关于用libpcap库取得数据包并进行分类还存在的问题

shujunz

无聊时写了一个抓包的软件，但是在获取源ip地址和目标ip地址的时候总是显示不出来，大家看看是哪里出了问题：

1. 
   
2. /*we must run this program in root*/
   
3. /*存在的问题:不能读取到ip地址*/
   
4. #include<pcap.h>
   
5. #include<stdio.h>
   
6. #include<stdlib.h>
   
7. #include<string.h>
   
8. char errbuf[PCAP_ERRBUF_SIZE];
   
9. 
   
10. 
    
11. 
    
12. struct ether_header{//Ethernet
    
13.         u_int8_t ether_dhost[6];
    
14.         u_int8_t ether_shost[6];
    
15.         u_int16_t ether_type;
    
16. };
    
17. typedef u_int32_t in_addr_t;
    
18. struct in_addr{
    
19.         in_addr_t s_addr;
    
20. };
    
21. /*
    
22. -------------------------------------------
    
23.       A R P
    
24. -------------------------------------------
    
25. */
    
26. struct arp_header{//Arp
    
27.         u_int16_t arp_hardware_type;
    
28.         u_int16_t arp_protocol_type;
    
29.         u_int8_t arp_hardware_length;
    
30.         u_int8_t arp_protocol_length;
    
31.         u_int16_t arp_operation_code;//arp Opcode!
    
32.         u_int8_t arp_source_ethernet_address[6];
    
33.         u_int8_t arp_destination_ethernet_address[6];
    
34.        
    
35.         //u_int16_t arp_source_ip_address[4];
    
36.         u_int8_t arp_source_ip_address[4];
    
37.         u_int8_t arp_destination_ip_address[4];
    
38. 
    
39. };
    
40. 
    
41. void ip_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content);
    
42. void arp_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content);
    
43. void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content);
    
44. pcap_t * init_pcap();
    
45. void get_packet(pcap_t *pcap_handle);
    
46. void close_pcap(pcap_t *pcap_handle);
    
47. 
    
48. 
    
49. void ip_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content)
    
50. {//IP call_back function
    
51. 
    
52. 
    
53. }
    
54. 
    
55. 
    
56. 
    
57. void arp_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content)
    
58. {//ARP call_back function
    
59.         struct arp_header *arp_protocol;
    
60.         u_short protocol_type;
    
61.         u_short hardware_type;
    
62.         u_short operation_code;
    
63.         u_char *mac_string;
    
64.         struct in_addr source_ip_address;
    
65.         struct in_addr destination_ip_address;
    
66.         u_char hardware_length;
    
67.         u_char protocol_length;
    
68.         printf("---------ARP Protocol(Network Layer)----------\n");
    
69.         arp_protocol=(struct arp_header *)(packet_content+14);
    
70.     /*
    
71.      * 获得ARP协议数据。注意在这里要跳过以太网数据部分，它的长度刚好是14，所以在这里加上14，是指针跳过14个字节
    
72.      */
    
73.         hardware_type=ntohs(arp_protocol->arp_hardware_type);
    
74.         operation_code=ntohs(arp_protocol->arp_operation_code);
    
75.         protocol_type=ntohs(arp_protocol->arp_protocol_type);
    
76.         hardware_length=arp_protocol->arp_hardware_length;
    
77.         protocol_length=arp_protocol->arp_protocol_length;
    
78.         printf("ARP Hardware Type:%d\n",hardware_type);
    
79.         printf("ARP Protocol Type:%d\n",protocol_type);
    
80.         printf("ARP Hardware Length:%d\n",hardware_length);
    
81.         printf("ARP Protocol Length:%d\n",protocol_length);
    
82.         printf("ARP Operation Code:%d\n",operation_code);
    
83. 
    
84. //------------------------------------------------
    
85.         //Judge up layer
    
86.         switch(operation_code)
    
87.         {
    
88.                 case 1:
    
89.                         printf("ARP request protocol\n");
    
90.                         break;
    
91.                 case 2:
    
92.                         printf("ARP reply protocol\n");
    
93.                         break;
    
94.                 case 3:
    
95.                         printf("RARP request protocol\n");
    
96.                         break;
    
97.                 case 4:
    
98.                         printf("RARP reply protocol\n");
    
99.                         break;
    
100.                 default :
     
101.                         break;
     
102.         }
     
103. //--------------------------------------
     
104.         printf("Ethernet source address is:\n");
     
105.         mac_string=arp_protocol->arp_source_ethernet_address;
     
106.         printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
     
107.         memcpy((void*)&source_ip_address,(void *)arp_protocol->arp_source_ip_address,sizeof(struct in_addr));
     
108.                
     
109.         printf("Source Ip address is :\n",inet_ntoa(source_ip_address));
     
110. 
     
