1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401
|
#include <unistd.h>
#include <arpa/inet.h>
#include <pcap.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <time.h>
u_char *packet;
struct pcap_pkthdr *header;
pcap_t *handle;
char *fichier = NULL;
/* Taille max de paquet */
#define SNAP_LEN 1518
/* taille en-tete ethernet */
#define SIZE_ETHERNET 14
/* adresse ethernet */
#define ETHER_ADDR_LEN 6
/* en-tete ethernet */
struct sniff_ethernet {
u_char ether_dhost[ETHER_ADDR_LEN]; /* adresse destination */
u_char ether_shost[ETHER_ADDR_LEN]; /* adresse source */
u_short ether_type; /* type de protocole */
};
/* en-tete IP */
struct sniff_ip {
u_char ip_vhl; /* version << 4 | header length >> 2 */
u_char ip_tos; /* type of service */
u_short ip_len; /* total length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
/* en-tete TCP */
typedef u_int tcp_seq;
struct sniff_tcp {
u_short th_sport; /* port source */
u_short th_dport; /* port destination */
tcp_seq th_seq; /* sequence number */
tcp_seq th_ack; /* acknowledgement number */
u_char th_offx2; /* data offset, rsvd */
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
u_short th_win; /* window */
u_short th_sum; /* checksum */
u_short th_urp; /* urgent pointer */
};
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet);
void print_payload(const u_char *payload, int len);
void print_hex_ascii_line(const u_char *payload, int len, int offset);
void dump_packet(u_char * args, const struct pcap_pkthdr *header, const u_char *packet)
{
pcap_dump_open(handle, fichier);
pcap_dump((u_char *) args,header,packet);
}
void print_hex_ascii_line(const u_char *payload, int len, int offset)
{
int i;
int gap;
const u_char *ch;
/* offset */
printf("%05d ", offset);
/* hex */
ch = payload;
for(i = 0; i < len; i++) {
printf("%02x ", *ch);
ch++;
/* print extra space after 8th byte for visual aid */
if (i == 7)
printf(" ");
}
/* print space to handle line less than 8 bytes */
if (len < 8)
printf(" ");
/* fill hex gap with spaces if not full line */
if (len < 16) {
gap = 16 - len;
for (i = 0; i < gap; i++) {
printf(" ");
}
}
printf(" ");
/* ascii (if printable) */
ch = payload;
for(i = 0; i < len; i++) {
if (isprint(*ch))
printf("%c", *ch);
else
printf(".");
ch++;
}
printf("\n");
return;
}
void print_payload(const u_char *payload, int len)
{
int len_rem = len;
int line_width = 16; /* number of bytes per line */
int line_len;
int offset = 0; /* zero-based offset counter */
const u_char *ch = payload;
if (len <= 0)
return;
/* data fits on one line */
if (len <= line_width) {
print_hex_ascii_line(ch, len, offset);
return;
}
/* data spans multiple lines */
for ( ;; ) {
/* compute current line length */
line_len = line_width % len_rem;
/* print line */
print_hex_ascii_line(ch, line_len, offset);
/* compute total remaining */
len_rem = len_rem - line_len;
/* shift pointer to remaining bytes to print */
ch = ch + line_len;
/* add offset */
offset = offset + line_width;
/* check if we have line width chars or less */
if (len_rem <= line_width) {
/* print last line and get out */
print_hex_ascii_line(ch, len_rem, offset);
break;
}
}
return;
}
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
dump_packet(args,header,packet);
static int count = 1; /* packet counter */
/* declare pointers to packet headers */
const struct sniff_ethernet *ethernet; /* The ethernet header [1] */
const struct sniff_ip *ip; /* The IP header */
const struct sniff_tcp *tcp; /* The TCP header */
const char *payload; /* Packet payload */
int size_ip;
int size_tcp;
int size_payload;
printf("\nPaquet Numero %d:\n", count);
count++;
/* define ethernet header */
ethernet = (struct sniff_ethernet*)(packet);
/* define/compute ip header offset */
ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
size_ip = IP_HL(ip)*4;
if (size_ip < 20) {
printf(" * Longueur en-tete IP invalide: %u octets\n", size_ip);
return;
}
/* print source and destination IP addresses */
printf(" Source: %s\n", inet_ntoa(ip->ip_src));
printf("Destination: %s\n", inet_ntoa(ip->ip_dst));
/* determine protocol */
switch(ip->ip_p) {
case IPPROTO_TCP:
printf(" Protocole: TCP\n");
break;
case IPPROTO_UDP:
printf(" Protocole: UDP\n");
return;
case IPPROTO_ICMP:
printf(" Protocole: ICMP\n");
return;
case IPPROTO_IP:
printf(" Protocole: IP\n");
return;
default:
printf(" Protocole: inconnu\n");
return;
}
/*
* OK, this packet is TCP.
