LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Programming (https://www.linuxquestions.org/questions/programming-9/)
-   -   How to capture and analyze an IP packet (https://www.linuxquestions.org/questions/programming-9/how-to-capture-and-analyze-an-ip-packet-899319/)

savio_hit 08-25-2011 01:48 AM

How to capture and analyze an IP packet
 
I am able to capture an IP packet using pcap_next();
but it only displays the header.I need to analyze the data of the packet to see if its a GET request and need to capture the replay if it is. I'm trying this on ubuntu using C. Can anyone help me.....
Here is the coding that I used to capture the packet.

#include <pcap.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
pcap_t *handle; /* Session handle */
char *dev; /* The device to sniff on */
char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
struct bpf_program fp; /* The compiled filter */
char filter_exp[] = "port 23"; /* The filter expression */
bpf_u_int32 mask; /* Our netmask */
bpf_u_int32 net; /* Our IP */
struct pcap_pkthdr header; /* The header that pcap gives us */
const u_char *packet; /* The actual packet */

/* Define the device */
dev = pcap_lookupdev(errbuf);
if (dev == NULL) {
fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
return(2);
}
/* Find the properties for the device */
if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf);
net = 0;
mask = 0;
}
/* Open the session in promiscuous mode */
handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
if (handle == NULL) {
fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
return(2);
}
/* Compile and apply the filter */
if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
if (pcap_setfilter(handle, &fp) == -1) {
fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
return(2);
}
/* Grab a packet */
packet = pcap_next(handle, &header);
/* Print its length */
printf("Jacked a packet with length of [%d]\n", header.len);
printf("Here comes the data %s \n", packet);
/* And close the session */
pcap_close(handle);
return(0);
}

savio_hit 08-25-2011 02:04 AM

can I use tcpdump here

Tinkster 08-25-2011 03:11 AM

Moved: This thread is more suitable in <PROGRAMMING> and has been moved accordingly to help your thread/question get the exposure it deserves.

Proud 08-25-2011 07:29 AM

Keep reading. Your code seems to be from here:
http://www.tcpdump.org/pcap.html
I don't think you can just add that line to print the packet as a string.
Quote:

But how do you make use of this variable (named "packet" in our prototype)? A packet contains many attributes, so as you can imagine, it is not really a string, but actually a collection of structures (for instance, a TCP/IP packet would have an Ethernet header, an IP header, a TCP header, and lastly, the packet's payload). This u_char pointer points to the serialized version of these structures. To make any use of it, we must do some interesting typecasting.
Also note that's from 2002 and using a 2.2.19 kernel.


All times are GMT -5. The time now is 06:35 PM.