Based on Kernel 2.6.23.1, use netfilter to capture packets and use proc file output to implement source code

# Include <linux/module. h>/* Specifically, a module */
# Include <linux/kernel. h>/* We're doing kernel work */
# Include <linux/proc_fs.h>
# Include <linux/netfilter. h>
# Include <linux/netfilter_00004.h>
# Include <linux/types. h>
# Include <linux/if_ether.h>
# Include <linux/tcp. h>
# Include <linux/ip. h>
# Include <linux/skbuff. h>
# Define IP 0x800
# Define TCP 0x6
/* Necessary because we use the proc fs */
# Define procfs_name "port"
Char * buf;
Struct nf_hook_ops nfho;
Struct proc_dir_entry * Our_Proc_File;
Int len = 0;
Unsigned int
Hook_func (unsigned int hooknum,
Struct sk_buff ** skb,
Const struct net_device * in,
Const struct net_device * out, int (* okfn) (struct sk_buff *))
{
Struct ethhdr * eth;
Struct iphdr * iph;
Struct tcphdr * tcp;
Struct sk_buff * SKB;

Int ips [4], ipd [4];
SKB = * skb;
Len = 0;
 
Eth = (struct ethhdr *) SKB-> mac_header;
Iph = (struct iphdr *) SKB-> network_header;
Tcp = (struct tcphdr *) SKB-> transport_header;
If (ntohs (eth-> h_proto) = IP)
{
If (iph-> protocol = TCP)
{
 
Len + = sprintf (buf + len, "smac = % 02x: % 02x: % 02x: % 02x: % 02x: % 02x: % 02x \ n ", eth-> h_source [0], eth-> h_source [1], eth-> h_source [2], eth-> h_source [3], eth-> h_source [4], eth-> h_source [5]);
Len + = sprintf (buf + len, "dmac = % 02x: % 02x: % 02x: % 02x: % 02x: % 02x: % 02x \ n ", eth-> h_dest [0], eth-> h_dest [1], eth-> h_dest [2], eth-> h_dest [3], eth-> h_dest [4], eth-> h_dest [5]);

Len + = sprintf (buf + len, "dip = % u. % u \ n", NIPQUAD (iph-> daddr ));
Len + = sprintf (buf + len, "sip = % u. % u \ n", NIPQUAD (iph-> daddr ));
Len + = sprintf (buf + len, "sport = % d \ n", ntohs (tcp-> source ));
Len + = sprintf (buf + len, "dport = % d \ n", ntohs (tcp-> dest ));
}
}
Return NF_ACCEPT;
}
 
Int
Procfile_read (char * buffer,
Char ** buffer_location,
Off_t offset, int buffer_length, int * eof, void * data)
{
Memcpy (buffer, buf, len );
Return len;
}
 
Int
Init_module ()
{
Buf = kmalloc (1024, GFP_KERNEL );
Nfho. hook = hook_func;/* processing function */
Nfho. hooknum = NF_IP_PRE_ROUTING;/* use the first hook of IPv4 */
Nfho. pf = PF_INET;
Nfho. priority = NF_IP_PRI_FIRST;/* run our function first */
Nf_register_hook (& nfho );
Our_Proc_File = create_proc_entry (procfs_name, 0644, NULL );
Our_Proc_File-> read_proc = procfile_read;
Our_Proc_File-> owner = THIS_MODULE;
Our_Proc_File-> mode = S_IFREG | S_IRUGO;
Our_Proc_File-> uid = 0;
Our_Proc_File-> gid = 0;
Our_Proc_File-> size = 37;
Return 0;/* everything is OK */
}

Void
Cleanup_module ()
{
Kfree (buf );
Nf_unregister_hook (& nfho );
Remove_proc_entry (procfs_name, & proc_root );
}
 
Makefile code:
Ifeq ($ (KERNELRELEASE ),)
KERNELDIR? =/Lib/modules/$ (shell uname-r)/build
PWD: = $ (shell pwd)
Modules:
$ (MAKE)-C $ (KERNELDIR) M = $ (PWD) modules
Modules_install:
$ (MAKE)-C $ (KERNELDIR) M = $ (PWD) modules_install
Clean:
Rm-rf *. o *~ Core. depend. *. cmd *. ko *. mod. c. tmp_versions
. PHONY: modules modules_install clean
Else
# Called from kernel build system: just declare what our modules are
Obj-m: = proc. o
Endif

Author "programmer"