*/
/* define/compute tcp header offset */
tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
size_tcp = TH_OFF(tcp)*4;
if (size_tcp < 20) {
printf(" * Longueur en-tete TCP invalide: %u octets\n", size_tcp);
return;
}
printf(" Port source: %d\n", ntohs(tcp->th_sport));
printf("Port destination: %d\n", ntohs(tcp->th_dport));
/* define/compute tcp payload (segment) offset */
payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);
/* compute tcp payload (segment) size */
size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp);
/*
* Print payload data; it might be binary, so don't just
* treat it as a string.
*/
if (size_payload > 0) {
printf(" Payload (%d bytes):\n", size_payload);
print_payload(payload, size_payload);
}
return;
}
int main (int argc, char **argv)
{
char *interface = NULL;
char *filtre = NULL;
int index;
int options;
opterr = 0;
char *device = NULL;
char errbuf[PCAP_ERRBUF_SIZE];
bpf_u_int32 net,mask;
struct in_addr in;
pcap_dumper_t *dumpdesc;
struct bpf_program fp; /* filtre */
/* Récupération des options */
while ((options = getopt (argc, argv, "i:d:f:")) != -1)
switch (options)
{
case 'i':
interface = optarg;
break;
case 'd':
fichier = optarg;
break;
case 'f':
filtre = optarg;
break;
case '?':
if (optopt == 'i')
fprintf (stderr, "Option -%c necessite un argument.\n", optopt);
else if (isprint (optopt))
fprintf (stderr, "Option inconnu `-%c'.\n", optopt);
else
fprintf (stderr, "Option inconnu `\\x%x'.\n", optopt);
if (optopt == 'd')
fprintf (stderr, "Option -%c necessite un argument.\n", optopt);
else if (isprint (optopt))
fprintf (stderr, "Option inconnu `-%c'.\n", optopt);
else
fprintf (stderr,"Option inconnu `\\x%x'.\n", optopt);
if (optopt == 'f')
fprintf (stderr, "Option -%c necessite un argument.\n", optopt);
else if (isprint (optopt))
fprintf (stderr, "Option inconnu `-%c'.\n", optopt);
else
fprintf (stderr,"Option inconnu `\\x%x'.\n", optopt);
return 1;
default:
abort ();
}
//printf ("interface = %s, fichier = %s, filtre = %s\n", interface, fichier, filtre);
for (index = optind; index < argc; index++)
printf ("Argument manquant %s\n", argv[index]);
/* Detection de l'interface de capture */
if (interface == NULL)
{
device = pcap_lookupdev(errbuf);
if (device == NULL) {
printf("Une erreur a été détectée: %s\n", errbuf);
}
} else {
device = interface;
if (device == NULL) {
printf("Une erreur a été détectée: %s\n", errbuf);
} else {
printf("Périphérique de capture: %s\n",device);
}
}
if (pcap_lookupnet(device, &net, &mask, errbuf) == -1) {
printf("Une erreur a été détectée: %s\n", errbuf);
} else {
printf("Périphérique: %s\n", device);
in.s_addr = net;
printf("Réseau: %s\n", inet_ntoa(in));
in.s_addr = mask;
printf("Masque: %s\n", inet_ntoa(in));
}
/* Obtenir un descripteur de capture de paquet */
handle = pcap_open_live(device, SNAP_LEN, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", device, errbuf);
exit(EXIT_FAILURE);
}
/* Compiler l'expression filtre */
if (pcap_compile(handle, &fp, filtre, 0, net) == -1) {
fprintf(stderr, "Verifier l'expresion filtre %s: %s\n", &filtre, pcap_geterr(handle));
exit(EXIT_FAILURE);
}
/* Appliquer le filtre */
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "erreur lors de l'application du filtre %s: %s\n", &filtre, pcap_geterr(handle));
exit(EXIT_FAILURE);
}
/* fonction callback */
//dumpdesc = pcap_dump_open(handle, fichier);
pcap_loop(handle,-1, got_packet, NULL);
/* cleanup */
pcap_freecode(&fp);
pcap_close(handle);
printf("\nCapture terminé.\n");
return 0;
} |
Partager