1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
| #include <stdio.h>
#include <pcap.h> // IMPORTANT
#include <time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h> // Use for atoi
typedef struct eth_hdr // Ethernet Header
{
u_char dst_mac[6];
u_char src_mac[6];
u_short eth_type;
}eth_hdr;
eth_hdr *ethernet;
typedef struct ip_hdr // IPv4 Header
{
int version:4;
int header_len:4;
u_char tos:8;
int total_len:16;
int ident:16;
int flags:16;
u_char ttl:8;
u_char protocol:8;
int checksum:16;
u_char sourceIP[4];
u_char destIP[4];
}ip_hdr;
ip_hdr *ip;
typedef struct tcp_hdr // TCP Header
{
u_short sport;
u_short dport;
u_int seq;
u_int ack;
u_char head_len;
u_char flags;
u_short wind_size;
u_short check_sum;
u_short urg_ptr;
}tcp_hdr;
tcp_hdr *tcp;
typedef struct udp_hdr // UDP Header
{
u_short sport;
u_short dport;
u_short tot_len;
u_short check_sum;
}udp_hdr;
udp_hdr *udp;
void pcap_callback(unsigned char * arg, const struct pcap_pkthdr *packet_header, const unsigned char *packet_content){
static int id = 1;
printf("Packet ID: %d\n", id++);
pcap_dump(arg, packet_header, packet_content);
printf("Packet Length: %d\n", packet_header->len);
printf("Number of Bytes: %d\n", packet_header->caplen);
printf("Received Time: %s\n", ctime((const time_t*)&packet_header->ts.tv_sec));
int i;
for (i = 0; i < packet_header->caplen; i++){
printf(" %02x", packet_content[i]);
if ((i + 1) % 32 == 0){
printf("\n");
}
}
printf("\n\n");
u_int eth_len = sizeof(struct eth_hdr);
u_int ip_len = sizeof(struct ip_hdr);
u_int tcp_len = sizeof(struct tcp_hdr);
u_int udp_len = sizeof(struct udp_hdr);
printf("Analyse Result:\n\n");
printf("Ethernet Header Information:\n");
ethernet = (eth_hdr *)packet_content;
printf("Source: %02x:%02x:%02x:%02x:%02x:%02x\n",ethernet->src_mac[0],ethernet->src_mac[1],ethernet->src_mac[2],ethernet->src_mac[3],ethernet->src_mac[4],ethernet->src_mac[5]);
printf("Destination: %02x:%02x:%02x:%02x:%02x:%02x\n",ethernet->dst_mac[0],ethernet->dst_mac[1],ethernet->dst_mac[2],ethernet->dst_mac[3],ethernet->dst_mac[4],ethernet->dst_mac[5]);
if(ntohs(ethernet->eth_type)==0x0800){
printf("Type: IPv4\n");
printf("IPV4 Header Information:\n");
ip = (ip_hdr*)(packet_content+eth_len);
printf("Source: %d.%d.%d.%d\n",ip->sourceIP[0],ip->sourceIP[1],ip->sourceIP[2],ip->sourceIP[3]);
printf("Destination: %d.%d.%d.%d\n",ip->destIP[0],ip->destIP[1],ip->destIP[2],ip->destIP[3]);
}
else {
printf("Type: IPv6\n");
}
printf("\n%s\n\n", "--------------- NEXT ---------------");
}
int main(int argc, char *argv[])
{
char *dev, errbuf[1024];
dev = argv[1];
if (dev == NULL) {
printf("You didn't provide any NETWORK DEVICE.\n");
return 0;
}
printf("Device: %s\n", dev);
pcap_t *pcap_handle = pcap_open_live(dev, 65535, 1, 0, errbuf);
if (pcap_handle == NULL) {
printf("%s\n", errbuf);
return 0;
}
struct in_addr addr;
bpf_u_int32 ipaddr, ipmask;
char *dev_ip, *dev_mask;
if (pcap_lookupnet(dev, &ipaddr, &ipmask,errbuf) == -1) {
printf("%s\n", errbuf);
return 0;
}
addr.s_addr = ipaddr;
dev_ip = inet_ntoa(addr);
printf("IP Address : %s\n", dev_ip);
addr.s_addr = ipmask;
dev_mask = inet_ntoa(addr);
printf("Netmask : %s\n", dev_mask);
struct bpf_program filter;
pcap_compile(pcap_handle, &filter, "icmp[icmptype] == icmp-echoreply or icmp[icmptype] == icmp-echo", 1, 0);
pcap_setfilter(pcap_handle, &filter);
printf("\n---------------The PACKET U Get--------------\n\n");
int id = 0;
char *num = argv[2];
if (num == NULL) {
printf("You didn't provide Packet number.\n");
return 0;
}
int pnum = atoi(num);
pcap_dumper_t* dumpfp = pcap_dump_open(pcap_handle, "./log.pcap");
if (pcap_loop(pcap_handle, pnum, pcap_callback, (unsigned char *)dumpfp) < 0){
printf("error\n");
return 0;
}
pcap_dump_close(dumpfp);
pcap_close(pcap_handle);
printf("None Packet Left.\n\n---------------All Printed--------------\n\n");
return 0;
}
|
