libpcap使用

最新推荐文章于 2022-11-21 01:18:35 发布

cmbj68996

最新推荐文章于 2022-11-21 01:18:35 发布

阅读量193

点赞数

文章标签：网络数据结构与算法

验证安装

引用pcap.h，确认是否能正常用libpcap开发

#include <stdio.h>
  #include <pcap.h>

  int main(int argc, char *argv[])
  {
     char *dev = argv[1];

     printf("Device: %s\n", dev);
     return(0);
  }

然后用-lpcap选项看能不能连接上

g++ -o a a.cc a.h -lpcap

用pcap_lookupdev获取默认设备

int main(int argc, char *argv[])
  {
    char *dev, errbuf[PCAP_ERRBUF_SIZE];
    dev = pcap_lookupdev(errbuf);
    if (dev == NULL) {
      fprintf(stderr, "%s\n", errbuf);
      return(2);
    }
    printf("Device: %s\n", dev);
    return(0);
  }

打开设备，返回一个pcap_t类型的“handle”。调用这个函数叫做“开启一个嗅探会话（sniffing session）”

pcap_t *pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)

参数

device：pcap_lookupdev返回的设备名，类似ethx的字符串

snaplen：抓包的buffer字节数

promisc：是否开启混杂模式

to_ms：超时，0表述无超时

ebuf：如果出错，会存入错误信息

errbuf[PCAP_ERRBUF_SIZE];
char* dev = pcap_lookupdev(errbuf);
pcap_t* handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
return(2);
}

过滤器

先要调用pcap_compile来编译过滤器

int pcap_compile(
  pcap_t *p, 由pcap_open_live返回的“handle”
  struct bpf_program *fp, 存放编译好的过滤器的数据结构
  char *str, 过滤器表达式，如“port 23”
  int optimize, 表达式是否需要被“优化”, 取值0或1
  bpf_u_int32 netmask 有pcap_lookupnet函数获取的netmask
  )

过滤器编译好之后就可以设置到pcap_t里

int pcap_setfilter(pcap_t *p, struct bpf_program *fp)

pcap_t *handle; /* Session handle */
char dev[] = "rl0"; /* Device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter expression */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* The netmask of our sniffing device */
bpf_u_int32 net; /* The IP of our sniffing device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Can't get netmask for device %s\n", dev);
net = 0;
mask = 0;
}
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
return(2);
}
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}

实际抓包

struct pcap_pkthdr header; /* The header that pcap gives us */
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
packet = pcap_next(handle, &header); pcap_close(handle);

调用上面的pcap_next函数可以得到header和packet

但是pcap_next只能抓一个包，libpcap提供了循环抓包的函数

int pcap_loop(
  pcap_t *p, //由pcap_open_live返回的“handle”
  int cnt, //抓多少个包
  pcap_handler callback, //抓到包后的回调函数
  u_char *user // 这个参数是用户自定义的，libpcap会自动将这个值传给回调函数
  )

回调函数的形式

重点是header和packet两个参数

void got_packet(
  u_char *args, // 这个就是pcap_loop的最后一个参数u_char *user
  const struct pcap_pkthdr *header,
  const u_char *packet
  );

header的内容

点击(此处)折叠或打开

struct pcap_pkthdr {
    struct timeval ts; /* time stamp */
    bpf_u_int32 caplen; /* length of portion present */
    bpf_u_int32 len; /* length this packet (off wire) */
  };

packet是一个u_char*，执行一块数据，这块数据可以被转换为下面几个结构体

#define SIZE_ETHERNET 14

const struct sniff_ethernet /* The ethernet header */

const struct sniff_ip /* The IP header */

const struct sniff_tcp /* The TCP header */

以及

const char *payload; /* Packet payload */

这些数据结构介绍如下

/* Ethernet addresses are 6 bytes */
#define ETHER_ADDR_LEN 6

  /* Ethernet header */
  struct sniff_ethernet {
    u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
    u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
    u_short ether_type; /* IP? ARP? RARP? etc */
  };

  /* IP header */
  struct sniff_ip {
    u_char ip_vhl; /* version << 4 | header length >> 2 */
    u_char ip_tos; /* type of service */
    u_short ip_len; /* total length */
    u_short ip_id; /* identification */
    u_short ip_off; /* fragment offset field */
  #define IP_RF 0x8000 /* reserved fragment flag */
  #define IP_DF 0x4000 /* dont fragment flag */
  #define IP_MF 0x2000 /* more fragments flag */
  #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
    u_char ip_ttl; /* time to live */
    u_char ip_p; /* protocol */
    u_short ip_sum; /* checksum */
    struct in_addr ip_src,ip_dst; /* source and dest address */
  };
  #define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
  #define IP_V(ip) (((ip)->ip_vhl) >> 4)

