ITPub博客
首页 博客 专栏 学院 社区 IT新媒体评选
发博

首页 > 应用开发 > IT综合 > libpcap使用

libpcap使用

原创 IT综合 作者：liiinuuux 时间：2016-06-24 11:15:01 0 删除 编辑
验证安装
引用pcap.h，确认是否能正常用libpcap开发
  1. #include <stdio.h>
  2.   #include <pcap.h>

  4.   int main(int argc, char *argv[])
  5.   {
  6.      char *dev = argv[1];

  8.      printf("Device: %s\n", dev);
  9.      return(0);
  10.   }


然后用-lpcap选项看能不能连接上
g++ -o a a.cc a.h -lpcap


用pcap_lookupdev获取默认设备
  1. int main(int argc, char *argv[])
  2.   {
  3.     char *dev, errbuf[PCAP_ERRBUF_SIZE];
  4.     dev = pcap_lookupdev(errbuf);
  5.     if (dev == NULL) {
  6.       fprintf(stderr, "%s\n", errbuf);
  7.       return(2);
  8.     }
  9.     printf("Device: %s\n", dev);
  10.     return(0);
  11.   }




打开设备，返回一个pcap_t类型的“handle”。调用这个函数叫做“开启一个嗅探会话（sniffing session）”
pcap_t *pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
参数
device：pcap_lookupdev返回的设备名，类似ethx的字符串
snaplen：抓包的buffer字节数
promisc：是否开启混杂模式
to_ms：超时，0表述无超时
ebuf：如果出错，会存入错误信息

  1. errbuf[PCAP_ERRBUF_SIZE];
  2.    char* dev = pcap_lookupdev(errbuf);
  3.    pcap_t* handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
  4.    if (handle == NULL) {
  5.      fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
  6.      return(2);
  7.    }

过滤器
先要调用pcap_compile来编译过滤器
  1. int pcap_compile(
  2.   pcap_t *p, 由pcap_open_live返回的“handle”
  3.   struct bpf_program *fp, 存放编译好的过滤器的数据结构
  4.   char *str, 过滤器表达式，如“port 23”
  5.   int optimize, 表达式是否需要被“优化”, 取值0或1
  6.   bpf_u_int32 netmask 有pcap_lookupnet函数获取的netmask
  7.   )

过滤器编译好之后就可以设置到pcap_t里
int pcap_setfilter(pcap_t *p, struct bpf_program *fp)


  1. pcap_t *handle; /* Session handle */
  2.    char dev[] = "rl0"; /* Device to sniff on */
  3.    char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
  4.    struct bpf_program fp; /* The compiled filter expression */
  5.    char filter_exp[] = "port 23"; /* The filter expression */
  6.    bpf_u_int32 mask; /* The netmask of our sniffing device */
  7.    bpf_u_int32 net; /* The IP of our sniffing device */

  9.    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
  10.      fprintf(stderr, "Can't get netmask for device %s\n", dev);
  11.      net = 0;
  12.      mask = 0;
  13.    }
  14.    handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
  15.    if (handle == NULL) {
  16.      fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
  17.      return(2);
  18.    }
  19.    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
  20.      fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
  21.      return(2);
  22.    }
  23.    if (pcap_setfilter(handle, &fp) == -1) {
  24.      fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
  25.      return(2);
  26.    }




实际抓包
  1. struct pcap_pkthdr header; /* The header that pcap gives us */
  2. handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
  3. packet = pcap_next(handle, &header);
  4. pcap_close(handle);

调用上面的pcap_next函数可以得到header和packet
但是pcap_next只能抓一个包，libpcap提供了循环抓包的函数
  1. int pcap_loop(
  2.   pcap_t *p, //由pcap_open_live返回的“handle”
  3.   int cnt, //抓多少个包
  4.   pcap_handler callback, //抓到包后的回调函数
  5.   u_char *user // 这个参数是用户自定义的，libpcap会自动将这个值传给回调函数
  6.   )


