1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
|
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <netinet/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <pcap.h>
#define SNAP_LEN (ETH_FRAME_LEN + ETH_FCS_LEN) /* Taille max de paquet */
#define LINE_WIDTH 16
pcap_t * handle;
static void print_hex_ascii_line(const unsigned char *payload, size_t len, size_t offset)
{
const unsigned char *ch = payload;
/* offset */
printf("%05zu ", offset);
/* hex */
size_t i;
for(i = 0; i < len; i++)
{
printf("%02x ", *ch);
ch++;
/* print extra space after 8th byte for visual aid */
if (i == 7)
{
putchar(' ');
}
}
/* print space to handle line less than 8 bytes */
if (len < 8)
{
putchar(' ');
}
/* fill hex gap with spaces if not full line */
if (len < 16)
{
size_t const gap = 16 - len;
size_t i;
for (i = 0; i < gap; i++)
{
fputs(" ", stdout);
}
}
fputs(" ", stdout);
/* ascii (if printable) */
ch = payload;
for(i = 0; i < len; i++)
{
putchar(isprint(*ch) ? *ch : '.');
ch++;
}
puts("");
}
static void print_payload(const unsigned char *payload, size_t const len)
{
if (len > 0)
{
size_t len_rem = len;
size_t offset = 0;
while (len_rem > LINE_WIDTH) /* data spans multiple lines */
{
size_t line_len = LINE_WIDTH % len_rem; /* compute current line length */
print_hex_ascii_line(payload, line_len, offset);
len_rem -= line_len;/* compute total remaining */
payload += line_len;/* shift pointer to remaining bytes to print */
offset += LINE_WIDTH;
}
print_hex_ascii_line(payload, len_rem, offset);/* print last line and get out */
}
}
void dumptcp(unsigned char *args, struct pcap_pkthdr const *header, unsigned char const *packet, u_char *fichier)
{
pcap_dumper_t *dumpdesc = pcap_dump_open(handle, fichier);
pcap_dump(args, header, packet);
}
void dumpudp(unsigned char *args, struct pcap_pkthdr const *header, unsigned char const *packet, u_char *fichier)
{
pcap_dumper_t *dumpdesc = pcap_dump_open(handle, fichier);
pcap_dump(args, header, packet);
}
void dumpicmp(unsigned char *args, struct pcap_pkthdr const *header, unsigned char const *packet, u_char *fichier)
{
pcap_dumper_t *dumpdesc = pcap_dump_open(handle, fichier);
pcap_dump(args, header, packet);
}
void dumpip(unsigned char *args, struct pcap_pkthdr const *header, unsigned char const *packet, u_char *fichier)
{
pcap_dumper_t *dumpdesc = pcap_dump_open(handle, fichier);
pcap_dump(args, header, packet);
}
static void got_packet(unsigned char *args, struct pcap_pkthdr const *header, unsigned char const *packet)
{
pcap_dump(args, header, packet);
static size_t count = 1; /* packet counter */
struct iphdr const * ip = (struct iphdr*)(packet + ETH_HLEN);
size_t const size_ip = ip->ihl * 4;
printf("\nPaquet Numero %zu:\n", count);
count++;
if (size_ip < 20)
{
printf(" * Longueur en-tete IP invalide: %zu octets\n", size_ip);
}
else
{
/* Afiicher IP et Source destination */
char ip_fmt[INET_ADDRSTRLEN];
printf(" Source: %s\n", inet_ntop(AF_INET, &ip->saddr, ip_fmt, sizeof ip_fmt));
printf("Destination: %s\n", inet_ntop(AF_INET, &ip->daddr, ip_fmt, sizeof ip_fmt));
/* determine protocol */
switch(ip->protocol)
{
case IPPROTO_TCP:
puts(" Protocole: TCP");
dumptcp(args, header, packet, "tcp.cap");
break;
case IPPROTO_UDP:
puts(" Protocole: UDP");
dumpudp(args, header, packet, "udp.cap");
return;
case IPPROTO_ICMP:
puts(" Protocole: ICMP");
dumpicmp(args, header, packet, "icmp.cap");
return;
case IPPROTO_IP:
puts(" Protocole: IP");
dumpip(args, header, packet, "ip.cap");
return;
default:
puts(" Protocole: inconnu");
return;
}
/* define/compute tcp header offset */
const struct tcphdr * tcp = (struct tcphdr*)(packet + ETH_HLEN + size_ip);
size_t size_tcp = tcp->doff * 4;
if (size_tcp < 20)
{
printf(" * Longueur en-tete TCP invalide: %zu octets\n", size_tcp);
}
else
{
printf(" Port source: %d\nPort destination: %d\n", ntohs(tcp->source), ntohs(tcp->dest));
/* define/compute tcp payload (segment) offset */
const unsigned char * payload = packet + ETH_HLEN + size_ip + size_tcp;
/* compute tcp payload (segment) size */
size_t size_payload = ntohs(ip->tot_len) - (size_ip + size_tcp);
/*
* Print payload data; it might be binary, so don't just
* treat it as a string.
