sniffer

需要先安装 winpcap

#include "pcap.h"


#pragma comment(lib,"wpcap.lib")
#pragma comment(lib,"ws2_32.lib")


typedef struct ip_address
{
u_char byte1;
u_char byte2;
u_char byte3;
u_char byte4;
}ip_address;


typedef struct ip_header
{
u_char ver_ihl;//版本号4b,IP头长度4b
u_char tos;
u_short tlen;
u_short identification;
u_short flags_fo;
u_char ttl;
u_char proto;
u_short crc;
ip_address saddr;
ip_address daddr;
u_int op_pad;
}ip_header;


typedef struct udp_header
{
u_short sport;
u_short dport;
u_short len;
u_short crc;
}udp_header;


void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);


int main()
{
pcap_if_t *alldevs;//所有的网络设备
pcap_if_t *d; //用户选定的网络设备
int iNum;
int i=0;
pcap_t *adhandle;
char ErrBuff[PCAP_ERRBUF_SIZE];
u_int netmask;
char packet_filter[] = "ip and udp";
struct bpf_program fcode;


//找到所有可用的网络设备(网卡),给alldevs
if(pcap_findalldevs(&alldevs,ErrBuff) == -1)
{
return -1;
}


//列出所有网络设备
for(d = alldevs; d; d = d->next)
{
printf("%d.%s",++i,d->name);//打印设备编号及设备名
if(d->description)
printf("(%s)\n",d->description);//打印设备描述
else
printf("No description available\n");
}

//i未变化,无网络设备或设备扫描失败
if(i == 0)
{
printf("Make sure winpcap was installed");
return -1;
}


//用户指定设备编号
printf("input interface number:\t");
scanf("%d",&iNum);


//检查用户输入的设备编号是否可用
if(iNum<1 || iNum>i)
{
printf("interface number out of range\n");
pcap_freealldevs(alldevs);
return -1;
}


//找到指定设备,在d中
for(d=alldevs,i=0; i<iNum-1; d=d->next,i++);


//得到捕捉网络包描述字,在adhandle
if((adhandle = pcap_open_live(d->name,65536,1,1000,ErrBuff)) == NULL)//混杂模式
{
pcap_freealldevs(alldevs);
return -1;
}


printf("\nListenint On %s\n", d->description);
pcap_freealldevs(alldevs);


//根据网络包描述字，检查网络类型是否为以太网
if(pcap_datalink(adhandle) != DLT_EN10MB)
{
printf("\nis not ethernet\n");
pcap_freealldevs(alldevs);
return -1;
}


//获取该网络设备地址的子网掩码
if(d->addresses != NULL)
netmask = ((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
else
netmask = 0xffffff;


//编译过滤器,将packet_filter中的规则作为参数,编译到fcode中
if(pcap_compile(adhandle,&fcode,packet_filter,1,netmask) < 0)
{
pcap_freealldevs(alldevs);
return -1;
}


//应用该过滤器
if(pcap_setfilter(adhandle,&fcode) < 0)
{
pcap_freealldevs(alldevs);
return -1;
}


printf("Listening On %s\n",d->description);
//pcap_freealldevs(alldevs);
pcap_loop(adhandle,0,packet_handler,NULL);//开始扫描


return 0;
}


//包处理函数
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
struct tm *ltime;
char timestr[16];
ip_header *ih;
udp_header *uh;
u_int ip_len;
u_short sport;
u_short dport;


//时间及长度,从回调函数第二个参数获得
ltime = localtime(&header->ts.tv_sec);
strftime(timestr, sizeof(timestr), "%H:%M:%S", ltime);
printf("%s,%.6d len=%d\t",timestr,header->ts.tv_usec, header->len);


//ip地址及端口号
ih = (ip_header *)(pkt_data + 14);//跳过mac层包头14个字节
ip_len = (ih->ver_ihl & 0xf) * 4;//取ver_ihl后四位,计算IP头长度(4B/单位)
uh = (udp_header *)((u_char *)ih + ip_len);//跳过IP头长度,得到UDP包
sport = ntohs(uh->sport);
dport = ntohs(uh->dport);
printf("%d.%d.%d.%d:%d -> %d.%d.%d.%d:%d\n",
ih->saddr.byte1,
ih->saddr.byte2,
ih->saddr.byte3,
ih->saddr.byte4,
sport,
ih->daddr.byte1,
ih->daddr.byte2,
ih->daddr.byte3,
ih->daddr.byte4,
dport );
}