网络抓包工具wireshark and tcpdump 及其实现基于的libpcap

1 #include<stdio.h>
 2 #include<pcap.h>
 3 #include<string>
 4 
 5 using namespace std;
 6 
 7 static const unsigned int ETHER_ADDR_LEN = 6;    
 8 void call_back(u_char * args, const struct pcap_pkthdr * header, const u_char * packet);
 9 string generate_mac_address(char macChars[ETHER_ADDR_LEN]);
10 
11 int main(){
12     pcap_t * handle; // Sesion handle
13     char dev[] = "eth2";  //device to sniff on
14     char errbuf[PCAP_ERRBUF_SIZE]; // error string
15     char filter_exp[] = "";  //filter expression
16     bpf_u_int32 mask;  //The netmask of our sniffing device
17     bpf_u_int32 net;   //The IP of our sniffing device
18 
19     struct bpf_program fp;  //the compiled filter expression
20     
21     //查询device的mask和ip    
22     if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1){
23         fprintf(stderr, "Can't get netmask for device %s\n", dev);
24         net = 0;
25         mask = 0;
26     }
27 
28     //obtaining packet capture descriptor
29     handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
30     if(handle == NULL){
31         fprintf(stderr, "Can't open device %s\n", dev);
32         return 2;
33     }
34     
35     // before apply filter exp, compile it 
36     if(pcap_compile(handle, &fp, filter_exp, 0, net) == -1){
37         fprintf(stderr, "can't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
38         return 2;
39     }    
40     //apply filter to this session
41     if(pcap_setfilter(handle, &fp) == -1){
42         fprintf(stderr, "can't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
43         return 2;
44     }
45 
46     // now the device is prepared to sniff under the filter condition
47     struct pcap_pkthdr header; // packet header struct
48     const u_char * packet;  // actual packet
49     
50     //5表示积累5个包pcap_loop才返回，但每个包都会调一次call_back
51     while(!pcap_loop(handle, 5, call_back, NULL)){
52         printf("-------\n");  //每8行才会输出一次这个
53     }
54     pcap_close(handle);
55 }
56 
57 struct sniff_ethernet {
58         char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
59         char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
60         u_short ether_type; /* IP? ARP? RARP? etc */
61 };
62 
63 // call_back function的统一原型
64 void call_back(u_char * args, const struct pcap_pkthdr * header, const u_char * packet){
65     static int count = 0;
66     struct sniff_ethernet * ethernet;  //ethernet header
67     ethernet = (struct sniff_ethernet*)(packet);
68     
69     //把6字节的字符串转换成mac地址的表示形式
70     std::string source_mac_address = generate_mac_address(ethernet->ether_shost);
71     std::string dst_mac_address = generate_mac_address(ethernet->ether_dhost);
72 
73     printf("wy: call_back called %d,  %s->%s,   packet length:%d\n", count++, source_mac_address.c_str(), dst_mac_address.c_str(),  header->len);
74 }
75 
76 //由字节为单位字符串生成mac地址，16进制数的字串
77 string generate_mac_address(char macChars[ETHER_ADDR_LEN]){
78     string macAddr;
79     char temp[2];
80     for(int i = 0; i < ETHER_ADDR_LEN; i++){
81         //把一个字节转化成16进制表示形式
82         sprintf(temp, "%x", macChars[i]);
83         if(i != 0){
84             macAddr.append(":");
85         }
86         macAddr.append(temp, 2);
87     }
88     return macAddr;
89 }

1 struct pcap_pkthdr {
2         struct timeval ts; /* time stamp */
3         bpf_u_int32 caplen; /* length of portion present */
4         bpf_u_int32 len; /* length this packet (off wire) */
5     };