4

我正在读取一个 pcap 文件，我想打印出每个数据包的 IP 地址和端口号。我正在使用来自http://www.tcpdump.org/pcap.htm和http://www.rhyous.com/2011/11/13/how-to-read-a-pcap-file-from-wireshark的代码-with-c/。

这是我的代码：

#define SIZE_ETHERNET 14
#define ETHER_ADDR_LEN  6


/* Ethernet header */
    struct sniff_ethernet {
        u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
        u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
        u_short ether_type; /* IP? ARP? RARP? etc */
    };

    /* IP header */
    struct sniff_ip {
        u_char ip_vhl;      /* version << 4 | header length >> 2 */
        u_char ip_tos;      /* type of service */
        u_short ip_len;     /* total length */
        u_short ip_id;      /* identification */
        u_short ip_off;     /* fragment offset field */
    #define IP_RF 0x8000        /* reserved fragment flag */
    #define IP_DF 0x4000        /* dont fragment flag */
    #define IP_MF 0x2000        /* more fragments flag */
    #define IP_OFFMASK 0x1fff   /* mask for fragmenting bits */
        u_char ip_ttl;      /* time to live */
        u_char ip_p;        /* protocol */
        u_short ip_sum;     /* checksum */
        struct in_addr ip_src;
        struct in_addr ip_dst; /* source and dest address */
    };
    #define IP_HL(ip)       (((ip)->ip_vhl) & 0x0f)
    #define IP_V(ip)        (((ip)->ip_vhl) >> 4)

    /* TCP header */
    struct sniff_tcp {
        u_short th_sport;   /* source port */
        u_short th_dport;   /* destination port */
        u_int32_t th_seq;       /* sequence number */
        u_int32_t th_ack;       /* acknowledgement number */

        u_char th_offx2;    /* data offset, rsvd */
    #define TH_OFF(th)  (((th)->th_offx2 & 0xf0) >> 4)
        u_char th_flags;
    #define TH_FIN 0x01
    #define TH_SYN 0x02
    #define TH_RST 0x04
    #define TH_PUSH 0x08
    #define TH_ACK 0x10
    #define TH_URG 0x20
    #define TH_ECE 0x40
    #define TH_CWR 0x80
    #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
        u_short th_win;     /* window */
        u_short th_sum;     /* checksum */
        u_short th_urp;     /* urgent pointer */
};

int main(int argc, char *argv[])
{

    //get file
     char *filename = argv[1];

     //error buffer
     char errbuff[PCAP_ERRBUF_SIZE];

     //open file and create pcap handler
     pcap_t * handler = pcap_open_offline(filename, errbuff);

     //The header that pcap gives us
    struct pcap_pkthdr *header;

    //The actual packet 
    const u_char *packet;   

      int packetCount = 0;
      int i;

      //write to file 
      FILE *fp = fopen ( "result.txt", "w" ) ;

      //tcp info
    const struct sniff_ethernet *ethernet; /* The ethernet header */
    const struct sniff_ip *ip; /* The IP header */
    const struct sniff_tcp *tcp; /* The TCP header */
    u_int size_ip;
    u_int size_tcp;

    while (pcap_next_ex(handler, &header, &packet) >= 0)
    {
        // Show the packet number
        printf("Packet # %i\n", ++packetCount);
        fprintf(fp,"Packet # %i\n", packetCount);

        // Show the size in bytes of the packet
        printf("Packet size: %d bytes\n", header->len);
        fprintf(fp,"Packet size: %d bytes\n", header->len);

        // Show a warning if the length captured is different
        if (header->len != header->caplen)
            printf("Warning! Capture size different than packet size: %ld bytes\n", header->len);

        // Show Epoch Time
        printf("Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);
        fprintf(fp,"Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);

        ethernet = (struct sniff_ethernet*)(packet);
        ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
        size_ip = IP_HL(ip)*4;
        if (size_ip < 20) {
            printf("   * Invalid IP header length: %u bytes\n", size_ip);
            return;
        }
        tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);

        printf("src port: %d dest port: %d \n", tcp->th_sport, tcp->th_dport);
        fprintf(fp,"src port: %d dest port: %d \n", tcp->th_sport, tcp->th_dport);

        printf("src address: %s dest address: %s \n",  inet_ntoa(ip->ip_src),  inet_ntoa(ip->ip_dst));
        fprintf(fp,"src address: %s dest address: %s \n",  inet_ntoa(ip->ip_src),  inet_ntoa(ip->ip_dst));

        printf("seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack);
        fprintf(fp,"seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack);

        // Add two lines between packets
        printf("\n");
        fprintf(fp,"\n");
    }
    fclose (fp);
     return(0);
}

这是我的结果的一部分：

Packet # 1
Packet size: 74 bytes
Epoch Time: 1348895319:643493 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3071009507 ack number: 2490081174

Packet # 2
Packet size: 66 bytes
Epoch Time: 1348895319:643566 seconds
src port: 15578 dest port: 20480
src address: 192.168.5.162 dest address: 192.168.5.162
seq number: 2490081174 ack number: 3087786723

Packet # 3
Packet size: 207 bytes
Epoch Time: 1348895319:643720 seconds
src port: 15578 dest port: 20480
src address: 192.168.5.162 dest address: 192.168.5.162
seq number: 2490081174 ack number: 3087786723

Packet # 4
Packet size: 66 bytes
Epoch Time: 1348895320:127547 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3087786723 ack number: 560766870

Packet # 5
Packet size: 1514 bytes
Epoch Time: 1348895320:129417 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3087786723 ack number: 560766870

即使我使用了 src 和 dst ip 地址，ip 地址也是相同的。seq number 和 ack number 似乎太大了。任何人都可以看到导致我的问题的原因以及如何解决它。提前致谢。

4

1 回答 1

6
  1. 你确定你的转储里只有IP数据包吗？
  2. 这些值按网络字节顺序排列。您需要使用ntohl并ntohs转换它们。
  3. inet_ntoato 使用静态缓冲区，因此后续调用会覆盖该值（因此匹配的源地址和目标地址）。
于 2012-10-21T16:14:12.987 回答