Skip to content

Instantly share code, notes, and snippets.

@joneskoo
Created February 16, 2011 09:01
Show Gist options
  • Save joneskoo/829065 to your computer and use it in GitHub Desktop.
Save joneskoo/829065 to your computer and use it in GitHub Desktop.
Quick and dirty PCAP parser
#include <pcap.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/time.h>
#define IP_SRC_OFFSET 34-8
#define IP_DST_OFFSET 38-8
void dump(char *name);
int main(int argc, char **argv) {
if (argc < 2) {
printf("Usage: pppoe-ip <file>\n");
exit(1);
}
dump(argv[1]);
return EXIT_SUCCESS;
}
void dump(char *fname) {
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *pcap = pcap_open_offline(fname, errbuf);
unsigned long long sum = 0;
struct pcap_pkthdr hdr;
const u_char *packet;
while ((packet = pcap_next(pcap, &hdr)) != NULL) {
if (packet[IP_DST_OFFSET + 0] == 217 &&
packet[IP_DST_OFFSET + 1] == 30 &&
packet[IP_DST_OFFSET + 2] == 184 &&
packet[IP_DST_OFFSET + 3] == 161 )
{
sum += hdr.len;
printf("%d\t%d.%d.%d.%d > %d.%d.%d.%d\n",
hdr.ts.tv_sec,
packet[IP_SRC_OFFSET + 0],
packet[IP_SRC_OFFSET + 1],
packet[IP_SRC_OFFSET + 2],
packet[IP_SRC_OFFSET + 3],
packet[IP_DST_OFFSET + 0],
packet[IP_DST_OFFSET + 1],
packet[IP_DST_OFFSET + 2],
packet[IP_DST_OFFSET + 3]);
}
}
printf("Total traffic: %lld bytes\n", sum);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment