{"id":58,"date":"2014-01-15T22:24:21","date_gmt":"2014-01-15T14:24:21","guid":{"rendered":"http:\/\/cmesoft.com\/?p=58"},"modified":"2014-01-15T23:24:55","modified_gmt":"2014-01-15T15:24:55","slug":"libpcap%e5%ad%a6%e4%b9%a0%e4%b9%8b%e4%b8%80%ef%bc%9aiptcp%e5%92%8cudp%e5%8d%8f%e8%ae%ae","status":"publish","type":"post","link":"http:\/\/cmesoft.com\/?p=58","title":{"rendered":"libpcap\u5b66\u4e60\u4e4b\u4e00\uff1aip,tcp\u548cudp\u534f\u8bae"},"content":{"rendered":"

\u8fd9\u4e2a\u4f8b\u5b50\u4f7f\u7528libpcap\u89e3\u6790\u7f51\u7edc\u62a5\u6587\uff0c\u6253\u5370tcp\/udp\u534f\u8bae\u7684\u5185\u5bb9\u3002
\n\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u8fd9\u4e2a\u7a0b\u5e8f\u7684\u7f16\u8bd1\u9700\u8981libpcap-devel\u652f\u6301\u3002
\n\u5982\u679c\u901a\u8fc7\u547d\u4ee4:
\n
\nrpm -qa | grep pcap
\n<\/coolcode>
\n\u67e5\u770b\u4e0d\u5230 libpcap-devel\u7684\u8bdd\uff0c\u5c31\u9700\u8981
\n
\nsudo yum install libpcap-devel -y
\n<\/coolcode>
\n\u6765\u5b89\u88c5\u8fd9\u4e2a\u5305\u3002
\n\u7136\u540e\u4e0b\u8f7d\u9644\u4ef6\u7684\u6e90\u7801
\npcap1(\u70b9\u51fb\u5373\u53ef\u76f4\u63a5\u4e0b\u8f7d)<\/a>
\n\u89e3\u538b\u7f29\uff0c\u8fdb\u5165\u76ee\u5f55\u4e2d\uff0c\u76f4\u63a5\u8fd0\u884c
\n
\nmake
\n<\/coolcode>
\n\u5373\u53ef\u5b8c\u6210\u7f16\u8bd1\uff0c\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u540d\u79f0\u4e3a “a”
\n\u5982\u4e0b\u8fd0\u884c:
\n
\nsudo .\/a bond0 (\u6216\u8005eth0\u7b49)
\n<\/coolcode>
\n\u53ef\u4ee5\u770b\u5230\u89e3\u6790\u5230\u7684\u62a5\u6587\uff0c\u8f93\u51fa\u5982\u4e0b\uff1a
\n
\nDevice: bond0
\nNumber of packets: 10
\nFilter expression: udp<\/p>\n

Packet number 1:
\n From: 0.0.0.0
\n To: 255.255.255.255
\n Protocol: UDP
\n Src port: 68
\n Dst port: 67
\nudp length:286
\nudp sum:17843
\n Payload (278 bytes):
\n00000 01 01 06 00 5e 2a 4d cd 00 00 80 00 00 00 00 00 ….^*M………
\n00016 00 00 00 00 00 00 00 00 00 00 00 00 00 21 5e 2a ………….!^*
\n00032 4d ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 M……………
\n00048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00064 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00096 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00112 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00144 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00176 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00192 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00208 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
\n00224 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 …………c.Sc
\n00240 35 01 01 33 04 ff ff ff ff 0c 08 36 34 39 41 41 5..3…….649AA
\n00256 33 32 31 37 03 01 03 06 ff 00 00 00 00 00 00 00 3217…………
\n00272 00 00 00 00 00 00 ……<\/p>\n

Packet number 2:
\n From: 10.232.2.102
\n To: 10.232.2.254
\n Protocol: UDP
\n Src port: 38880
\n Dst port: 53
\nudp length:46
\nudp sum:41840
\n Payload (38 bytes):
\n00000 d6 a9 01 00 00 01 00 00 00 00 00 00 04 70 6f 70 ………….pop
\n00016 33 0b 61 6c 69 62 61 62 61 2d 69 6e 63 03 63 6f 3.alibaba-inc.co
\n00032 6d 00 00 01 00 01 m…..<\/p>\n

