */ printf("%04x\n", ethernet_type); switch (ethernet_type) { case 0x0800: printf("The network layer is IP protocol\n"); break; /* 上层协议为IP协议 */ case 0x0806: printf("The network layer is ARP protocol\n"); printf("---------- ARP Protocol (Network Layer) ----------\n"); break; /* 上层协议为ARP协议 */ case 0x8035: printf("The network layer is RARP protocol\n"); printf("---------- RARP Protocol (Network Layer) ----------\n"); break; /* 上层协议为RARP协议 */ default: break; } switch (ethernet_type) { case 0x0800: ip_protocol_packet_callback( packet_content); break; // 上层协议为IP协议，就调用分析IP 协议的函数，注意参数的传递 default: printf("Mac Source Address is : \n"); mac_string = ethernet_protocol->ether_shost; printf("%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5)); //获得源以太网地址 printf("Mac Destination Address is : \n"); mac_string = ethernet_protocol->ether_dhost; printf("%02x:%02x:%02x:%02x:%02x:%02x\n", *mac_string, *(mac_string + 1), *(mac_string + 2), *(mac_string + 3), *(mac_string + 4), *(mac_string + 5)); // 获得目的以太网地址 break; } printf("**************************************************\n"); packet_number++; } char buf[40960];int main(){ struct sockaddr_in addr; int sock; int r = 0; socklen_t len = 0; u_char *ptemp; if((sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) == -1) //建立socket ，man socket可以看到上面几个宏的意思 { die("socket", 1); } do_promisc("eth0", sock); //eth0为网卡名称 system("ifconfig"); for(;;) { len = sizeof(addr); if(recvfrom(sock,(char *)buf,sizeof(buf), 0, (struct sockaddr *)&addr,&len) > 0){ } else{ continue; } //成功则返回接收到的字符数,失败返回-1,调试的时候可以增加一个输出r的语句判断是否抓到包 buf[r] = 0; ptemp = buf; ethernet_protocol_packet_callback(ptemp);//调用以太网协议的回调函数 usleep(1000); // perror("dump"); } return 0;}?