  /* TCP header */
  typedef u_int tcp_seq;

  struct sniff_tcp {
    u_short th_sport; /* source port */
    u_short th_dport; /* destination port */
    tcp_seq th_seq; /* sequence number */
    tcp_seq th_ack; /* acknowledgement number */
    u_char th_offx2; /* data offset, rsvd */
  #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
    u_char th_flags;
  #define TH_FIN 0x01
  #define TH_SYN 0x02
  #define TH_RST 0x04
  #define TH_PUSH 0x08
  #define TH_ACK 0x10
  #define TH_URG 0x20
  #define TH_ECE 0x40
  #define TH_CWR 0x80
  #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
    u_short th_win; /* window */
    u_short th_sum; /* checksum */
    u_short th_urp; /* urgent pointer */
};

将u_char *packet转换成这些结构体的方法：

#define SIZE_ETHERNET 14

  const struct sniff_ethernet *ethernet; /* The ethernet header */
  const struct sniff_ip *ip; /* The IP header */
  const struct sniff_tcp *tcp; /* The TCP header */
  const char *payload; /* Packet payload */

  u_int size_ip;
  u_int size_tcp;

  ethernet = (struct sniff_ethernet*)(packet);
  ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);   size_ip = IP_HL(ip)*4;
  if (size_ip < 20) {
    printf(" * Invalid IP header length: %u bytes\n", size_ip);
    return;
  }
  tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);   size_tcp = TH_OFF(tcp)*4;
  if (size_tcp < 20) {
    printf(" * Invalid TCP header length: %u bytes\n", size_tcp);
    return;
  }
  payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);

Variable	Location (in bytes)
sniff_ethernet	X
sniff_ip	X + SIZE_ETHERNET
sniff_tcp	X + SIZE_ETHERNET + {IP header length}
payload	X + SIZE_ETHERNET + {IP header length} + {TCP header length}

程序

[root@localhost cc]# cat cap.c
#include "a.h"
#define SIZE_ETHERNET 14
char errbuf[PCAP_ERRBUF_SIZE];
int addr_ntoa(int i_addr, char* str_addr)
{
if(str_addr == NULL)
{
return -1;
}
struct in_addr addr;
addr.s_addr = i_addr;
char* tmp = inet_ntoa(addr);
strcpy(str_addr, tmp);
return 0;
}
int errstr(int ret, char* str)
{
if(str != NULL) fprintf(stderr, "%s\n", str);
exit(ret);
}
int err(int ret)
{
errstr(ret, errbuf);
}
void got_packet(u_char* args, const struct pcap_pkthdr* header, const u_char* packet)
{
u_int size_ip;
u_int size_tcp;
const struct sniff_ethernet *ethernet;
const struct sniff_ip *ip;
const struct sniff_tcp *tcp;
const char *payload;
ethernet = (struct sniff_ethernet*)(packet);
ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
if((size_ip = IP_HL(ip)*4) < 20) return;
tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
if((size_tcp = TH_OFF(tcp)*4) < 20) return;
char ip_src[16];
char ip_dst[16];
addr_ntoa(ip->ip_src.s_addr, ip_src);
addr_ntoa(ip->ip_dst.s_addr, ip_dst);
printf("%s:%d>> %s:%d\n", ip_src, ntohs(tcp->th_sport), ip_dst, ntohs(tcp->th_dport));
struct ether_header *eptr = (struct ether_header *) packet;
u_int8_t* ptr;
ptr = eptr->ether_shost;
int i = ETHER_ADDR_LEN;
printf("src MAC: [");
do
{
printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
}
while(--i>0);
printf("]\n");
ptr = eptr->ether_dhost;
i = ETHER_ADDR_LEN;
printf("dest MAC: [");
do
{
printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
}
while(--i>0);
printf("]\n");
struct tm* local = localtime(&(header->ts));
printf("time: %d:%d:%d\n",local->tm_hour,local->tm_min,local->tm_sec);
printf("package length: %d\n", header->len);
printf("TTL: %d\n", ip->ip_ttl);
printf("\n");
}
int main()
{
char* dev;
bpf_u_int32 mask;
bpf_u_int32 net;
pcap_t *handle;
if ((dev = pcap_lookupdev(errbuf)) == NULL) err(-1);
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) err(-1);
char strnet[16];
char strmask[16];
addr_ntoa(net, strnet);
addr_ntoa(mask, strmask);
printf("\nMonitoring: %s/%s/%s\n\n", dev, strnet, strmask);
if((handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf)) == NULL) err(-1);
if((pcap_loop(handle, 10, got_packet, "test1")) < 0) err(-1);
return 0;
}