Packet number 3:
\n From: 10.232.2.254
\n To: 10.232.2.102
\n Protocol: UDP
\n Src port: 53
\n Dst port: 38880
\nudp length:214
\nudp sum:60805
\n Payload (206 bytes):
\n00000 d6 a9 81 80 00 01 00 01 00 04 00 04 04 70 6f 70 ………….pop
\n00016 33 0b 61 6c 69 62 61 62 61 2d 69 6e 63 03 63 6f 3.alibaba-inc.co
\n00032 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e9 m……………
\n00048 00 04 2a 78 51 1b c0 11 00 02 00 01 00 00 02 02 ..*xQ………..
\n00064 00 15 04 6e 73 68 7a 0d 61 6c 69 62 61 62 61 6f …nshz.alibabao
\n00080 6e 6c 69 6e 65 c0 1d c0 11 00 02 00 01 00 00 02 nline………..
\n00096 02 00 07 04 6e 73 70 32 c0 47 c0 11 00 02 00 01 ….nsp2.G……
\n00112 00 00 02 02 00 06 03 6e 73 38 c0 47 c0 11 00 02 …….ns8.G….
\n00128 00 01 00 00 02 02 00 06 03 6e 73 70 c0 47 c0 76 ………nsp.G.v
\n00144 00 01 00 01 00 01 bf b5 00 04 6e 4b d9 03 c0 88 ……….nK….
\n00160 00 01 00 01 00 01 c0 07 00 04 6e 4b d9 02 c0 42 ……….nK…B
\n00176 00 01 00 01 00 01 c0 07 00 04 79 00 15 04 c0 63 ……….y….c
\n00192 00 01 00 01 00 01 c0 07 00 04 79 00 15 03 ……….y…
\n<\/coolcode>
\n\u6ce8\u610f
\n(1): \u534f\u8bae\u7c7b\u578b<\/b>
\n\u4e5f\u53ef\u4ee5\u628a\u8fc7\u6ee4\u5668\u5b57\u7b26\u4e32\u4eceip\u4fee\u6539\u4e3atcp\u6216\u8005udp,\u6bd4\u5982\u4f60\u53ef\u4ee5\u628a\u4ee3\u7801\u884c:
\n
\n char filter_exp[] = “ip”;
\n<\/coolcode>
\n\u4fee\u6539\u4e3a:
\n
\n char filter_exp[] = “udp”;
\n<\/coolcode>
\n\u8fd9\u6837\uff0c\u5c31\u53ea\u4f1a\u8fc7\u6ee4\u6307\u5b9a\u534f\u8bae\u7684\u62a5\u6587\u5230\u56de\u8c03\u51fd\u6570 got_packet\u3002<\/p>\n

