Created
December 23, 2023 07:56
-
-
Save quackduck/520a9ef8a0e74e503d5b67a985c4628f to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <pcap.h> | |
#include <stdio.h> | |
#include <string.h> | |
#include <stdlib.h> | |
#include <ctype.h> | |
#include <errno.h> | |
#include <sys/types.h> | |
#include <sys/socket.h> | |
#include <netinet/in.h> | |
#include <arpa/inet.h> | |
/* default snap length (maximum bytes per packet to capture) */ | |
#define SNAP_LEN 1518 | |
/* ethernet headers are always exactly 14 bytes [1] */ | |
#define SIZE_ETHERNET 14 | |
/* Ethernet addresses are 6 bytes */ | |
#define ETHER_ADDR_LEN 6 | |
/* Ethernet header */ | |
struct sniff_ethernet { | |
u_char ether_dhost[ETHER_ADDR_LEN]; /* destination host address */ | |
u_char ether_shost[ETHER_ADDR_LEN]; /* source host address */ | |
u_short ether_type; /* IP? ARP? RARP? etc */ | |
}; | |
/* IP header */ | |
struct sniff_ip { | |
u_char ip_vhl; /* version << 4 | header length >> 2 */ | |
u_char ip_tos; /* type of service */ | |
u_short ip_len; /* total length */ | |
u_short ip_id; /* identification */ | |
u_short ip_off; /* fragment offset field */ | |
#define IP_RF 0x8000 /* reserved fragment flag */ | |
#define IP_DF 0x4000 /* don't fragment flag */ | |
#define IP_MF 0x2000 /* more fragments flag */ | |
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ | |
u_char ip_ttl; /* time to live */ | |
u_char ip_p; /* protocol */ | |
u_short ip_sum; /* checksum */ | |
struct in_addr ip_src,ip_dst; /* source and dest address */ | |
}; | |
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f) | |
#define IP_V(ip) (((ip)->ip_vhl) >> 4) | |
/* TCP header */ | |
typedef u_int tcp_seq; | |
struct sniff_tcp { | |
u_short th_sport; /* source port */ | |
u_short th_dport; /* destination port */ | |
tcp_seq th_seq; /* sequence number */ | |
tcp_seq th_ack; /* acknowledgement number */ | |
u_char th_offx2; /* data offset, rsvd */ | |
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4) | |
u_char th_flags; | |
#define TH_FIN 0x01 | |
#define TH_SYN 0x02 | |
#define TH_RST 0x04 | |
#define TH_PUSH 0x08 | |
#define TH_ACK 0x10 | |
#define TH_URG 0x20 | |
#define TH_ECE 0x40 | |
#define TH_CWR 0x80 | |
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) | |
u_short th_win; /* window */ | |
u_short th_sum; /* checksum */ | |
u_short th_urp; /* urgent pointer */ | |
}; | |
void | |
got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet); | |
void | |
print_payload(const u_char *payload, int len); | |
void | |
print_hex_ascii_line(const u_char *payload, int len, int offset); | |
char *mac_ntoa(u_char *d); | |
/* | |
* print data in rows of 16 bytes: offset hex ascii | |
* | |
* 00000 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a GET / HTTP/1.1.. | |
*/ | |
void | |
print_hex_ascii_line(const u_char *payload, int len, int offset) | |
{ | |
int i; | |
int gap; | |
const u_char *ch; | |
/* offset */ | |
printf("%05d ", offset); | |
/* hex */ | |
ch = payload; | |
for(i = 0; i < len; i++) { | |
printf("%02x ", *ch); | |
ch++; | |
/* print extra space after 8th byte for visual aid */ | |
if (i == 7) | |
printf(" "); | |
} | |
/* print space to handle line less than 8 bytes */ | |
if (len < 8) | |
printf(" "); | |
/* fill hex gap with spaces if not full line */ | |
if (len < 16) { | |
gap = 16 - len; | |
for (i = 0; i < gap; i++) { | |
printf(" "); | |
} | |
} | |
printf(" "); | |
/* ascii (if printable) */ | |
ch = payload; | |
for(i = 0; i < len; i++) { | |
if (isprint(*ch)) | |
printf("%c", *ch); | |
else | |
