arp.rar_arp抓包工具_libpcap_libpcap qt_pcap arp_qt 抓包

#include <stdio.h> #include <arpa/inet.h> #include <string.h> #include <pcap.h> struct ether_header { u_int8_t ether_dhost[6]; u_int8_t ether_shost[6]; u_int16_t ether_type; }; typedef u_int32_t in_addr_t; struct int6_addr { in_addr_t s_addr; }; struct arp_header { u_int16_t arp_hardware_type; u_int16_t arp_protocol_type; u_int8_t arp_hardware_length; u_int8_t arp_protocol_length; u_int16_t arp_operation_code; u_int8_t arp_source_ethernet_address[6]; u_int8_t arp_source_ip_address[4]; u_int8_t arp_destination_ethernet_address[6]; u_int8_t arp_destination_ip_address[4]; }; void arp_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr *packet_header,const u_char *packet_content) { struct arp_header *arp_protocol; u_short protocol_type; u_short hardware_type; u_short operation_code; u_char *mac_string; struct in_addr source_ip_address; struct in_addr destination_ip_address; u_char hardware_length; u_char protocol_length; printf("---------ARP protocol (Network Layer) ---------\n"); arp_protocol = (struct arp_hearder*)(packet_content + 14); hardware_type =ntohs(arp_protocol->arp_hardware_type); protocol_type =ntohs(arp_protocol->arp_protocol_type); operation_code = ntohs(arp_protocol->arp_operation_code); hardware_length = arp_protocol->arp_hardware_length; protocol_length =arp_protocol->arp_protocol_length; printf("ARP hardware type:%d\n", hardware_type); printf("ARP protocol type:%d\n", protocol_type); printf("ARP hardware length:%d\n", hardware_length); printf("ARP protocol length:%d\n",protocol_length); printf("ARP Operation:%d\n",operation_code); switch (operation_code) { case 1: printf("ARP Request protocol\n"); break; case 2: printf("ARP Reply Protocol\n"); break; printf("RARP Request protocol\n"); break; case 4: printf("RARP Reply Protocol\n"); break; default: break; } printf("Ethernet Source Address is : \n"); mac_string = arp_protocol->arp_source_ethernet_address; printf("%02x:%02x:%02x:%02x:%02x:%02x:\n", *mac_string, *(mac_string + 1), (*mac_string+2),*(mac_string + 3),*(mac_string + 4),*(mac_string + 5)); memcpy((void*)&source_ip_address,(void*)arp_protocol->arp_source_ip_address, sizeof(struct in_addr)); printf("source IP address:%s\n", inet_ntoa(source_ip_address)); printf("Ethernet Destination Address is : \n"); mac_string = arp_protocol->arp_destination_ethernet_address; printf("%02x:%02x:%02x:%02x:%02x:%02x:\n", *mac_string, *(mac_string + 1), (*mac_string+2),*(mac_string + 3),*(mac_string + 4),*(mac_string + 5)); memcpy((void*)&destination_ip_address,(void*)arp_protocol->arp_destination_ip_address, sizeof(struct in_addr)); printf("destination IP address:%s\n", inet_ntoa(destination_ip_address)); } void ethernet_protocol_packet_callback(u_char *argument, const struct pcap_pkthdr *packet_header,const u_char *packet_content) { u_short ethernet_type; struct ether_header *ethernet_protocol; u_char *mac_string; static int packet_number = 1; printf("******************************\n"); printf("the %d ARP packet is captured.\n", packet_number); printf("----------Ethernet Protocol (link layer)----------\n"); ethernet_protocol = (struct ether_header*)packet_content; printf("Ethernet type is:\n"); ethernet_type = ntohs(ethernet_protocol->ether_type); printf("%04x\n", ethernet_type); switch (ethernet_type) { case 0x0800: printf("the network layer is IP protocol\n"); break; case 0x0806: printf("the network layer is ARP protocol\n"); break; case 0x8035: printf("the network layer is RARP protocol\n"); break; default: break; } printf("Mac Source Address is : \n"); mac_string = ethernet_protocol->ether_shost; printf("%02x:%02x:%02x:%02x:%02x:%02x:\n", *mac_string, *(mac_string + 1), (*mac_string+2),*(mac_string + 3),*(mac_string + 4),*(mac_string + 5)); printf("Mac Source Address is : \n"); mac_string = ethernet_protocol->ether_dhost; printf("%02x:%02x:%02x:%02x:%02x:%02x:\n", *mac_string, *(mac_string + 1), (*mac_string+2),*(mac_string + 3),*(mac_string + 4),*(mac_string + 5)); switch (ethernet_type) { case 0x0806: arp_protocol_packet_callback(argument, packet_header, packet_content); break; default: break; } printf("*************************************\n"); packet_number++; } void main() { pcap_t *pcap_handle; char error_content[PCAP_ERRBUF_SIZE]; char *net_interface; struct bpf_program bpf_filter; char bpf_filter_string[]="arp"; bpf_u_int32 net_mask; bpf_u_int32 net_ip; net_interface = pcap_lookupdev(error_content); pcap_lookupnet(net_interface,&net_ip,&net_mask,error_content); pcap_handle = pcap_open_live(net_interface,BUFSIZ,1,0,error_content); pcap_compile(pcap_handle,&bpf_filter,bpf_filter_string,0,net_ip); pcap_setfilter(pcap_handle,&bpf_filter); if (pcap_datalink(pcap_handle) != DLT_EN10MB) return; pcap_loop(pcap_handle,-1,ethernet_protocol_packet_callback,NULL); pcap_close(pcap_handle); }