(2): \u5904\u7406\u5305\u4e2a\u6570<\/b>
\n\u5728\u4ee3\u7801
\n
\npcap_loop (handle, -1, got_packet, NULL);
\n<\/coolcode>
\n\u4e2d\uff0c\u5f53\u7b2c\u4e8c\u4e2a\u53c2\u6570\u4e3a\u6b63\u6570num\u65f6\uff0c\u5904\u7406\u5230num\u4e2a\u5305\u5c31\u4f1a\u9000\u51fa\uff0c\u800c\u4e3a-1\u65f6\uff0c\u5c31\u4f1a\u4e00\u76f4\u5904\u7406\u4e0b\u53bb\uff0c\u8fd9\u70b9\u8981\u6ce8\u610f\u4e0b\u3002
\n(3): \u6838\u5fc3\u4ee3\u7801\u7247\u6bb5<\/b>
\n\u8fd9\u4e2a\u4f8b\u5b50\u7684\u6838\u5fc3\u51fd\u6570\u662f\uff1a
\n
\nvoid
\ngot_packet (u_char * args, const struct pcap_pkthdr *header,
\n const u_char * packet);
\n<\/coolcode>
\n\u4ed6\u662f\u6ce8\u518c\u5230pcap\u7684\u56de\u8c03\u51fd\u6570\uff0c\u7528\u4e8e\u5904\u7406\u7ecf\u8fc7\u89c4\u5219 filter_exp \u8fc7\u6ee4\u540e\u7684\u62a5\u6587\u3002
\n\u770b\u8fd9\u4e2a\u51fd\u6570\u4e4b\u524d\uff0c\u5148\u770b\u770b\u4ee3\u7801\u4e2d\u7684\u51e0\u4e2a\u6570\u636e\u7ed3\u6784\u5b9a\u4e49\u3002
\n\u9996\u5148\u662fMAC\u534f\u8bae\u5934\u548cIP\u534f\u8bae\u5934\u5b9a\u4e49\uff1a
\n
\n\/* Ethernet header *\/
\nstruct sniff_ethernet
\n{
\n u_char ether_dhost[ETHER_ADDR_LEN]; \/* destination host address *\/
\n u_char ether_shost[ETHER_ADDR_LEN]; \/* source host address *\/
\n u_short ether_type; \/* IP? ARP? RARP? etc *\/
\n};
\n\/* IP header *\/
\nstruct sniff_ip
\n{
\n u_char ip_vhl; \/* version << 4 | header length >> 2 *\/
\n u_char ip_tos; \/* type of service *\/
\n u_short ip_len; \/* total length *\/
\n u_short ip_id; \/* identification *\/
\n u_short ip_off; \/* fragment offset field *\/
\n#define IP_RF 0x8000 \/* reserved fragment flag *\/
\n#define IP_DF 0x4000 \/* dont fragment flag *\/
\n#define IP_MF 0x2000 \/* more fragments flag *\/
\n#define IP_OFFMASK 0x1fff \/* mask for fragmenting bits *\/
\n u_char ip_ttl; \/* time to live *\/
\n u_char ip_p; \/* protocol *\/
\n u_short ip_sum; \/* checksum *\/
\n struct in_addr ip_src, ip_dst; \/* source and dest address *\/
\n};
\n<\/coolcode>
\n\u5982\u679c\u4f60\u8fd8\u770b\u4e0d\u61c2\u8fd9\u4e24\u4e2a\u6570\u636e\u7ed3\u6784\u7684\u5b9a\u4e49\uff0c\u90a3\u4e48\uff0c\u8fc5\u901f\u53bb\u767e\u5ea6\u4e0btcp\/ip\u534f\u8bae\u56fe\u793a\uff0c\u5148\u5f04\u660e\u767dMAC\/IP\u5c42\u534f\u8bae\u5305\u542b\u4e86\u54ea\u4e9b\u5143\u7d20\u3002\u6216\u8005\u5b89\u88c5\u4e2awireshark\u6216\u8005tcpdump\u6293\u5305\u770b\u4e0b\u3002\u6700\u597d\u7684\u65b9\u5f0f\u5c31\u662f\u5728windows\u4e0b\u7528wireshark\u6293\u53d6\u4e00\u4e2a\u62a5\u6587\u770b\u4e0b\u7ed3\u6784\uff0c\u53e6\u5916\uff0c\u4e5f\u53ef\u4ee5\u9605\u8bfb\u300aTCP\/IP\u7b2c\u4e00\u5377\uff1a\u534f\u8bae\u300b\u6765\u638c\u63e1\u8fd9\u90e8\u5206\u77e5\u8bc6\u3002<\/p>\n

\u7b2c\u4e8c\u4e2a\u6570\u636e\u7ed3\u6784\u662fudp\u534f\u8bae\u5934\uff0c\u5728\u539f\u6765\u7684\u5f00\u6e90\u4ee3\u7801\u4e2d\u662f\u6ca1\u6709sniff_udp\u7ed3\u6784\u5b9a\u4e49\u7684\uff0c\u4e0d\u8fc7\u53c2\u8003ip\u548ctcp\u7ed3\u6784\u7684\u5b9a\u4e49\uff0c\u4ee5\u53caTCP\/IP\u534f\u8bae\u7ed3\u6784\u56fe\uff0c
\n\u5c31\u53ef\u4ee5\u5b9a\u4e49\u51fasniff_udp\u7684\u7ed3\u6784\uff0c\u5982\u4e0b\uff1a
\n
\nstruct sniff_udp
\n{
\n uint16_t sport; \/* source port *\/
\n uint16_t dport; \/* destination port *\/
\n uint16_t udp_length;
\n uint16_t udp_sum; \/* checksum *\/
\n};
\n<\/coolcode>
\nudp\u534f\u8bae\u662f\u6bd4\u8f83\u7b80\u5355\u7684\uff0ctcp\u7ed3\u6784\u7531\u4e8e\u5176\u534f\u8bae\u590d\u6742\uff0c\u6570\u636e\u7ed3\u6784\u4e5f\u5c31\u590d\u6742\u591a\u4e86\uff0c\u5b9a\u4e49\u5982\u4e0b\uff1a
\n
\nstruct sniff_tcp
\n{
\n u_short th_sport; \/* source port *\/
\n u_short th_dport; \/* destination port *\/
\n tcp_seq th_seq; \/* sequence number *\/
\n tcp_seq th_ack; \/* acknowledgement number *\/
\n u_char th_offx2; \/* data offset, rsvd *\/
\n#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
\n u_char th_flags;
\n#define TH_FIN 0x01
\n#define TH_SYN 0x02
\n#define TH_RST 0x04
\n#define TH_PUSH 0x08
\n#define TH_ACK 0x10
\n#define TH_URG 0x20
\n#define TH_ECE 0x40
\n#define TH_CWR 0x80
\n#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
\n u_short th_win; \/* window *\/
\n u_short th_sum; \/* checksum *\/
\n u_short th_urp; \/* urgent pointer *\/
\n};
\n<\/coolcode>
\n\u7136\u540e\uff0cmac\u5934\uff0cip\u5934\uff0ctcp\u5934\u548cudp\u5934\u7684\u89e3\u6790\u5c31\u6bd4\u8f83\u5bb9\u6613\u770b\u61c2\u4e86\uff1a
\n
\n\/* define ethernet header *\/
\n ethernet = (struct sniff_ethernet *) (packet);<\/p>\n

