capture.c

来自「linux系统下捕获信息程序。可以显示源」· C语言 代码 · 共 214 行

 /*   capture.c   */
/*   gcc   -W   -Wall   -Wno-unused   -ggdb   -o   capture   capture.c   */
  #include <stdio.h>   
  #include <fcntl.h>   
  #include <errno.h>   
  #include <stdlib.h>   
  #include <unistd.h>
  #include <ctype.h>
  #include <string.h>   
  #include <net/if.h>   
  #include <features.h>   
  #include <sys/ioctl.h>   
  #include <sys/types.h>   
  #include <arpa/inet.h>   
  #include <netinet/in.h>   
  #include <netinet/ip.h>   
  #include <netinet/tcp.h>
  #include <linux/if_ether.h>   
  #include <sys/socket.h>   
  #include <net/ethernet.h>   
  #include <netpacket/packet.h>   
    
  #include <fcntl.h>   
  #include <signal.h>   
  #include <sys/stat.h>   
    
  #define DEFAULT_DEVICE_NAME "eth0"   
  #define DEFAULT_RECORD_FILENAME "packet.dat"   
    
  typedef unsigned   char   uchar;   
    
  int RecordFile;   
  int Packet;   
  int PacketCount   =   0;   
  char *RecordFileName   =   DEFAULT_RECORD_FILENAME;   
  char *DeviceName   =   DEFAULT_DEVICE_NAME; 
  unsigned   char   *iphead,   *ethhead;   
  short int DefaultFlag;   
  struct ifreq ifr;   
    
  void ArgInit(   int   argc,   char   **argv   )   
  {   
  }     
  void Shutdown(   int   signum   )   
  {

  fdatasync(   RecordFile   );   
  close(   RecordFile   );   
  ifr.ifr_flags   =   DefaultFlag;   
  ioctl(   Packet,   SIOCSIFFLAGS,   &ifr   );   
  close(   Packet   );   
  fprintf(   stdout,   "Capture   %d   packets\n",   PacketCount   );   
  exit(   0   );   
  }    
  void AppInit(   void   )   
  {   
  RecordFile   =   open(   RecordFileName,   O_RDWR   |   O_CREAT   |   O_TRUNC   );   
  if   (   RecordFile   <   0   )   
  {   
  fprintf(   stderr,   "can't   open   record   file   :   [%s]\n",   strerror(errno)   );   
  exit(   1   );   
  }   
    
  strcpy(   ifr.ifr_name,   DeviceName   );   
  fchmod(   RecordFile,   0644   );   
  signal(   SIGINT,   Shutdown   );   
  signal(   SIGTERM,   Shutdown   );   
  }   
    
  void PacketInit(   void   )   
  {   
  int r,   flag;   
    
  Packet   =   socket(   PF_PACKET,   SOCK_RAW,   htons(ETH_P_ALL)   );   
  if   (   Packet   <   0   )   
  {   
  fprintf(   stderr,   "socket   failed   :   [%s]\n",   strerror(errno)   );   
  exit(   1   );   
  }   
    
  r   =   ioctl(   Packet,   SIOCGIFFLAGS,   &ifr   );   
  if   (   r   <   0   )   
  {   
  fprintf(   stderr,   "ioctl   failed   :   [%s]\n",   strerror(errno)   );   
  close(   Packet   );   
  exit(   1   );   
  }   
    
  DefaultFlag   =   ifr.ifr_flags;   
                ifr.ifr_flags   |=   IFF_PROMISC;   
  r   =   ioctl(   Packet,   SIOCSIFFLAGS,   &ifr   );   
  if   (   r   <   0   )   
  {   
  fprintf(   stderr,   "ioctl   failed   :   [%s]\n",   strerror(errno)   );   
  close(   Packet   );   
  exit(   1   );   
  }   
  }   
    
  void CaptureLoop(   void   )   
  {   
  int n ;   
  uchar buf[2048]; 
    
  while(   1   )
    { 
  n   =   recvfrom(   Packet,   buf,   sizeof(buf),   0,   NULL,   NULL   );   
  if   (   n   <=   0   )   
  {   
  fprintf(   stderr,   "recvfrom   error   :   [%s]\n",   strerror(errno)   );   
   break;   
  } 
  
   ethhead   =   buf;   
        printf("Source   MAC   address:   "   
                      "%02x:%02x:%02x:%02x:%02x:%02x\n",   
                       ethhead[0],ethhead[1],ethhead[2],   
                       ethhead[3],ethhead[4],ethhead[5]);   
          printf("Destination   MAC   address:   "   
                      "%02x:%02x:%02x:%02x:%02x:%02x\n",   
                        ethhead[6],ethhead[7],ethhead[8],   
                        ethhead[9],ethhead[10],ethhead[11]);   
    
          iphead   =   buf+14;   /*   Skip   Ethernet   header   */ 
  
         if   (*iphead==0x45)  
       {            /*   Double   check   for   IPv4    and   no   options   present    *     */  
                                                         
            printf("Source   host   %d.%d.%d.%d\n",   
                          iphead[12],iphead[13],   
                         iphead[14],iphead[15]);   
            printf("Dest   host   %d.%d.%d.%d\n",   
                         iphead[16],iphead[17],   
                         iphead[18],iphead[19]);   
           printf("Sourcrecvfrome,Dest   ports   %d,%d\n",   
                        (iphead[20]<<8)+iphead[21],   
                       (iphead[22]<<8)+iphead[23]);   
       printf("Layer-4   protocol   %d\n",iphead[9]);   
   	 
   	
        
  	}

int   t;   
  uchar buf[2048];   
  t   =   0;  
 
  bzero(   buf,   sizeof(buf)   ); 
  read(Packet,buf,n);

  while(   (n-t)   >=   16   )   
  {   
  int i;   
  printf(   "[   "   );   
  for   (   i   =   0;   i   <   16;   i++   )   
  printf("%02x   ",buf[t+i]);   
  printf(   "]\t["   );   
  for   (   i   =   0;   i   <   16;   i++   )   
  {   
  char ch   =   buf[t+i];   
  if   (   isalnum(ch)   )   
  printf(   "%c",   ch   );   
  else   
  printf(".");   
  }   
  printf("]\n");   
  t   +=   16;
  }   
  if   (   n   >   t   )   
  {   
  int i   =   t;   
  printf(   "[   "   );   
  while(   i   <   n   )   
  printf(   "%02x   ",   buf[i++]   );   
  printf("]");   
  i   =   n   -   t;   
  i   =   16   -   i;   
  while(   i--   )   printf(   "       "   );   
  printf(   "\t["   );   
  i   =   t;   
  while(i<n)   
  {   
  char ch   =   buf[i++];   
  if   (   isalnum(ch)   )   
  printf(   "%c",   ch   );   
  else   
  printf(".");   
  }   
  printf(   "]\n"   );   
  }   
  printf(   "\n"   );
     
           PacketCount++;
  }   
  fprintf(   stdout,   "Capture   %d   packets\n",   PacketCount   );   
 fdatasync(   RecordFile   ); 
  close(   RecordFile   );   
  ifr.ifr_flags   =   DefaultFlag;   
  ioctl(   Packet,   SIOCSIFFLAGS,   &ifr   );   
  close(   Packet   );  
 
    
} 

  int main(   int   argc,   char   **argv   )   
  {   
  ArgInit(   argc,   argv   );   
  AppInit();   
  PacketInit();  
  CaptureLoop();   
  return   0;   
  }