printf("."); | |
ch++; | |
} | |
printf("\n"); | |
return; | |
} | |
/* | |
* print packet payload data (avoid printing binary data) | |
*/ | |
void | |
print_payload(const u_char *payload, int len) | |
{ | |
int len_rem = len; | |
int line_width = 16; /* number of bytes per line */ | |
int line_len; | |
int offset = 0; /* zero-based offset counter */ | |
const u_char *ch = payload; | |
if (len <= 0) | |
return; | |
/* data fits on one line */ | |
if (len <= line_width) { | |
print_hex_ascii_line(ch, len, offset); | |
return; | |
} | |
/* data spans multiple lines */ | |
for ( ;; ) { | |
/* compute current line length */ | |
line_len = line_width % len_rem; | |
/* print line */ | |
print_hex_ascii_line(ch, line_len, offset); | |
/* compute total remaining */ | |
len_rem = len_rem - line_len; | |
/* shift pointer to remaining bytes to print */ | |
ch = ch + line_len; | |
/* add offset */ | |
offset = offset + line_width; | |
/* check if we have line width chars or less */ | |
if (len_rem <= line_width) { | |
/* print last line and get out */ | |
print_hex_ascii_line(ch, len_rem, offset); | |
break; | |
} | |
} | |
return; | |
} | |
/* | |
* dissect/print packet | |
*/ | |
void | |
got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) | |
{ | |
static int count = 1; /* packet counter */ | |
/* declare pointers to packet headers */ | |
const struct sniff_ethernet *ethernet; /* The ethernet header [1] */ | |
const struct sniff_ip *ip; /* The IP header */ | |
const struct sniff_tcp *tcp; /* The TCP header */ | |
const char *payload; /* Packet payload */ | |
int size_ip; | |
int size_tcp; | |
int size_payload; | |
printf("\nPacket number %d:\n", count); | |
count++; | |
/* define ethernet header */ | |
ethernet = (struct sniff_ethernet*)(packet); | |
/* define/compute ip header offset */ | |
ip = (struct sniff_ip*)(packet + SIZE_ETHERNET); | |
size_ip = IP_HL(ip)*4; | |
if (size_ip < 20) { | |
printf(" * Invalid IP header length: %u bytes\n", size_ip); | |
// return; | |
} | |
/* print source and destination IP addresses */ | |
printf(" From: %15s %s\n", inet_ntoa(ip->ip_src), mac_ntoa(ethernet->ether_shost)); | |
printf(" To: %15s %s\n", inet_ntoa(ip->ip_dst), mac_ntoa(ethernet->ether_dhost)); | |
/* determine protocol */ | |
switch(ip->ip_p) { | |
case IPPROTO_TCP: | |
printf(" Protocol: TCP\n"); | |
break; | |
case IPPROTO_UDP: | |
printf(" Protocol: UDP\n"); | |
return; | |
case IPPROTO_ICMP: | |
printf(" Protocol: ICMP\n"); | |
return; | |
case IPPROTO_IP: | |
printf(" Protocol: IP\n"); | |
return; | |
default: | |
printf(" Protocol: unknown\n"); | |
return; | |
} | |
/* | |
* OK, this packet is TCP. | |
*/ | |
/* define/compute tcp header offset */ | |
tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip); | |
size_tcp = TH_OFF(tcp)*4; | |
if (size_tcp < 20) { | |
printf(" * Invalid TCP header length: %u bytes\n", size_tcp); | |
return; | |
} | |
printf(" Src port: %d\n", ntohs(tcp->th_sport)); | |
printf(" Dst port: %d\n", ntohs(tcp->th_dport)); | |
/* define/compute tcp payload (segment) offset */ | |
payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp); | |
/* compute tcp payload (segment) size */ | |
size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp); | |
/* | |
* Print payload data; it might be binary, so don't just | |
* treat it as a string. | |
*/ | |
if (size_payload > 0) { | |
printf(" Payload (%d bytes):\n", size_payload); | |
print_payload(payload, size_payload); | |
} | |
return; | |
} | |
int main() | |
{ | |
char *dev = NULL; /* capture device name */ | |