回调函数的形式
重点是header和packet两个参数
  1. void got_packet(
  2.   u_char *args, // 这个就是pcap_loop的最后一个参数u_char *user
  3.   const struct pcap_pkthdr *header,
  4.   const u_char *packet
  5.   );



header的内容

点击(此处)折叠或打开

  1. struct pcap_pkthdr {
  2.     struct timeval ts; /* time stamp */
  3.     bpf_u_int32 caplen; /* length of portion present */
  4.     bpf_u_int32 len; /* length this packet (off wire) */
  5.   };


packet是一个u_char*，执行一块数据，这块数据可以被转换为下面几个结构体
#define SIZE_ETHERNET 14
const struct sniff_ethernet /* The ethernet header */
const struct sniff_ip /* The IP header */
const struct sniff_tcp /* The TCP header */
以及
const char *payload; /* Packet payload */



这些数据结构介绍如下
  1. /* Ethernet addresses are 6 bytes */
  2. #define ETHER_ADDR_LEN 6

  4.   /* Ethernet header */
  5.   struct sniff_ethernet {
  6.     u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
  7.     u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
  8.     u_short ether_type; /* IP? ARP? RARP? etc */
  9.   };

  11.   /* IP header */
  12.   struct sniff_ip {
  13.     u_char ip_vhl; /* version << 4 | header length >> 2 */
  14.     u_char ip_tos; /* type of service */
  15.     u_short ip_len; /* total length */
  16.     u_short ip_id; /* identification */
  17.     u_short ip_off; /* fragment offset field */
  18.   #define IP_RF 0x8000 /* reserved fragment flag */
  19.   #define IP_DF 0x4000 /* dont fragment flag */
  20.   #define IP_MF 0x2000 /* more fragments flag */
  21.   #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
  22.     u_char ip_ttl; /* time to live */
  23.     u_char ip_p; /* protocol */
  24.     u_short ip_sum; /* checksum */
  25.     struct in_addr ip_src,ip_dst; /* source and dest address */
  26.   };
  27.   #define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
  28.   #define IP_V(ip) (((ip)->ip_vhl) >> 4)

  30.   /* TCP header */
  31.   typedef u_int tcp_seq;

  33.   struct sniff_tcp {
  34.     u_short th_sport; /* source port */
  35.     u_short th_dport; /* destination port */
  36.     tcp_seq th_seq; /* sequence number */
  37.     tcp_seq th_ack; /* acknowledgement number */
  38.     u_char th_offx2; /* data offset, rsvd */
  39.   #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
  40.     u_char th_flags;
  41.   #define TH_FIN 0x01
  42.   #define TH_SYN 0x02
  43.   #define TH_RST 0x04
  44.   #define TH_PUSH 0x08
  45.   #define TH_ACK 0x10
  46.   #define TH_URG 0x20
  47.   #define TH_ECE 0x40
  48.   #define TH_CWR 0x80
  49.   #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
  50.     u_short th_win; /* window */
  51.     u_short th_sum; /* checksum */
  52.     u_short th_urp; /* urgent pointer */
  53. };


将u_char *packet转换成这些结构体的方法：
  1. #define SIZE_ETHERNET 14

  3.   const struct sniff_ethernet *ethernet; /* The ethernet header */
  4.   const struct sniff_ip *ip; /* The IP header */
  5.   const struct sniff_tcp *tcp; /* The TCP header */
  6.   const char *payload; /* Packet payload */

  8.   u_int size_ip;
  9.   u_int size_tcp;

  11.   ethernet = (struct sniff_ethernet*)(packet);
  12.   ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
  13.   size_ip = IP_HL(ip)*4;
  14.   if (size_ip < 20) {
  15.     printf(" * Invalid IP header length: %u bytes\n", size_ip);
  16.     return;
  17.   }
  18.   tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
  19.   size_tcp = TH_OFF(tcp)*4;
  20.   if (size_tcp < 20) {
  21.     printf(" * Invalid TCP header length: %u bytes\n", size_tcp);
  22.     return;
  23.   }
  24.   payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);



Variable Location (in bytes)
sniff_ethernet X
sniff_ip X + SIZE_ETHERNET
sniff_tcp X + SIZE_ETHERNET + {IP header length}
payload X + SIZE_ETHERNET + {IP header length} + {TCP header length}





程序

  1. [root@localhost cc]# cat cap.c
  2. #include "a.h"

  4. #define SIZE_ETHERNET 14

  6. char errbuf[PCAP_ERRBUF_SIZE];

  8. int addr_ntoa(int i_addr, char* str_addr)
  9. {
  10.     if(str_addr == NULL)
  11.     {
  12.         return -1;
  13.     }
  14.     struct in_addr addr;
  15.     addr.s_addr = i_addr;
  16.     char* tmp = inet_ntoa(addr);
  17.     strcpy(str_addr, tmp);
  18.     return 0;
  19. }


  22. int errstr(int ret, char* str)
  23. {
  24.     if(str != NULL) fprintf(stderr, "%s\n", str);
  25.     exit(ret);
  26. }

  28. int err(int ret)
  29. {
  30.     errstr(ret, errbuf);
  31. }



  35. void got_packet(u_char* args, const struct pcap_pkthdr* header, const u_char* packet)
  36. {
  37.     u_int size_ip;
  38.     u_int size_tcp;
  39.     const struct sniff_ethernet *ethernet;
  40.     const struct sniff_ip *ip;
  41.     const struct sniff_tcp *tcp;
  42.     const char *payload;

  44.     ethernet = (struct sniff_ethernet*)(packet);

  46.     ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
  47.     if((size_ip = IP_HL(ip)*4) < 20) return;
  48.     tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
  49.     if((size_tcp = TH_OFF(tcp)*4) < 20) return;


  52.     char ip_src[16];
  53.     char ip_dst[16];
  54.     addr_ntoa(ip->ip_src.s_addr, ip_src);
  55.     addr_ntoa(ip->ip_dst.s_addr, ip_dst);
  56.     printf("%s:%d>> %s:%d\n", ip_src, ntohs(tcp->th_sport), ip_dst, ntohs(tcp->th_dport));

  58.     struct ether_header *eptr = (struct ether_header *) packet;
  59.         u_int8_t* ptr;
  60.     ptr = eptr->ether_shost;
  61.     int i = ETHER_ADDR_LEN;
  62.     printf("src MAC: [");
  63.     do
  64.     {
  65.     printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
  66.     }
  67.     while(--i>0);
  68.     printf("]\n");

  70.     ptr = eptr->ether_dhost;
  71.     i = ETHER_ADDR_LEN;
  72.     printf("dest MAC: [");
  73.     do
  74.     {
  75.     printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
  76.     }
  77.     while(--i>0);
  78.     printf("]\n");

  80.     struct tm* local = localtime(&(header->ts));

  82.     printf("time: %d:%d:%d\n",local->tm_hour,local->tm_min,local->tm_sec);
  83.     printf("package length: %d\n", header->len);
  84.     printf("TTL: %d\n", ip->ip_ttl);


  87.     printf("\n");
  88. }


  91. int main()
  92. {
  93.     char* dev;
  94.     bpf_u_int32 mask;
  95.     bpf_u_int32 net;
  96.     pcap_t *handle;

  98.     if ((dev = pcap_lookupdev(errbuf)) == NULL) err(-1);
  99.     if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) err(-1);

  101.     char strnet[16];
  102.     char strmask[16];
  103.     addr_ntoa(net, strnet);
  104.     addr_ntoa(mask, strmask);
  105.     printf("\nMonitoring: %s/%s/%s\n\n", dev, strnet, strmask);

  107.     if((handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf)) == NULL) err(-1);
  108.     if((pcap_loop(handle, 10, got_packet, "test1")) < 0) err(-1);

  110.     return 0;
  111. }




头文件里的结构体来自tcpdump官网的文章，其实就是按照包头的格式设置变量大小和顺序。

  1. [root@localhost cc]# cat cap.h
  2. #include <string.h>
  3. #include <pcap.h>
  4. #include <sys/socket.h>
  5. #include <netinet/in.h>
  6. #include <arpa/inet.h>
  7. #include <netinet/if_ether.h>
  8. #include <unistd.h>
  9. #include <stdlib.h>
  10. #include <net/ethernet.h>
  11. #include <time.h>

  13. /* Ethernet addresses are 6 bytes */
  14. //#define ETHER_ADDR_LEN 6

  16. /* Ethernet header */
  17. struct sniff_ethernet {
  18.     u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
  19.     u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
  20.     u_short ether_type; /* IP? ARP? RARP? etc */
  21. };

  23. /* IP header */
  24. struct sniff_ip {
  25.     u_char ip_vhl; /* version << 4 | header length >> 2 */
  26.     u_char ip_tos; /* type of service */
  27.     u_short ip_len; /* total length */
  28.     u_short ip_id; /* identification */
  29.     u_short ip_off; /* fragment offset field */
  30. #define IP_RF 0x8000 /* reserved fragment flag */
  31. #define IP_DF 0x4000 /* dont fragment flag */
  32. #define IP_MF 0x2000 /* more fragments flag */
  33. #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
  34.     u_char ip_ttl; /* time to live */
  35.     u_char ip_p; /* protocol */
  36.     u_short ip_sum; /* checksum */
  37.     struct in_addr ip_src,ip_dst; /* source and dest address */
  38. };
  39. #define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
  40. #define IP_V(ip) (((ip)->ip_vhl) >> 4)

  42. /* TCP header */
  43. typedef u_int tcp_seq;

  45. struct sniff_tcp {
  46.     u_short th_sport; /* source port */
  47.     u_short th_dport; /* destination port */
  48.     tcp_seq th_seq; /* sequence number */
  49.     tcp_seq th_ack; /* acknowledgement number */
  50.     u_char th_offx2; /* data offset, rsvd */
  51. #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
  52.     u_char th_flags;
  53. #define TH_FIN 0x01
  54. #define TH_SYN 0x02
  55. #define TH_RST 0x04
  56. #define TH_PUSH 0x08
  57. #define TH_ACK 0x10
  58. #define TH_URG 0x20
  59. #define TH_ECE 0x40
  60. #define TH_CWR 0x80
  61. #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
  62.     u_short th_win; /* window */
  63.     u_short th_sum; /* checksum */
  64.     u_short th_urp; /* urgent pointer */
  65. };



执行效果
[root@localhost cc]# ./cap

Monitoring: enp0s8/192.168.1.0/255.255.255.0

192.168.1.66:22>> 192.168.1.1:52672
src MAC: [ 8:0:27:80:ff:b0]
dest MAC: [ a:0:27:0:0:0]
time: 15:25:4
package length: 154
TTL: 64

192.168.1.1:52672>> 192.168.1.66:22
src MAC: [ a:0:27:0:0:0]
dest MAC: [ 8:0:27:80:ff:b0]
time: 15:25:4
package length: 60
TTL: 64

192.168.1.66:22>> 192.168.1.1:52672
src MAC: [ 8:0:27:80:ff:b0]
dest MAC: [ a:0:27:0:0:0]
time: 15:25:4
package length: 378
TTL: 64

192.168.1.66:22>> 192.168.1.1:52672
src MAC: [ 8:0:27:80:ff:b0]
dest MAC: [ a:0:27:0:0:0]
time: 15:25:4
package length: 234
TTL: 64
...
...


来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/26239116/viewspace-2120890/ ，如需转载，请注明出处，否则将追究法律责任。

0
0
上一篇： mmap
下一篇： 接管子进程的标准输入输出
请登录后发表评论 登录
全部评论
liiinuuux

注册时间：2012-11-12

  • 博文量
    94
  • 访问量
    353448

最新文章

支持我们 作者招募 用户协议 FAQ Contact Us

北京盛拓优讯信息技术有限公司. 版权所有  京ICP备16024965号-8 北京市公安局海淀分局网监中心备案编号：11010802021510 niuxiaotong@pcpop.com 17352615567 未成年人举报专区

广播电视节目制作经营许可证(京) 字第1234号 中国互联网协会会员

违法和不良信息举报电话:18101376593