sniff.c

来自「Nast是一个基于Libnet 和Libpcap的sniffer包和LAN分析器」· C语言 代码 · 共 189 行

/*
    nast

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

*/

#include "include/nast.h"

/* prototypes */
void sniff (int d, int x, FILE *output, FILE *ldd);
int run_sniffer (u_short promisc, u_short data, u_short hex, u_short f, u_short l, char *filter, char *dev, char *ldname);

/* plugin to run sniffer */
int run_sniffer (u_short promisc, u_short data, u_short hex, u_short f, u_short l, char *filter, char *dev, char *ldname)
{
   char *mask;
   char errbuf[PCAP_ERRBUF_SIZE];
   libnet_t *L;
   struct libnet_ether_addr *e;
   struct in_addr addr;
   /* log data FILE descriptor */
   FILE *ldd;

   ldd = NULL;
   
   /* ask pcap for the network address and mask of the device */
   if ((pcap_lookupnet(dev,&netp,&maskp,errbuf))==-1)
     {
	fprintf (stderr, "pcap_lookupnet error: %s\n\n", errbuf);
	return -1;
     }

   if ((descr = pcap_open_live (dev, BUFSIZ, promisc, 10, errbuf))==NULL)
     {
	fprintf(stderr, "pcap_open_live() error: %s\n\n",errbuf);
	return -1;
     }

   if ((offset=(device(dev,descr)))==-1) return -1;

   L = libnet_init (LIBNET_LINK, NULL, errbuf);

   e = libnet_get_hwaddr(L);
   if (!e)
     {
	fprintf(stderr, "Can't get hardware address: %s\n\n", libnet_geterror(L));
	return -1;
     }

   addr.s_addr = maskp;
   if ((mask = inet_ntoa(addr))==NULL)
     {
	fprintf(stderr, "Impossible get the mask\n\n");
	return -1;
     }

   printf("\n");
   printf("%sSniffing on:\n\n%s", CYAN, NORMAL);
   printf("%s- Device:\t%s%s\n",BOLD, NORMAL, dev);
   printf("%s- MAC address:\t%s%s\n", BOLD, NORMAL, nast_hex_ntoa (e->ether_addr_octet));
   printf("%s- IP address:\t%s%s\n", BOLD, NORMAL, libnet_addr2name4(libnet_get_ipaddr4(L), 0));
   printf("%s- Netmask:\t%s%s\n",BOLD, NORMAL, mask);

   libnet_destroy(L);

   printf("%s- Promisc mode:\t%s", BOLD, NORMAL);
   if (promisc) printf("Set\n");
   else printf("Not set\n");

   printf ("%s- Filter:\t%s", BOLD, NORMAL);
   if (filter) printf("%s\n", filter);
   else printf("None\n");

   printf("%s- Logging:\t%s", BOLD, NORMAL);
   if (!ldname && !l) printf ("None\n");
   else if (ldname && !l) printf ("Sniffed data\n");
   else if (!ldname && l) printf ("Traffic\n");
   else if (ldname && l) printf ("Traffic and Sniffed data\n");

   /* log all packets */
   if (l)
     {
	openfile();

	fprintf(log, "NAST SNIFFER LOGGING REPORT\n");
	fprintf(log, "Made on %s, device %s (%s)\n\n", timed, dev, libnet_addr2name4(libnet_get_ipaddr4(L), 0));   
     }

   /* log only data */
   if (ldname)
     {
	if ((ldd = (fopen(ldname,"w"))) == NULL)
	  {
	     fprintf(stderr, "\nError: unable to open logfile descriptor: %s\n\n", strerror(errno));
	     return -1;
	  }
	fprintf(ldd, "NAST SNIFFED DATA REPORT\n");
	fprintf(ldd, "Made on %s, device %s (%s)\n\n", timed, dev, libnet_addr2name4(libnet_get_ipaddr4(L), 0));   
     }

   if (f)
     {
	if(pcap_compile(descr,&fp,filter,0,netp) == -1)
	  {
	     fprintf(stderr, "Error calling pcap_compile\n\n");
	     return -1;
	  }
	if(pcap_setfilter(descr,&fp) == -1)
	  {
	     fprintf(stderr, "Error calling pcap_setfilter\n\n");
	     return -1;
	  }

     }

   /* demonize only now */
   if (demonize)
     bkg();

   /* sniff here */
   while(1)
     {
	if ((packet = (u_char *) pcap_next (descr, &hdr))!=NULL)
	  {
	     if (!ldname)
	       sniff (data, hex, stdout, NULL);          /* print to stdout */
	     else
	       {
		  sniff (data, hex, stdout, ldd);        /* print to stdout and write data file */
		  fflush (ldd);
	       }

	     if (l)
	       {
		  sniff (data, hex, log, NULL);          /* log packets to file */
		  fflush (log);
	       }
	  }
     }

   if (l) fclose (log);
   if (ldname) fclose (ldd);
   return 0;
}

/* sniffer function heandler */
void sniff (int d, int x, FILE *output, FILE *ldd)
{
   struct libnet_ipv4_hdr *ip;
   u_int16_t type;

   type = handle_ethernet (packet);

   if (type==ETHERTYPE_IP)
     {
	ip = (struct libnet_ipv4_hdr *) (packet+offset);
	switch(ip->ip_p)
	  {
	   case IPPROTO_TCP:
	     handle_TCP (d, x, output, ldd);
	     break;
	   case IPPROTO_UDP:
	     handle_UDP (d, x, output, ldd);
	     break;
	   case IPPROTO_ICMP:
	     handle_ICMP (d, x, output, ldd);
	     break;
	   case IPPROTO_IGMP:
	     handle_IGMP (output);
	     break;
	  }
     }

   else if ((type==ETHERTYPE_ARP) || (type==ETHERTYPE_REVARP)) handle_ARP(output);
}