#include <stdio.h>
#include <pcap/pcap.h>
#include <net/ethernet.h>
#include <arpa/inet.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
void Print_Ip(const void *);
void Print_Ether(const void *);
void HexaView(const void * , unsigned int);
int main()
{
char * cpNICName;//network interface
char caErrMsg[PCAP_ERRBUF_SIZE];
pcap_t * stpDS;
const unsigned char *ucpData;
struct pcap_pkthdr stInfo;
struct tcphdr * stTcp;
cpNICName = pcap_lookupdev(caErrMsg);
if(0 == cpNICName)
{
printf("ErrMsg : [%s]\n", caErrMsg);
return 0;
}
printf("NICName : [%s]\n", cpNICName);
stpDS = pcap_open_live(cpNICName, 1500, 1, 0, caErrMsg);
while(1)
{
ucpData = pcap_next(stpDS,&stInfo);
printf("Packet Length : %d Bytes\n", stInfo.len);
Print_Ether(ucpData);
if(ETH_P_IP == ntohs(*((short *)(ucpData+12))))
{
Print_Ip(ucpData+sizeof(struct ether_header));
}
if(*(ucpData+23)==IPPROTO_TCP)
{
stTcp = (struct tcphdr *)(ucpData
+ sizeof(struct ether_header)
+ ((*(ucpData + sizeof(struct ether_header))) & 0x0F)*4);
printf("Source Port : %d\n", ntohs(stTcp->source));
}
//HexaView(ucpData, 16 * 25);
}
pcap_close(stpDS);
return 0;
}
void Print_Ip(const void * vP)
{
struct ip const * v =vP;
int iCnt;
printf("IP version : %d\n",v->ip_v);
printf("Header Lengh : %d Bytes\n",v->ip_hl*4);
printf("Type of Service : 0x%02X\n", v->ip_tos);
printf("Total Packet Length : %d Bytes\n",ntohs(v->ip_len));
printf("Fragment Identifier : %d\n",ntohs(v->ip_id));
printf("reserved fragment flag : %d\n",(IP_RF == (IP_RF & v->ip_off)));
printf("dont fragment flag : %d\n", (IP_DF == (IP_DF & v->ip_off)));
printf("more fragments flag : %d\n", (IP_MF == (IP_MF & v->ip_off)));
printf("Fragmentaion offset : %d\n", (IP_OFFMASK & v->ip_off));
printf("Time To Live : %d\n",v->ip_ttl);
printf("Protcol Identifie : ");
switch(v->ip_p)
{
//IPPROTO_HOPOPTS = 0, /* IPv6 Hop-by-Hop options. */
case IPPROTO_IP :
printf("Dummy protocol for TCP.");
break;
case IPPROTO_ICMP:
printf("Internet Control Message Protocol.");
break;
case IPPROTO_IGMP:
printf("Internet Group Management Protocol.");
break;
case IPPROTO_IPIP:
printf("IPIP tunnels (older KA9Q tunnels use 94).");
break;
case IPPROTO_TCP:
printf("Transmission Control Protocol.");
break;
case IPPROTO_EGP:
printf("Exterior Gateway Protocol.");
break;
case IPPROTO_PUP:
printf("PUP protocol.");
break;
case IPPROTO_UDP:
printf("User Datagram Protocol.");
break;
}
putchar('\n');
printf("Checksum : %d\n",v->ip_sum);
printf("Source IP Address : %s\n", inet_ntoa(v->ip_src));
printf("Destination IP Address : %s\n", inet_ntoa(v->ip_dst));
#if 0
printf("Source IP Address : " );
for(iCnt = 0; iCnt < 4 ; ++iCnt)
{
printf("%d.",(char)(v->ip_src.s_addr >> (iCnt*8)));
}
printf("\b \n");
printf("Destination IP Address: ");
for(iCnt = 0; iCnt < 4 ; ++iCnt)
{
printf("%d.",(char)(v->ip_dst.s_addr >> (iCnt*8)));
}
printf("\b \n");
#endif
return;
}
void Print_Ether(const void * vP)
{
int iCnt;
printf("Dest MAC : ");
for(iCnt = 0; iCnt < ETH_ALEN ; ++iCnt)
{
printf("%02X:",((struct ether_header *)vP)->ether_dhost[iCnt]);
}
printf("\b \n");
printf("Src MAC : ");
for(iCnt = 0; iCnt < ETH_ALEN ; ++iCnt)
{
printf("%02X:",((struct ether_header *)vP)->ether_shost[iCnt]);
}
printf("\b \n");
printf("Next Layer :");
switch(ntohs(((struct ether_header *)vP)->ether_type))
{
case ETH_P_LOOP:
printf("Ethernet Loopback packet");
break;
case ETH_P_PUP:
printf("Xerox PUP packet");
break;
case ETH_P_PUPAT:
printf("Xerox PUP Addr Trans packet");
break;
case ETH_P_IP:
printf("Internet Protocol packet");
break;
case ETH_P_X25:
printf("CCITT X.25");
break;
case ETH_P_ARP:
printf("Address Resolution packet");
break;
case ETH_P_BPQ:
printf("G8BPQ AX.25 Ethernet Packet[ NOT AN OFFICIALLY REGISTERED ID ]");
break;
case ETH_P_IEEEPUP:
printf("Xerox IEEEBUP packet");
break;
case ETH_P_IEEEPUPAT:
printf("Xerox IEEE802.3 PUP Addr Trans packet");
break;
case ETH_P_DEC:
printf("DEC Assigned proto");
break;
case ETH_P_DNA_DL:
printf("DEC DNA Dump/Load");
break;
case ETH_P_DNA_RC:
printf("DEC DNA Remote Console");
break;
case ETH_P_DNA_RT:
printf("DEC DNA Routing");
break;
case ETH_P_LAT:
printf("DEC LAT");
break;
case ETH_P_DIAG:
printf("DEC Diagnostics");
break;
case ETH_P_CUST:
printf("DEC Customer use");
break;
case ETH_P_SCA:
printf("DEC Systems Comms Arch");
break;
case ETH_P_RARP:
printf("Reverse Addr Res packet");
break;
case ETH_P_ATALK:
printf("Appletalk DDP");
break;
case ETH_P_AARP:
printf("Appletalk AARP");
break;
case ETH_P_8021Q:
printf("802.1Q VLAN Extended Header");
break;
case ETH_P_IPX:
printf("IPX over DIX");
break;
case ETH_P_IPV6:
printf("IPv6 over bluebook");
break;
case ETH_P_PAUSE:
printf("IEEE Pause frames. See 802.3 31B");
break;
case ETH_P_SLOW:
printf("Slow Protocol. See 802.3ad 43B");
break;
case ETH_P_WCCP:
printf("Web-cache coordination protocol");
break;
case ETH_P_PPP_DISC:
printf("PPPoE discovery messages");
break;
case ETH_P_PPP_SES:
printf("PPPoE session messages");
break;
case ETH_P_MPLS_UC:
printf("MPLS Unicast traffic");
break;
case ETH_P_MPLS_MC:
printf("MPLS Multicast traffic");
break;
case ETH_P_ATMMPOA:
printf("MultiProtocol Over ATM");
break;
case ETH_P_ATMFATE:
printf("Frame-based ATM Transport");
break;
case ETH_P_AOE:
printf("ATA over Ethernet");
break;
case ETH_P_TIPC:
printf("TIPC");
break;
case ETH_P_802_3:
printf("Dummy type for 802.3 frames");
break;
case ETH_P_AX25:
printf("Dummy protocol id for AX.25");
break;
case ETH_P_ALL:
printf("Every packet (be careful!!!)");
break;
case ETH_P_802_2:
printf("802.2 frames");
break;
case ETH_P_SNAP:
printf("Internal only");
break;
case ETH_P_DDCMP:
printf("DEC DDCMP: Internal only");
break;
case ETH_P_WAN_PPP:
printf("Dummy type for WAN PPP frames");
break;
case ETH_P_PPP_MP:
printf("Dummy type for PPP MP frames");
break;
case ETH_P_LOCALTALK:
printf("Localtalk pseudo type");
break;
case ETH_P_CAN:
printf("Controller Area Network");
break;
case ETH_P_PPPTALK:
printf("Dummy type for Atalk over PPP");
break;
case ETH_P_TR_802_2:
printf("802.2 frames");
break;
case ETH_P_MOBITEX:
printf("Mobitex (kaz@cafe.net)");
break;
case ETH_P_CONTROL:
printf("Card specific control frames");
break;
case ETH_P_IRDA:
printf("Linux-IrDA");
break;
case ETH_P_ECONET:
printf("Acorn Econet");
break;
case ETH_P_HDLC:
printf("HDLC frames");
break;
case ETH_P_ARCNET:
printf("1A for ArcNet :-)");
break;
}
putchar('\n');
