1 #include <stdio.h>
  2 #include <stdlib.h>
  3 #include <pcap.h>
  4
  5 #define PCAP_DATABUF_MAX 65535
  6
  7 #define ETHERTYPE_IPV4 0x0800
  8 #define ETHERTYPE_IPV6 0x86DD
  9
 10 typedef unsigned char   u_int8;
 11 typedef unsigned short  u_int16;
 12 typedef unsigned int    u_int32;
 13 typedef unsigned long   u_int64;
 14
 15 /*MAC头，总长度14字节 */
 16 typedef struct _eth_hdr{
 17     u_int8 dst_mac[6];
 18     u_int8 src_mac[6];
 19     u_int16 eth_type;
 20 }eth_hdr;
 21 eth_hdr *ethernet;
 22
 23 /*IP头*/
 24 typedef struct _ip_hdr{
 25     u_int8 ver_hl;    //版本和头长
 26     u_int8 serv_type; //服务类型
 27     u_int16 pkt_len;  //包总长
 28     u_int16 re_mark;  //重组标志
 29     u_int16 flag_seg; //标志位和段偏移量
 30     u_int8 surv_tm;    //生存时间
 31     u_int8 protocol;  //协议码（判断传输层是哪一个协议）
 32     u_int16 h_check;  //头检验和
 33     u_int32 src_ip;   //源ip
 34     u_int32 dst_ip;   //目的ip
 35     u_int32 option;   //可选选项
 36 }ip_hdr;
 37 ip_hdr *ip;
 38
 39 /*TCP头,总长度20字节，不包括可选选项*/
 40 typedef struct _tcp_hdr{
 41     u_int16 sport;     //源端口
 42     u_int16 dport;     //目的端口
 43     u_int32 seq;       //序列号
 44     u_int32 ack;       //确认序号
 45     u_int8  head_len;  //头长度
 46     u_int8  flags;     //保留和标记位
 47     u_int16 wind_size; //窗口大小
 48     u_int16 check_sum; //校验和
 49     u_int16 urgent_p;  //紧急指针
 50 }tcp_hdr;
 51 tcp_hdr *tcp;
 52
 53 /*UDP头，总长度8个字节*/
 54 typedef struct _udp_hdr{
 55     u_int16 sport;     //源端口
 56     u_int16 dport;     //目的端口
 57     u_int16 pktlen;    //UDP头和数据的总长度
 58     u_int16 check_sum; //校验和
 59 }udp_hdr;
 60 udp_hdr *udp;
 61
 62 //ip整型转换点分十进制
 63 char *InttoIpv4str(u_int32 num){
 64     char* ipstr = (char*)calloc(128, sizeof(char*));
 65
 66     if (ipstr)
 67         sprintf(ipstr, "%d.%d.%d.%d", num >> 24 & 255, num >> 16 & 255, num >> 8 & 255, num & 255);
 68     else
 69         printf("failed to Allocate memory...");
 70
 71     return ipstr;
 72 }
 73
 74 void pcap_callback(u_char *useless,const struct pcap_pkthdr *pkthdr, const u_char *packet)
 75 {
 76     printf("data len:%u\n", pkthdr->caplen); //抓到时的数据长度
 77     printf("packet size:%u\n", pkthdr->len); //数据包实际的长度
 78
 79     /*解析数据链路层 以太网头*/
 80     ethernet = (struct _eth_hdr*)packet;
 81     u_int64 src_mac = ntohs( ethernet->src_mac );
 82     u_int64 dst_mac = ntohs( ethernet->dst_mac );
 83
 84     printf("src_mac:%lu\n",src_mac);
 85     printf("dst_mac:%lu\n",dst_mac);
 86     printf("eth_type:%u\n",ethernet->eth_type);
 87
 88     u_int32 eth_len = sizeof(struct _eth_hdr);  //以太网头的长度
 89     u_int32 ip_len; //ip头的长度
 90     u_int32 tcp_len = sizeof(struct _tcp_hdr);  //tcp头的长度
 91     u_int32 udp_len = sizeof(struct _udp_hdr);  //udp头的长度
 92
 93     /*解析网络层  IP头*/
 94     if(ntohs(ethernet->eth_type) == ETHERTYPE_IPV4){  //IPV4
 95         printf("It's IPv4!\n");
 96
 97         ip = (struct _ip_hdr*)(packet + eth_len);