111.         printf("Ethernet destination address is:\n");
     
112.         mac_string=arp_protocol->arp_destination_ethernet_address;
     
113.         printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
     
114.         memcpy((void*)&destination_ip_address,(void *)arp_protocol->arp_destination_ip_address,sizeof(struct in_addr));
     
115.         printf("Destination Ip address is :\n",inet_ntoa(source_ip_address));
     
116. 
     
117. }
     
118. 
     
119. 
     
120. 
     
121. void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char *packet_content)//Ethernet call_back function
     
122. {
     
123.         u_short ethernet_type;//Ethernet type
     
124.         struct ether_header *ethernet_protocol;//Ethernet protocol variables
     
125.         u_char *mac_string;//Ethernet address---MAC address
     
126.         static int packet_num=1;//default packet number!
     
127.         printf("***********************************************\n");
     
128.         printf("The %d packet is captured..\n",packet_num);
     
129.         printf("--------Ethernet protocol (Link Layer)--------\n");
     
130.         ethernet_protocol=(struct ether_header *)packet_content;
     
131.         printf("Ethernet type is:");
     
132.         ethernet_type=ntohs(ethernet_protocol->ether_type);
     
133.         printf("%04x\n",ethernet_type);
     
134.   //Judge the up_layer protocol
     
135.         //coding....
     
136.         switch(ethernet_type)
     
137.         {
     
138.                 case 0x0800:
     
139.                         printf("The network layer is IP protocol\n");
     
140.                         ip_protocol_packet_callback(argument,packet_header,packet_content);
     
141.                         break;
     
142.                 case 0x0806:
     
143.                         printf("The network layer is ARP protocol\n");
     
144.                         arp_protocol_packet_callback(argument,packet_header,packet_content);
     
145.                         break;
     
146.                 case 0x08035:
     
147.                         printf("The network layer is RARP protocol\n");
     
148.                         break;
     
149.                 default :
     
150.                         break;
     
151.         }
     
152.         printf("Mac Source Address is:\n");
     
153.         mac_string=ethernet_protocol->ether_shost;
     
154.         printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
     
155.         printf("Mac Destination Address is:\n");
     
156.         mac_string=ethernet_protocol->ether_dhost;
     
157.         printf("%02x:%02x:%02x:%02x:%02x:%02x\n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));
     
158.         printf("***********************************************\n");
     
159.         packet_num++;
     
160.        
     
161. }       
     
162. 
     
163. pcap_t * init_pcap()
     
164. {       
     
165.         pcap_t *pcap_handle;
     
166.         char *interface;//
     
167.         struct bpf_program bpf_filter;
     
168.         char bpf_filter_string[]="";//设置过滤规则为空,表示捕获所有数据包
     
169. //        bpf_u_int32 net_mask;
     
170. //        bpf_u_int32 net_ip;
     
171.         u_int32_t net_mask;
     
172.         u_int32_t net_ip;
     
173.         interface=pcap_lookupdev(errbuf);//get net interface
     
174.         if(interface==NULL)
     
175.                 {
     
176.                         printf("get net interface error:%s\n",errbuf);
     
177.                         //return 1;
     
178.                         return NULL;
     
179.                 }
     
180.         if(pcap_lookupnet(interface,&net_ip,&net_mask,errbuf)==-1)//get mask and ip address
     
181.                 {
     
182.                         printf("get mask and ip error:%s\n",errbuf);
     
183. //                        return 2;
     
184.                         return NULL;
     
185.                 }
     
186.         pcap_handle=pcap_open_live(interface,BUFSIZ,1,0,errbuf);//open the Interface
     
187.         if(pcap_handle==NULL)
     
188.                 {
     
189.                         printf("open the Inerface:%s\n",pcap_geterr(pcap_handle));
     
190. //                        return 3;
     
191.                         return NULL;
     
192.                 }
     
193.         if(pcap_compile(pcap_handle,&bpf_filter,bpf_filter_string,0,net_ip)==-1)//Compile the filtering rules
     
194.                 {
     
195.                         printf("Compile the filtering rules:%s\n",pcap_geterr(pcap_handle));
     
196. //                        return 4;
     
197.                         return NULL;
     
198.                 }
     
199.         if(pcap_setfilter(pcap_handle,&bpf_filter)==-1)//set filter rules!
     
200.                 {
     
201.                         printf("set filter rules:%s\n",pcap_geterr(pcap_handle));
     
202. //                        return 5;
     
203.                         return NULL;
     
204.                 }
     
205.        
     
206. return pcap_handle;
     
207. }
     
208. 
     
209. void get_packet(pcap_t *pcap_handle)
     
210. {
     
211.         if(pcap_datalink(pcap_handle)!=DLT_EN10MB)//Judge the packet is not Ethernet packet
     
212.                 {
     
213.                         return;
     
214.                 }
     
215.         if(pcap_loop(pcap_handle,-1,ethernet_protocol_packet_callback,NULL)!=0)
     
216.                 {
     
217.                         printf("get packet error:%s\n",pcap_geterr(pcap_handle));
     
218.                 }
     
219. 
     