return;
}
/*
void HexaView(const void * vP, unsigned int uiLen)
{
unsigned int uiCnt;
unsigned int uiLine;
printf("===============================================================================\n");
printf(" Address Hexa ASCII \n");
printf("-------------------------------------------------------------------------------\n");
for (uiLine = 0; uiLine < uiLen; uiLine = uiLine + 16)
{
printf(" %08d ", uiLine);
//printf(" %08X ", vP);
for (uiCnt = 0; uiCnt < 16; ++uiCnt)
{
printf("%02X ", *((unsigned char *)vP));
vP = (char *)vP + 1;
}
putchar(' ');
vP = (char *)vP - 16;
for (uiCnt = 0; uiCnt < 16; ++uiCnt)
{
if (32 > *((unsigned char *)vP)) // ASCII 32 => SPACE // 제어문자 => '.'출력
{
putchar('.');
}
else if ( 127 < *((unsigned char *)vP)) // ASCII 128이상 (확장아스키) // 한글 => '.'출력
{
putchar('.');
}
else
{
printf("%c", *((unsigned char *)vP));
}
vP = (char *)vP + 1;
}
putchar('\n');
}
return;
}
*/
#if 0
pcap_t *pcap_open_live(const char *, int, int, int, char *);
// NETWORK
// MTU: maximum transmitter unit
// PROMISCUOUS:난잡한 :0- 가리지 않고 아무 패킷이나 다 들고옴
// INTERVAL : term
// void pcap_close(pcap_t *);
const u_char* pcap_next(pcap_t *, struct pcap_pkthdr *);
struct pcap_pkthdr {
struct timeval ts; /* time stamp */
bpf_u_int32 caplen; /* length of portion present */읽은 패킷 길이
bpf_u_int32 len; /* length this packet (off wire) */ 제공 길이
};
/* 10Mb/s ethernet header */
struct ether_header
{
u_int8_t ether_dhost[ETH_ALEN]; /* destination eth addr */목적지 MAC
u_int8_t ether_shost[ETH_ALEN]; /* source ether addr */자기 MAC
u_int16_t ether_type; /* packet type ID field */
} __attribute__ ((__packed__));
struct ip
{
#if __BYTE_ORDER == __LITTLE_ENDIAN
unsigned int ip_hl:4; /* header length */
unsigned int ip_v:4; /* version */
#endif
#if __BYTE_ORDER == __BIG_ENDIAN
unsigned int ip_v:4; /* version */
unsigned int ip_hl:4; /* header length */
#endifㅁ
u_int8_t ip_tos; /* type of service */
u_short ip_len; /* total length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_int8_t ip_ttl; /* time to live */
u_int8_t ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src, ip_dst; /* source and dest address */
};
struct iphdr
{
#if __BYTE_ORDER == __LITTLE_ENDIAN
unsigned int ihl:4;
unsigned int version:4;
#elif __BYTE_ORDER == __BIG_ENDIAN
unsigned int version:4;
unsigned int ihl:4;
#else
# error "Please fix <bits/endian.h>"
#endif
u_int8_t tos;
u_int16_t tot_len;
u_int16_t id;
u_int16_t frag_off;
u_int8_t ttl;
u_int8_t protocol;
u_int16_t check;
u_int32_t saddr;
u_int32_t daddr;
/*The options start here. */
};
# else /* !__FAVOR_BSD */
struct tcphdr
{
u_int16_t source;
u_int16_t dest;
u_int32_t seq;
u_int32_t ack_seq;
# if __BYTE_ORDER == __LITTLE_ENDIAN
u_int16_t res1:4;
u_int16_t doff:4;
u_int16_t fin:1;
u_int16_t syn:1;
u_int16_t rst:1;
u_int16_t psh:1;
u_int16_t ack:1;
u_int16_t urg:1;
u_int16_t res2:2;
# elif __BYTE_ORDER == __BIG_ENDIAN
u_int16_t doff:4;
u_int16_t res1:4;
u_int16_t res2:2;
u_int16_t urg:1;
u_int16_t ack:1;
u_int16_t psh:1;
u_int16_t rst:1;
u_int16_t syn:1;
u_int16_t fin:1;
# else
# error "Adjust your <bits/endian.h> defines"
# endif
u_int16_t window;
u_int16_t check;
u_int16_t urg_ptr;
};
# endif /* __FAVOR_BSD */
#endif
|
