求教： BSD下用C编的sniffer为什么不能接取包？

qqcheng

#include <stdio.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>

#include "headers.h"
#define INTERFACE "ed0"
/*Prototype area*/

int Open_Raw_Socket(void);
void set_promisc(char *interface, int sock);

int main() {
        int sock, bytes_recieved, fromlen;
        char buffer[65535];
        struct sockaddr_in from;
        struct ip *ip;
        struct tcp *tcp;
        sock = Open_Raw_Socket();
        set_promisc(INTERFACE, sock);
        while(1)
        {
                fromlen = sizeof(struct sockaddr_in *);
                bytes_recieved = recvfrom(sock, buffer, sizeof buffer, 0, \
                         (struct sockaddr *)&from, &fromlen);
                printf("\nBytes received ::: %5d\n",bytes_recieved);
                printf("Source address ::: %s\n",inet_ntoa(from.sin_addr));
                ip = (struct ip *)buffer;
                /*See if this is a TCP packet*/
                //if(ip->ip_protocol == 6) {
                printf("IP header length ::: %d\n",ip->ip_length);
                printf("Protocol ::: %d\n",ip->ip_protocol);
                tcp = (struct tcp *)(buffer + (4*ip->ip_length));
                printf("Source port ::: %d\n",ntohs(tcp->tcp_source_port));
                printf("Dest port ::: %d\n",ntohs(tcp->tcp_dest_port));
                //}
        }
}
int Open_Raw_Socket() {
        int sock;
        if((sock = socket(AF_INET, SOCK_RAW, 0)) < 0) {
        /*Then the socket was not created properly and must die*/
                perror("The raw socket was not created");
                exit(1);
        };
        return(sock);
}

void set_promisc(char *interface, int sock ) {
        struct ifreq ifr;
        strncpy(ifr.ifr_name, interface,sizeof(interface)+1);
        if((ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)) {
        /*Could not retrieve flags for the interface*/
                 perror("Could not retrive flags for the interface");
                exit(1);
        }
        printf("The interface is ::: %s\n", interface);
        printf("Retrieved flags from interface successfully");
        ifr.ifr_flags |= IFF_PROMISC;
        if (ioctl (sock, SIOCSIFFLAGS, &ifr) == -1 ) {
        /*Could not set the flags on the interface */
                perror("Could not set the PROMISC flag:");
                exit(1);
        }
        printf("Setting interface ::: %s ::: to promisc", interface);
}

mingyanguo

抓包难道不是bpf？
你可以用libnet/libpcap，这样移植性会好一些。

qqcheng

我现在只是想学一下BSD中简单的抓包的原理。

mingyanguo

也许 bpf(4) 是你需要的

qqcheng

谢谢楼上