\/* define\/compute ip header offset *\/
\n ip = (struct sniff_ip *) (packet + SIZE_ETHERNET);<\/p>\n

\/* define\/compute tcp header offset *\/
\n tcp = (struct sniff_tcp *) (packet + SIZE_ETHERNET + size_ip);
\n udp = (struct sniff_udp *) (packet + SIZE_ETHERNET + size_ip);
\n<\/coolcode>
\ntcp\u548cudp\u7684payload\u4e5f\u662f\u6839\u636e\u534f\u8bae\u6765\u8ba1\u7b97\u7684\uff1a
\n
\n \/* define\/compute tcp payload (segment) offset *\/
\n payload = (u_char *) (packet + SIZE_ETHERNET + size_ip + size_tcp);<\/p>\n

\/* compute tcp payload (segment) size *\/
\n size_payload = ntohs (ip->ip_len) – (size_ip + size_tcp);<\/p>\n

payload = (u_char *) (packet + SIZE_ETHERNET + size_ip + 8);
\n size_payload = ntohs (ip->ip_len) – (size_ip + 8);
\n<\/coolcode>
\n\u6700\u540e\u662f\u6253\u5370payload\u7684\u4ee3\u7801\u7247\u6bb5\uff1a
\n
\nvoid
\nprint_payload (const u_char * payload, int len)
\n{<\/p>\n

int len_rem = len;
\n int line_width = 16;\t\t\/* number of bytes per line *\/
\n int line_len;
\n int offset = 0;\t\t\/* zero-based offset counter *\/
\n const u_char *ch = payload;<\/p>\n

if (len <= 0)\n return;\n\n \/* data fits on one line *\/\n if (len <= line_width)\n {\n print_hex_ascii_line (ch, len, offset);\n return;\n }\n\n \/* data spans multiple lines *\/\n for (;;)\n {\n \/* compute current line length *\/\n line_len = line_width % len_rem;\n \/* print line *\/\n print_hex_ascii_line (ch, line_len, offset);\n \/* compute total remaining *\/\n len_rem = len_rem - line_len;\n \/* shift pointer to remaining bytes to print *\/\n ch = ch + line_len;\n \/* add offset *\/\n offset = offset + line_width;\n \/* check if we have line width chars or less *\/\n if (len_rem <= line_width)\n\t{\n\t \/* print last line and get out *\/\n\t print_hex_ascii_line (ch, len_rem, offset);\n\t break;\n\t}\n }\n\n return;\n}\n<\/coolcode>
\n\u6574\u4e2a\u7a0b\u5e8f\u57fa\u672c\u4e0a\u5c31\u5206\u6790\u5b8c\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u8fd9\u4e2a\u4f8b\u5b50\u4f7f\u7528libpcap\u89e3\u6790\u7f51\u7edc\u62a5\u6587\uff0c\u6253\u5370tcp\/udp\u534f\u8bae\u7684\u5185\u5bb9\u3002 \u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u8fd9\u4e2a\u7a0b\u5e8f\u7684\u7f16\u8bd1\u9700\u8981lib… Read More »libpcap\u5b66\u4e60\u4e4b\u4e00\uff1aip,tcp\u548cudp\u534f\u8bae<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[12],"tags":[],"class_list":["post-58","post","type-post","status-publish","format-standard","hentry","category-12"],"_links":{"self":[{"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/posts\/58","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/cmesoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=58"}],"version-history":[{"count":11,"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":71,"href":"http:\/\/cmesoft.com\/index.php?rest_route=\/wp\/v2\/posts\/58\/revisions\/71"}],"wp:attachment":[{"href":"http:\/\/cmesoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cmesoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cmesoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}