0

我写了一个小程序来玩libpcap。问题是我捕获的标头的源地址和目标地址字段似乎总是为空。

代码：

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <linux/if_ether.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <pcap.h>
#include <arpa/inet.h>

#define BUFFERSIZE 65535

char errbuf[PCAP_ERRBUF_SIZE];

void sniffloop(u_char *, const struct pcap_pkthdr *, const u_char *);

void usage(char *name){
    fprintf(stderr, "usage: %s <interface> <secret>", name);
    exit(1);
}

int main(int argc, char **argv){
    pcap_t *sniffsess;
    struct bpf_program filter;

    if(argc<3){
        usage(argv[0]);
        return 1;
    }

    if(!(sniffsess=pcap_open_live(argv[1], BUFFERSIZE, 0, 1000, errbuf))){
        fprintf(stderr, "%s: couldn't open devices for sniffing: %s\n", argv[0], errbuf);
        return 1;
    }

    if(pcap_datalink(sniffsess)!=DLT_EN10MB){
        fprintf(stderr, "%s: %s not an ethernet device", argv[0], argv[1]);
        return 1;
    }

    if(pcap_compile(sniffsess, &filter, "icmp", 0, 0)==-1){
        fprintf(stderr, "%s: couldn't parse icmp filter", argv[0]);
        return 1;
    }

    if(pcap_setfilter(sniffsess, &filter)==-1){
        fprintf(stderr, "%s: couldn't set icmp filter", argv[0]);
        return 1;
    }

    // daemonize here.
    pcap_loop(sniffsess, -1, sniffloop, NULL);
}

void sniffloop(u_char *args, const struct pcap_pkthdr *hdr, const u_char *pkt){
    struct ethhdr *ehdr=(struct ethhdr *)pkt;
    struct iphdr *ipheader=(struct iphdr *)pkt+sizeof(struct ethhdr);
    struct icmphdr *icmpheader=(struct icmphdr*)pkt+sizeof(structethhdr)+ipheader->ihl*4;
    char *data=(char *)pkt+sizeof(struct ethhdr)+ipheader->ihl*4+sizeof(struct icmphdr);
    struct in_addr source,destination;
    source.s_addr=ipheader->saddr;
    destination.s_addr=ipheader->daddr;

    printf("sourceaddress is %p\ndestinationaddess is %p\n", ipheader->saddr, ipheader->daddr);
}

输出：

spongebob code # ./icmpexec br0 foo
sourceaddress is (nil)
destinationaddess is (nil)
sourceaddress is (nil)
destinationaddess is (nil)

我已经搜索了答案，但没有找到任何东西。我认为我最有可能在协议头中弄错了一些偏移量。

感谢您查看此内容！:D

4

1 回答 1

2

你所有的地址计算都是错误的。例如：

struct iphdr *ipheader=(struct iphdr *)pkt+sizeof(struct ethhdr);

需要是：

struct iphdr *ipheader=(struct iphdr *)(pkt+sizeof(struct ethhdr));
于 2011-07-29T06:03:18.243 回答