char errbuf[PCAP_ERRBUF_SIZE]; /* error buffer */ | |
pcap_t *handle; /* packet capture handle */ | |
// and (not host 192.168.86.27) | |
// char filter_exp[] = "tcp src portrange 0-1023 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)"; /* filter expression [3] */ | |
// char filter_exp[] = "type mgt subtype probe-req"; /* filter expression [3] */ | |
char filter_exp[] = "type data"; /* filter expression [3] */ | |
struct bpf_program fp; /* compiled filter program (expression) */ | |
bpf_u_int32 mask; /* subnet mask */ | |
bpf_u_int32 net; /* ip */ | |
int num_packets = 10000; /* number of packets to capture */ | |
/* find a capture device if not specified on command-line */ | |
// dev = pcap_lookupdev(errbuf); | |
// if (dev == NULL) { | |
// fprintf(stderr, "Couldn't find default device: %s\n", | |
// errbuf); | |
// exit(EXIT_FAILURE); | |
// } | |
dev = "en0"; | |
/* get network number and mask associated with capture device */ | |
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) { | |
fprintf(stderr, "Couldn't get netmask for device %s: %s\n", | |
dev, errbuf); | |
net = 0; | |
mask = 0; | |
} | |
/* print capture info */ | |
printf("Device: %s\n", dev); | |
printf("Number of packets: %d\n", num_packets); | |
printf("Filter expression: %s\n", filter_exp); | |
// /* open capture device */ | |
// handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf); | |
// if (handle == NULL) { | |
// fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf); | |
// exit(EXIT_FAILURE); | |
// } | |
handle = pcap_create(dev, errbuf); | |
if (handle == NULL) | |
{ | |
printf("pcap_create failed:%s\n", errbuf); | |
return 3; // or exit or return an error code or something | |
} | |
if(pcap_set_rfmon(handle,1)==0 ) | |
{ | |
printf("monitor mode enabled\n"); | |
} | |
pcap_set_snaplen(handle, 1518); // Set the snapshot length to 2048 | |
pcap_set_promisc(handle, 1); // Turn promiscuous mode off | |
pcap_set_timeout(handle, 512); // Set the timeout to 512 milliseconds | |
int status = pcap_activate(handle); | |
if (status < 0) | |
{ | |
printf("pcap_activate failed: %s\n", pcap_geterr(handle)); | |
return 3; // or exit or return an error code or something | |
} | |
// if (pcap_can_set_rfmon(handle) == 0) { | |
// fprintf(stderr, "Monitor mode not supported on %s\n", dev); | |
// return 3; | |
// } | |
// if(pcap_set_rfmon(handle,1)==0 ) | |
// { | |
// printf("monitor mode enabled\n"); | |
// } | |
/* make sure we're capturing on an Ethernet device [2] */ | |
// if (pcap_datalink(handle) != DLT_EN10MB) { | |
// fprintf(stderr, "%s is not an Ethernet\n", dev); | |
// exit(EXIT_FAILURE); | |
// } | |
/* compile the filter expression */ | |
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) { | |
fprintf(stderr, "Couldn't parse filter %s: %s\n", | |
filter_exp, pcap_geterr(handle)); | |
exit(EXIT_FAILURE); | |
} | |
/* apply the compiled filter */ | |
if (pcap_setfilter(handle, &fp) == -1) { | |
fprintf(stderr, "Couldn't install filter %s: %s\n", | |
filter_exp, pcap_geterr(handle)); | |
exit(EXIT_FAILURE); | |
} | |
printf("started!\n"); | |
/* now we can set our callback function */ | |
pcap_loop(handle, num_packets, got_packet, NULL); | |
/* cleanup */ | |
pcap_freecode(&fp); | |
pcap_close(handle); | |
printf("\nCapture complete.\n"); | |
return 0; | |
} | |
char *mac_ntoa(u_char *d) | |
{ | |
static char str[18]; | |
sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x", | |
d[0], d[1], d[2], d[3], d[4], d[5]); | |
return str; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment