linux下libpcap开发例子

实现功能：抓取分析TCP包

编译方法：

#gcc -c main.c tcp.c ip.c ether.c

#gcc -g -Wall -o mian mian.o ip.o tcp.o ether.o -lpcap

运行方法：

#./main eth2

main.c

#include <sys/types.h>
#include <arpa/inet.h>
#include <pcap.h>
#include <time.h>
#include <stdlib.h>
#include <stdio.h>
#include "lib.h"

int main(int argc,char *argv[])
{
  char errBuf[PCAP_ERRBUF_SIZE], * devStr;

  if(argc>1){
    devStr = argv[1];
  }
  else{
  /* get a device */
    devStr = pcap_lookupdev(errBuf);
  }

  if(devStr)
  {
    printf("success: device: %s\n", devStr);
  }
  else
  {
    printf("error: %s\n", errBuf);
    exit(1);
  }

  /* open a device, wait until a packet arrives */
  pcap_t * device = pcap_open_live(devStr, 65535, 1, 0, errBuf);

  if(!device)
  {
    printf("error: pcap_open_live(): %s\n", errBuf);
    exit(1);
  }

  /* construct a filter */
  struct bpf_program filter;
  pcap_compile(device, &filter, "port 80", 1, 0);
  pcap_setfilter(device, &filter);

  /* wait loop forever */
  int id = 0;
  pcap_loop(device, -1, getPacket, (u_char*)&id);

  pcap_close(device);

  return 0;
}

ip.c

 

#include <sys/types.h>
#include <arpa/inet.h>
#include <pcap.h>
#include <time.h>
#include <stdlib.h>
#include <stdio.h>

struct ip_header{
  u_int8_t ip_version: 4,ip_header_length: 4;
  u_int8_t ip_tos;
  u_int16_t ip_length;
  u_int16_t ip_id;
  u_int16_t ip_off;
  u_int8_t ip_ttl;
  u_int8_t ip_protocol;
  u_int16_t ip_checksum;
  struct in_addr ip_source_address;
  struct in_addr ip_destination_address;
};

void ip_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr *packet_header, const u_char *packet_content)
{
  struct ip_header *ip_protocol;
  u_int header_length;
  u_int offset;
  u_char tos;
  u_int16_t checksum;
  ip_protocol=(struct ip_header*)(packet_content + 14);
  checksum=ntohs(ip_protocol->ip_checksum);
  header_length = ip_protocol->ip_header_length * 4;
  tos=ip_protocol->ip_tos;
  offset=ntohs(ip_protocol->ip_off);
  printf("IP Version:%d\n",ip_protocol->ip_version);
  printf("Header length:%d\n",header_length);
  printf("TOS:%d\n",tos);
  printf("Total length:%d\n",ntohs(ip_protocol->ip_length));
  printf("Identification:%d\n",ntohs(ip_protocol->ip_id));
  printf("Offset:%d\n",(offset &0x1fff) *8);
  printf("TTL:%d\n",ip_protocol->ip_ttl);
  printf("Protocol:%d\n",ip_protocol->ip_protocol);
  switch (ip_protocol->ip_protocol)
  {
    case 6:
      printf("The Transport Layer Protocol is TCP\n");
      break;
    case 17:
      printf("The Transport Layer Protocol is UDP\n");
      break;
    case 1:
      printf("The Transport Layer Protocol is ICMP\n");
      break;
    default:
      break;
  }
  printf("Header checksum:%d\n",checksum);
  printf("Source address:%s\n",inet_ntoa(ip_protocol->ip_source_address));
  printf("Destination address:%s\n",inet_ntoa(ip_protocol->ip_destination_address));
  switch(ip_protocol->ip_protocol){
    case 6:
      tcp_protocol_packet_callback(argument,packet_header,packet_content);
      break;
    default:
      break;
  }
}

ether.c

 

#include <sys/types.h>
#include <arpa/inet.h>
#include <pcap.h>
#include <time.h>
#include <stdlib.h>
#include <stdio.h>

struct ether_header{
  u_int8_t ether_dhost[6];
  u_int8_t ether_shost[6];
  u_int16_t ether_type;
};

void getPacket(u_char * arg, const struct pcap_pkthdr * pkthdr, const u_char * packet)
{
  struct ip_header *ip_protocol;
  struct ether_header *ethernet_protocol;
  int * id = (int *)arg;
  u_char *mac_string;

  ethernet_protocol=(struct ether_header*)packet;
  u_short ethernet_type = ntohs(ethernet_protocol->ether_type);

  switch (ethernet_type){
    case 0x0800:
      printf("The network layer is IP protocol\n");
      break;
    case 0x0806:
      printf("The network layer is ARP protocol\n");
      break;
    case 0x8035:
      printf("The network layer is RAPR protocol\n");
      break;
    default:
      printf("The network laye protocol unknow\n");
      break;
  }

  printf("Mac Source Address is :\n");
  mac_string = ethernet_protocol->ether_shost;
  printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
  printf("id: %d\n", ++(*id));
  printf("Packet length: %d\n", pkthdr->len);
  printf("Number of bytes: %d\n", pkthdr->caplen);
  printf("Recieved time: %s", ctime((const time_t *)&pkthdr->ts.tv_sec));
  switch(ethernet_type){
    case 0x0800:
      ip_protocol_packet_callback(arg,pkthdr,packet);
      break;
    default:
      break;
  }
  printf("\n\n");
}

tcp.c

 

#include <sys/types.h>
#include <arpa/inet.h>
#include <pcap.h>
#include <time.h>
#include <stdlib.h>
#include <stdio.h>

struct tcp_header{
  u_int16_t sport;
  u_int16_t dport;
  u_int32_t sn;
  u_int32_t ack;
//  u_int16_t other;
#if BYTE_ORDER == LITTLE_ENDIAN
  u_char th_x2:4,
    th_off:4;
#endif
#if BYTE_ORDER == BIG_ENDIAN
  u_char th_off:4,
    th_x2:4;
#endif
  u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20

  u_int16_t win_size;
  u_int16_t checksum;
  u_int16_t urg_ptr;
};

void tcp_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr *packet_header, const u_char *packet_content)
{
  struct tcp_header *tcp_protocol;
  tcp_protocol=(struct tcp_header*)(packet_content + 14 + 20);
  u_short source_port=ntohs(tcp_protocol->sport);
  u_short destination_port=ntohs(tcp_protocol->dport);
  u_int sequence = ntohl(tcp_protocol->sn);
  u_int acknowledgement = ntohl(tcp_protocol->ack);
  u_char flags = tcp_protocol->th_flags;
  u_int16_t win_size = ntohl(tcp_protocol->win_size);
  u_int16_t checksum = ntohl(tcp_protocol->checksum);
  printf("Tcp Source Port:%d\n",source_port);
  printf("Tcp Destination Port:%d\n",destination_port);
  printf("Sequence Number:%u\n",sequence);
  printf("Acknowledgement Number:%u\n",acknowledgement);
  printf("Flags:");
  if(flags & 0x08)   printf("PSH ");
  if(flags & 0x10)   printf("ACK ");
  if(flags & 0x02)   printf("SYN ");
  if(flags & 0x20)   printf("URG ");
  if(flags & 0x01)   printf("FIN ");
  if(flags & 0x04)   printf("RST ");
  printf("\n");

  int i;
  for(i=0; i<packet_header->len; ++i)
  {
    printf(" %c", packet_content[i]);
    if( (i + 1) % 16 == 0 )
    {
      printf("\n");
    }
  }

}

lib.h

 

struct ether_header;
struct ip_header;
struct tcp_header;

void tcp_protocol_packet_callback(u_char *, const struct pcap_pkthdr *, const u_char *);
void ip_protocol_packet_callback(u_char *, const struct pcap_pkthdr *, const u_char *);
void getPacket(u_char *, const struct pcap_pkthdr *, const u_char *);