*/
if (size_payload > 0)
{
printf(" Payload (%zu bytes):\n", size_payload);
print_payload(payload, size_payload);
}
}
}
}
int main (int argc, char **argv)
{
int ret = EXIT_FAILURE;
char errbuf[PCAP_ERRBUF_SIZE];
char * filtre = NULL;
char * device = NULL;
char * fichier = "-";
int options = -1;
opterr = 0;
/* Recuperation des options */
while ((options = getopt (argc, argv, "i:d:f:")) != -1)
{
switch (options)
{
case 'i':
device = optarg;
break;
case 'd':
fichier = optarg;
break;
case 'f':
filtre = optarg;
break;
case '?':
if (optopt == 'i' || optopt == 'd' || optopt == 'f')
fprintf (stderr, "Option -%c necessite un argument.\n", optopt);
else if (isprint (optopt))
fprintf (stderr, "Option inconnu `-%c'.\n", optopt);
else
fprintf (stderr, "Option inconnu `\\x%x'.\n", optopt);
}
}
int index = optind;
for (index; index < argc; index++)
{
printf ("Arguments restants %s\n", argv[index]);
}
/* Detection de l'interface de capture */
if (device == NULL)
{
device = pcap_lookupdev(errbuf);
}
if (device == NULL)
{
printf("Une erreur a ete detectee: %s\n", errbuf);
}
else
{
printf("Peripherique de capture: %s\n", device);
bpf_u_int32 net = 0;
bpf_u_int32 mask = 0;
if (pcap_lookupnet(device, &net, &mask, errbuf) == -1)
{
printf("Une erreur a ete detectee: %s\n", errbuf);
}
else
{
char ip_fmt[INET_ADDRSTRLEN];
printf("Reseau: %s\n", inet_ntop(AF_INET, &net, ip_fmt, sizeof ip_fmt));
printf("Masque: %s\n", inet_ntop(AF_INET, &mask, ip_fmt, sizeof ip_fmt));
/* Obtenir un descripteur de capture de paquet */
handle = pcap_open_live(device, SNAP_LEN, 1, 1000, errbuf);
if (handle == NULL)
{
fprintf(stderr, "Erreur ouverture %s: %s\n", device, errbuf);
}
else
{
pcap_dumper_t *dumpdesc = pcap_dump_open(handle, fichier);
pcap_dumper_t *dumpdesctcp = pcap_dump_open(handle, "tcp.cap");
pcap_dumper_t *dumpdescudp = pcap_dump_open(handle, "udp.cap");
pcap_dumper_t *dumpdescip = pcap_dump_open(handle, "ip.cap");
pcap_dumper_t *dumpdescicmp = pcap_dump_open(handle, "icmp.cap");
if(dumpdesc == NULL)
{
fprintf(stderr, "Erreur ouverture fichier %s\n", fichier);
}
else
{
if(filtre != NULL)
{
struct bpf_program fp;
if (pcap_compile(handle, &fp, filtre, 0, net) == -1) /* Compiler l'expression filtre */
{
fprintf(stderr, "Verifier l'expresion filtre %s: %s\n", filtre, pcap_geterr(handle));
}
else
{
if (pcap_setfilter(handle, &fp) == -1) /* Appliquer le filtre */
{
fprintf(stderr, "erreur lors de l'application du filtre %s: %s\n", filtre, pcap_geterr(handle));
}
pcap_freecode(&fp);
}
}
pcap_loop(handle, 50, got_packet, (unsigned char*) dumpdesc);
pcap_dump_close(dumpdesc), dumpdesc = NULL;/* cleanup */
pcap_dump_close(dumpdesctcp);
pcap_dump_close(dumpdescip);
pcap_dump_close(dumpdescudp);
pcap_dump_close(dumpdescicmp);
puts("\nCapture termine.");
ret = EXIT_SUCCESS;
}
pcap_close(handle), handle = NULL;
}
}
}
return ret;
} |
Affichage et dump de paquets en même temps
Répondre avec citation
Envoyé par nicolas.sitbon
Partager