220. }
     
221. void close_pcap(pcap_t *pcap_handle)
     
222. {
     
223.         pcap_close(pcap_handle);
     
224. }
     
225. int main()
     
226. {
     
227.         pcap_t *pcap_handle;
     
228.         pcap_handle=init_pcap();
     
229.         if(pcap_handle==NULL)
     
230.         {
     
231.                 return 1;
     
232.         }
     
233.         get_packet(pcap_handle);
     
234.         close_pcap(pcap_handle);
     
235. 
     
236. 
     
237. return 0;
     
238. }
     
239. 
     

复制代码

原来是写到几个c文件中的 为了方便我把他们整合到一个文件中了

shujunz

这是编译和运行的结果 由于抓的包比较多 我就选了几个

1. 
   
2. % gcc get_packet.c -lpcap
   
3. % ./a.out
   
4. get net interface error:no suitable device found
   
5. % sudo ./a.out
   
6. 
   
7. 
   
8. 
   
9. The 33 packet is captured..
   
10. --------Ethernet protocol (Link Layer)--------
    
11. Ethernet type is:0806
    
12. The network layer is ARP protocol
    
13. ---------ARP Protocol(Network Layer)----------
    
14. ARP Hardware Type:1
    
15. ARP Protocol Type:2048
    
16. ARP Hardware Length:6
    
17. ARP Protocol Length:4
    
18. ARP Operation Code:1
    
19. ARP request protocol
    
20. Ethernet source address is:
    
21. 00:1a:4d:96:81:da
    
22. Source Ip address is :
    
23. Ethernet destination address is:
    
24. ac:10:12:4e:00:00
    
25. Destination Ip address is :
    
26. Mac Source Address is:
    
27. 00:1a:4d:96:81:da
    
28. Mac Destination Address is:
    
29. ff:ff:ff:ff:ff:ff
    
30. ***********************************************
    
31. ***********************************************
    
32. The 34 packet is captured..
    
33. --------Ethernet protocol (Link Layer)--------
    
34. Ethernet type is:0806
    
35. The network layer is ARP protocol
    
36. ---------ARP Protocol(Network Layer)----------
    
37. ARP Hardware Type:1
    
38. ARP Protocol Type:2048
    
39. ARP Hardware Length:6
    
40. ARP Protocol Length:4
    
41. ARP Operation Code:1
    
42. ARP request protocol
    
43. Ethernet source address is:
    
44. 00:1a:4d:96:81:da
    
45. Source Ip address is :
    
46. Ethernet destination address is:
    
47. ac:10:12:4e:00:00
    
48. Destination Ip address is :
    
49. Mac Source Address is:
    
50. 00:1a:4d:96:81:da
    
51. Mac Destination Address is:
    
52. ff:ff:ff:ff:ff:ff
    
53. ***********************************************
    
54. ***********************************************
    
55. The 35 packet is captured..
    
56. --------Ethernet protocol (Link Layer)--------
    
57. Ethernet type is:0800
    
58. The network layer is IP protocol
    
59. Mac Source Address is:
    
60. 40:61:86:fe:ff:3f
    
61. Mac Destination Address is:
    
62. 00:19:66:4c:02:08
    
63. ***********************************************
    
64. ***********************************************
    
65. The 36 packet is captured..
    
66. --------Ethernet protocol (Link Layer)--------
    
67. Ethernet type is:0800
    
68. The network layer is IP protocol
    
69. Mac Source Address is:
    
70. 00:19:66:4c:02:08
    
71. Mac Destination Address is:
    
72. 40:61:86:fe:ff:3f
    
73. ***********************************************
    
74. 
    

复制代码

另外代码只写到分析ARP ，IP以及其上层协议的都还没有写，因为发现问题 就不得不停下来  大家帮忙看看

linuxlixk

106#         memcpy((void*)&source_ip_address,(void *)arp_protocol->arp_source_ip_address,sizeof(struct in_addr));
      #               
      #         printf("Source Ip address is :\n",inet_ntoa(source_ip_address));
      #

printf("Source Ip address is :%s\n",inet_ntoa(source_ip_address));

注意inet_ntoa这个函数返回结果存储的位置 .

linuxlixk

113# memcpy((void*)&destination_ip_address,(void *)arp_protocol->arp_destination_ip_address,sizeof(struct in_addr));
#         printf("Destination Ip address is :\n",inet_ntoa(source_ip_address));

自己认真的看

shujunz

1. 
   
2. printf("Source Ip address is :%s\n",inet_ntoa(source_ip_address));
   

复制代码

打印出来的效果是 Source Ip address is :0.0.0.0

这是怎么回事阿？

flw

【现 在 写 代 碼 的 都 不 带 注 視 嗎? 】
何止是注视，还要行注目礼呢。

shujunz

注释掉// 注视
求代码！

shujunz

{:3_191:}来人啊  
  帮帮忙