Sniffer implementation

Al-xkon · 06-24-2006, 04:54 AM

Hi
Does anyone know the basics of what is needed in order to implement a sniffer in Linux.
I thinking f developing it in C and C++ but i can't find any information on how to start.
an help apprecited

Thanks in advance

cupubboy · 06-24-2006, 05:46 AM

I think you should take a look at libpcap .. http://www.tcpdump.org/

introuble · 06-24-2006, 06:26 AM

Just one question: what kind of sniffer ?

fedora4002 · 06-25-2006, 01:15 PM

You can use perl or python package for libpcap and it is very easy to do it.

alred · 06-27-2006, 07:21 AM

if you are refering to networking stuffs and if you are going to use libpcap , heres something simple i collected from the net quite sometime ago , not sure whether its accurate but sometimes i use it just to make sure things are moving around at least ... its in c ...

Code:

//cc -o 00 pcap6.c -lpcap

#include <ctype.h> 
#include<stdio.h>
#include<pcap.h>
int main(int argc,char *argv[])
{
int i;
char errbuf[PCAP_ERRBUF_SIZE];
char dev[]="eth0"; // set the device to listen on lo or eth0
bpf_u_int32 mask;
bpf_u_int32 net;
pcap_t *descr;
const u_char *packet;
struct pcap_pkthdr hdr;
    
printf("\nOpen Device = %s\n\n",dev);
    
descr=pcap_open_live(dev,BUFSIZ,1,0,errbuf);  
  
for (;;){

 packet=(u_char *)pcap_next(descr,&hdr);
    
if (packet != NULL) {

 fprintf(stdout,"\n==================================================================================\n"); 
for (i=0; i <= hdr.len; i++) {
  if isgraph(*packet) printf("%c",*packet); else

    printf(".",*packet);
 //printf("%c",*packet);                          
 //    printf("%.2X",*packet);
          packet++;
}
   fprintf(stdout,"\n==================================================================================\n"); 
       
}
  printf("      capturing packet of length [%d] from device [%s] total of i run = %i\n",hdr.len,dev,i); 
}
 return(0); 
}

you need to take a look at tcpdump websites ...

//dont ask me how it actually works ^_^

.

Al-xkon · 06-28-2006, 11:30 AM

well i found information on libcap and tcpdump but i was hoping i could develop my own methods in spite of using libcap.
I think i should use raw sockets in Linux in order to implement it. at least for developing a ping program i should use raw sockets.
something similar i think i have to do.

cupubboy · 06-28-2006, 12:33 PM

I maybe way off .. but so is ping related to a sniffer

fedora4002 · 06-29-2006, 10:41 AM

The Sniffer can catch everything passing along the wire including PING traffic.

Al-xkon · 06-30-2006, 03:50 AM

well the only way i found in order to be able to analyze the network packets received is raw sockets.i can't find any other way of how to create it.
i mentioned ping because ping also analyzes packets an a version i found was created with sockets.

fedora4002 · 06-30-2006, 08:53 AM

PING is a program created to test the "liveness" of a host. Basically, it creates ICMP query and reply traffic.

Al-xkon · 07-06-2006, 05:45 AM

Finally i found how to create,and it seems it isvery simple.
the basin is that you create a socket(PF_PACKET,SOCK_RAW,htons(ETH_P_ALL));
The rest i'm looking for them but this is the basic idea.