A simple sniffier tool I wrote in linux

I wrote a simple sniffier tool in linux-general Linux technology-Linux programming and kernel information. The following is a detailed description. Original: Milan Wang
I use the lipcap toolkit to write code. Just one file: The eth_txt.c file, which is then compiled using GCC, can be used on the FC to detect and analyze network packets.

There is also a TEMP file to save the captured content.

CODE: // eth_txt.c // When detect ethenet frame, deplay the text // Methods of use // Eth_txt // The example // Eth_txt le0 // The method of end // Input the control key C // Read the head file # Include # Include # Include # Include # Include # Include # Include # Include # Include // Pcap programe library # Include // The use of DNS searching # Define DEFAULT_SNAPLEN 68 # Define MAXSTRINGSIZE 256 // the length of the string # Define MAXENTRY 1024 // the max number of the fastcache in the table of the host // Print the mac address of the packet Void print_hwadd (u_char * hwadd ){ Int I; For (I = 0; I <5; I ++) Printf ("% 2x:", hwadd [I]); Printf ("% 2x", hwadd [I]); } // Print the ip address of the packet Void print_ipadd (u_char * ipadd ){ Int I; For (I = 0; I <3; ++ I) Printf ("% d.", ipadd [I]); Printf ("% d \ n", ipadd [I]); } // Mean the data of the packet Void packet_print (u_char * user, const struct pcap_pkthdr * h, const u_char * p) { Struct ether_header * eth; // the pointer of the structe of the head of the ethernetpacket Static long int counter = 0; Struct ether_arp * arppkt; Struct ip * iph; Struct icmphdr * icmp; Printf ("% d \ n", (h-> ts). TV _sec ); Printf ("xiaobinker find data \ n "); Printf ("% d \ n", ++ counter ); Printf ("% d \ n", h-> len ); Int I; Eth = (struct ether_header *) p; Print_hwadd (eth-> ether_shost ); Printf ("----"); Print_hwadd (eth-> ether_dhost ); Printf ("\ n "); Printf ("% x \ n", ntohs (eth-> ether_type )); If (ntohs (eth-> ether_type )){ Iph = (struct ip *) (p + sizeof (struct ether_header )); Printf ("Find IP "); If (iph-> ip_p = 0 ){ Icmp = (struct icmphdr *) (p + sizeof (struct ether_header) + sizeof (struct ip )); Printf ("ICMP packet "); // Printf ("% d \ n", icmp-> type ); } Print_hostname (u_char *) & (iph-> ip_src )); // Print_ipadd (u_char *) & (iph-> ip_src )); Printf ("====== "); // Print_ipadd (u_char *) & (iph-> ip_dst )); Print_hostname (u_char *) & (iph-> ip_dst )); Printf ("\ t % d", iph-> ip_ttl ); Printf ("\ t % d", iph-> ip_p ); } Unsigned int typeno; Typeno = ntohs (eth-> ether_type ); If (typeno = ETHERTYPE_ARP) | (typeno = ETHERTYPE_REVARP )){ Arppkt = (struct ether_arp *) (p + sizeof (struct ether_header )); If (typeno = ETHERTYPE_ARP) Printf ("arp "); Else printf ("rarp "); Print_hwadd (u_char *) & (arppkt-> arp_sha )); Printf (","); Print_ipadd (u_char *) & (arppkt-> arp_spa )); Printf ("======== "); Print_hwadd (u_char *) & (arppkt-> arp_tha )); Printf (","); Print_ipadd (u_char *) & (arppkt-> arp_tpa )); } Printf ("\ n "); Fflush (stdout ); } // The struct of the table (the use of host) Struct { Unsigned long int ipaddr; // the ip address Char hostname [MAXSTRINGSIZE]; // the name of the host } Nametable [MAXENTRY]; Int tbllength = 0; // Converge the hostname Void upload host (unsigned long int iadd, char * hn ){ Int I; Extern int tbllength; For (I = 0; I If (nametable [I]. ipaddr = iadd) break; If (I Strcpy (hn, nametable [I]. hostname ); } Else { Fprintf (stderr, "Internal Error on void multicast host () \ n "); Exit (1 ); } } // Log the hostname Void reghost (unsigned long int iadd ){ Int I; Struct hostent * shostname; Extern int tbllength; For (I = 0; I If (nametable [I]. ipaddr = iadd) break; } If (I = tbllength ){ Nametable [I]. ipaddr = iadd; Shostname = gethostbyaddr (char *) & iadd, sizeof (iadd), AF_INET ); If (shostname! = NULL ){ Strcpy (nametable [I]. hostname, shostname-> h_name ); } Else { Strcpy (nametable [I]. hostname ,""); } Tbllength ++; } } // Output the hostname Void print_hostname (u_char * ipadd ){ Int I; Unsigned long int iadd; Struct hostent * hostname; Char hn [MAXSTRINGSIZE]; Iadd = * (unsigned long int *) (ipadd )); Reghost (iadd ); Using host (iadd, hn ); If (strlen (hn)> 0) Printf ("% s", hn ); Else { For (I = 0; I <3; ++ I) Printf ("% d:", ipadd [I]); Printf ("% d:", ipadd [I]); } } // Main // The start and configure of getting packet Int main (int argc, char ** argv) { Char ebuf [PCAP_ERRBUF_SIZE]; Pcap_t * pd; If (argc <= 1 ){ Printf ("usage: % s \ N ", argv [0]); Exit (0 ); } /* Configure using pcap */ If (pd = pcap_open_live (argv [1], DEFAULT_SNAPLEN, 1,1000, ebuf) = NULL) { (Void) fprintf (stderr, "% s", ebuf ); Exit (1 ); } /* Get the packet by the pcap_loop */ If (pcap_loop (pd,-1, packet_print, NULL) <0 ){ (Void) fprintf (stderr, "pcap_loop: % s \ n", pcap_geterr (pd )); Exit (1 ); } Pcap_close (pd ); Exit (0 ); }