NetAnalyzer笔记 之 三. 用C++做一个抓包程序

 1 #include "pcap.h"
 2 main()
 3 {
 4     pcap_if_t *alldevs;
 5     pcap_if_t *d;
 6     int i=0;
 7     char errbuf[PCAP_ERRBUF_SIZE];
 8     
 9     /* 获取本地机器设备列表 */
10     if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL /* auth is not needed */, &alldevs, errbuf) == -1)
11     {
12         fprintf(stderr,"Error in pcap_findalldevs_ex: %s\n", errbuf);
13         exit(1);
14     }
15     /* 打印列表 */
16     for(d= alldevs; d != NULL; d= d->next)
17     {
18         printf("%d. %s", ++i, d->name);
19         if (d->description)
20             printf(" (%s)\n", d->description);
21         else
22             printf(" (No description available)\n");
23     }
24     
25     if (i == 0)
26     {
27         printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
28         return;
29     }
30     /* 不再需要设备列表了，释放它 */
31     pcap_freealldevs(alldevs);
32 }

  1 #ifdef _MSC_VER
  2 /*
  3  * we do not want the warnings about the old deprecated and unsecure CRT functions
  4  * since these examples can be compiled under *nix as well
  5  */
  6 #define _CRT_SECURE_NO_WARNINGS
  7 #endif
  8 
  9 #include "pcap.h"
 10 
 11 /* 4 bytes IP address */
 12 typedef struct ip_address
 13 {
 14     u_char byte1;
 15     u_char byte2;
 16     u_char byte3;
 17     u_char byte4;
 18 }ip_address;
 19 
 20 /* IPv4 header */
 21 typedef struct ip_header
 22 {
 23     u_char    ver_ihl;        // Version (4 bits) + Internet header length (4 bits)
 24     u_char    tos;            // Type of service 
 25     u_short tlen;            // Total length 
 26     u_short identification; // Identification
 27     u_short flags_fo;        // Flags (3 bits) + Fragment offset (13 bits)
 28     u_char    ttl;            // Time to live
 29     u_char    proto;            // Protocol
 30     u_short crc;            // Header checksum
 31     ip_address    saddr;        // Source address
 32     ip_address    daddr;        // Destination address
 33     u_int    op_pad;            // Option + Padding
 34 }ip_header;
 35 
 36 /* UDP header*/
 37 typedef struct udp_header
 38 {
 39     u_short sport;            // Source port
 40     u_short dport;            // Destination port
 41     u_short len;            // Datagram length
 42     u_short crc;            // Checksum
 43 }udp_header;
 44 
 45 /* prototype of the packet handler */
 46 void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
 47 
 48 
 49 int main()
 50 {
 51     pcap_if_t *alldevs;
 52     pcap_if_t *d;
 53     int inum;
 54     int i=0;
 55     pcap_t *adhandle;
 56     char errbuf[PCAP_ERRBUF_SIZE];
 57     u_int netmask;
 58     char packet_filter[] = "ip and udp"; 
 59     struct bpf_program fcode;
 60     
 61     /* Retrieve the device list */
 62     if(pcap_findalldevs(&alldevs, errbuf) == -1)
 63     {
 64         fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
 65         exit(1);
 66     }
 67     
 68     /* Print the list */
 69     for(d=alldevs; d; d=d->next)
 70     {
 71         printf("%d. %s", ++i, d->name);
 72         if (d->description)
 73             printf(" (%s)\n", d->description);
 74         else
 75             printf(" (No description available)\n");
 76     }
 77 
 78     if(i==0)
 79     {
 80         printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
 81         return -1;
 82     }
 83     
 84     printf("Enter the interface number (1-%d):",i);
 85     scanf("%d", &inum);
 86     
 87     /* Check if the user specified a valid adapter */
 88     if(inum < 1 || inum > i)
 89     {
 90         printf("\nAdapter number out of range.\n");
 91         
 92         /* Free the device list */
 93         pcap_freealldevs(alldevs);
 94         return -1;
 95     }
 96 
 97     /* Jump to the selected adapter */
 98     for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
 99     
100     /* Open the adapter */
101     if ((adhandle= pcap_open_live(d->name,    // name of the device
102                              65536,            // portion of the packet to capture. 
103                                             // 65536 grants that the whole packet will be captured on all the MACs.
104                              1,                // promiscuous mode (nonzero means promiscuous)
105                              1000,            // read timeout
106                              errbuf            // error buffer
107                              )) == NULL)
108     {
109         fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
110         /* Free the device list */
111         pcap_freealldevs(alldevs);
112         return -1;
113     }
114     
115     /* Check the link layer. We support only Ethernet for simplicity. */
116     if(pcap_datalink(adhandle) != DLT_EN10MB)
117     {
118         fprintf(stderr,"\nThis program works only on Ethernet networks.\n");
119         /* Free the device list */
120         pcap_freealldevs(alldevs);
121         return -1;
122     }
123     
124     if(d->addresses != NULL)
125         /* Retrieve the mask of the first address of the interface */
126         netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
127     else
128         /* If the interface is without addresses we suppose to be in a C class network */
129         netmask=0xffffff; 
130 
131 
132     //compile the filter
133     if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) <0 )
134     {
135         fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
136         /* Free the device list */
137         pcap_freealldevs(alldevs);
138         return -1;
139     }
140     
141     //set the filter
142     if (pcap_setfilter(adhandle, &fcode)<0)
143     {
144         fprintf(stderr,"\nError setting the filter.\n");
145         /* Free the device list */
146         pcap_freealldevs(alldevs);
147         return -1;
148     }
149     
150     printf("\nlistening on %s...\n", d->description);
151     
152     /* At this point, we don‘t need any more the device list. Free it */
153     pcap_freealldevs(alldevs);
154     
155     /* start the capture */
156     pcap_loop(adhandle, 0, packet_handler, NULL);
157     
158     return 0;
159 }
160 
161 /* Callback function invoked by libpcap for every incoming packet */
162 void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
163 {
164     struct tm *ltime;
165     char timestr[16];
166     ip_header *ih;
167     udp_header *uh;
168     u_int ip_len;
169     u_short sport,dport;
170     time_t local_tv_sec;
171 
172     /*
173      * unused parameter
174      */
175     (VOID)(param);
176 
177     /* convert the timestamp to readable format */
178     local_tv_sec = header->ts.tv_sec;
179     ltime=localtime(&local_tv_sec);
180     strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
181 
182     /* print timestamp and length of the packet */
183     printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len);
184 
185     /* retireve the position of the ip header */
186     ih = (ip_header *) (pkt_data +
187         14); //length of ethernet header
188 
189     /* retireve the position of the udp header */
190     ip_len = (ih->ver_ihl & 0xf) * 4;
191     uh = (udp_header *) ((u_char*)ih + ip_len);
192 
193     /* convert from network byte order to host byte order */
194     sport = ntohs( uh->sport );
195     dport = ntohs( uh->dport );
196 
197     /* print ip addresses and udp ports */
198     printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n",
199         ih->saddr.byte1,
200         ih->saddr.byte2,
201         ih->saddr.byte3,
202         ih->saddr.byte4,
203         sport,
204         ih->daddr.byte1,
205         ih->daddr.byte2,
206         ih->daddr.byte3,
207         ih->daddr.byte4,
208         dport);
209 }