 98         ip_len = (ip->ver_hl & 0x0f)*4;            //ip头的长度
 99         u_int32 saddr = (u_int32)ntohl(ip->src_ip); //网络字节序转换成主机字节序
100         u_int32 daddr = (u_int32)ntohl(ip->dst_ip);
101
102         printf("eth_len:%u  ip_len:%u  tcp_len:%u  udp_len:%u\n", eth_len, ip_len, tcp_len, udp_len);
103
104         printf("src_ip:%s\n", InttoIpv4str(saddr));  //源IP地址
105         printf("dst_ip:%s\n", InttoIpv4str(daddr));  //目的IP地址
106
107         printf("ip->proto:%u\n", ip->protocol);      //传输层用的哪一个协议
108
109         /*解析传输层  TCP、UDP、ICMP*/
110         if(ip->protocol == 6){         //TCP
111             tcp = (struct _tcp_hdr*)(packet + eth_len + ip_len);
112             printf("tcp_sport = %u\n", tcp->sport);
113             printf("tcp_dport = %u\n", tcp->dport);
114
115 /**********(pcaket + eth_len + ip_len + tcp_len)就是TCP协议传输的正文数据了***********/
116
117         }else if(ip->protocol == 17){  //UDP
118             udp = (struct _udp_hdr*)(packet + eth_len + ip_len);
119             printf("udp_sport = %u\n", udp->sport);
120             printf("udp_dport = %u\n", udp->dport);
121
122 /**********(pcaket + eth_len + ip_len + udp_len)就是UDP协议传输的正文数据了***********/
123
124         }else if(ip->protocol == 1){   //ICMP
125
126         }
127
128     }else if(ntohs(ethernet->eth_type) == ETHERTYPE_IPV6){ //IPV6
129         printf("It's IPv6!\n");
130     }
131
132     printf("============================================\n");
133 }
134
135 int main()
136 {
137     char *dev;  //设备名
138     char errbuf[PCAP_ERRBUF_SIZE] = {}; //PCAP_ERRBUF_SIZE在pcap.h中已经定义
139     bpf_u_int32 netp, maskp;  //网络号和掩码
140     pcap_t *handler;          //数据包捕获描述字
141     struct bpf_program *fp;
142     char *filter_str = "port 9000";  //过滤条件
143
144     /*Find network devices*/
145     if((dev = pcap_lookupdev(errbuf)) == NULL){
146         printf("lookupdev failed:%s\n", errbuf);
147         exit(1);
148     }else{
149         printf("Device:%s\n", dev);
150     }
151
152     /*Get the network number and mask of the network device*/
153     if(pcap_lookupnet(dev, &netp, &maskp, errbuf) == -1){
154         printf("%s\n", errbuf);
155         exit(1);
156     }
157
158     /*Open network device*/
159     if((handler = pcap_open_live(dev, PCAP_DATABUF_MAX, 1, 0, errbuf)) == NULL){
160         printf("%s\n", errbuf);
161         exit(1);
162     }
163
164     /*Compiling and setting filtering conditions*/
165     if(pcap_compile(handler, fp, filter_str, 0, maskp) == -1){
166         printf("pcap_compile error...\n");
167         exit(1);
168     }
169     if(pcap_setfilter(handler, fp) == -1){
170         printf("pcap_setfilter error...\n");
171         exit(1);
172     }
173
174     /*Capturing and processing data packets*/
175     if(pcap_loop(handler, -1, pcap_callback, NULL) == -1){
176         printf("pcap_loop error...\n");
177         pcap_close(handler);
178     }
179
180     return 0;
181 }