Design and Implementation of Sniffer based on Linux environment
Source: Internet
Author: User
Article Title: Design and Implementation of Sniffer in Linux environment. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
I. Sniffer principle analysis Before implementing the sniffer, we need to master the TCP/IP protocol. TCP and IP protocols refer to two network protocols (or data transmission methods) used on the Internet ). They are Transmission Control Protocol and internet connection protocol. These two protocols are part of many TCP/IP protocol groups.
The protocols in TCP/IP protocol groups ensure data transmission over the Internet and provide almost all services used for Internet access. These services include email transmission, file transmission, publishing of newsgroups, and accessing the world wide web.
The TCP protocol is based on the IP protocol. Different from the unreliable transmission service provided by the IP protocol, the TCP protocol provides a reliable transmission service for the application layer on it. This service features reliability, full duplex, streaming, and unstructured transmission. TCP transmission principle:
TCP uses a positive acknowledgement with retransmission technology for reliable transmission. After receiving the data sent by the sender, the receiver must send an ACK message indicating that the sender has received the data. The sender stores the records of the sent data and waits for the confirmation message before sending the next data. When it sends this data, it also starts a notebook. If no confirmation message is received within a certain period of time, it is deemed that the data is lost during transmission, and then the data will be resent.
This method also produces a problem, that is, repeated packets. If the network transmission speed is relatively low and the message is returned to the sender after the wait time is over, duplicate data will appear because of the sending method adopted by the sender. One solution is to give each data a serial number, and the sender needs to remember the data with which the serial number has been confirmed. To prevent delay or repeated validation, the validation message must also contain the validation serial number. Then the sender can know which package has been confirmed. TCP also has an important concept: Sliding window. This method makes transmission more efficient.
As described above, the sender must wait for confirmation after sending a data packet. The period before it receives the confirmation message is idle. If the network latency is long, this problem will be quite obvious. The sliding window is used to send multiple packets before it receives the confirmation message. As you can imagine, there is a window moving on a sequence. If a package has not been confirmed after it is sent, it is called an unconfirmed package. The number of unconfirmed packages is usually the size of the window. At the receiving end, there is also a sliding window to receive and confirm a package.
TCP transmission is used to establish a connection. In TCP transmission, a connection consists of two endpoints. In fact, a connection represents a communication between sending and receiving applications at both ends. We can think of them as building a circuit. Generally, a connection is represented by the following formula: (host, port), host is host, and port is port. The TCP port can be shared by several applications. For programmers, we can understand that an application can provide services for different connections. The unit of TCP transmission is the segment. when a connection is established, data is transmitted, and the window for confirmation message and notice is large, the segment is exchanged.
TCP uses a three-way handshake to establish a TCP connection. The code bit in the first segment of the handshake is set to SYN, and the serial number is x, which indicates that a handshake is started. After receiving this segment, the receiver sends it back to the sender. Set the code bit to SYN and ACK, set the serial number to y, and confirm that the serial number is set to x + 1. After receiving this segment, the sender knows that TCP data can be sent. Therefore, the sender sends an ACK segment to the receiver, indicating that the connection between the two parties has been established. After the handshake is completed, data transmission is started. The serial numbers in the above handshake segment are all randomly generated.
After learning about the TCP/IP protocol, you must master network programming. In LINUX network programming, we can think that sockets promote file operations on Unix systems to provide point-to-point communication. If you want to operate files, the application will create a socket for the application according to its needs. The operating system returns an integer. The application uses this socket by referencing this positive number. The difference between a file descriptor and a socket descriptor is that when a program calls open (), the operating system binds a file descriptor to a file or device, but when creating a socket, you can not bind it to a destination address. The program can specify the target address when it wants to use this socket. In point-to-point communication programs, we call a request Service or data program a client program, and the software that provides data or services is called a server program. The following explains a basic socket system call function, which is also a function used in the sniffer:
Socket ()
# Include <sys/types. h>
# Include <sys/socket. h>
Int socket (int family, int type, int protocol );
The int family parameter specifies the communication protocol to be used. the following values are used:
AF_UNIX internal protocol
AF_INET Internet Protocol
AF_NS Xerox NS protocol
AF_IMPLINK IMP connection layer
Int type specifies the socket type. the following values are used:
SOCK_STREAM stream socket
SOCK_DGRAM datagram socket
SOCK_RAW unprocessed socket
SOCK_SEQPACKET Sequential packet socket
The int protocol parameter is usually set to 0.
A socket () system call returns an integer called socket description sockfd, which works the same way as a file descriptor. The first step of network I/O is to call this function.
II. implementation of Sniffer This section describes the implementation of the sniffer. The sniffer is written in C language in Red Hat LINUX6.2, for debugging and compilation.
Sniffer is a common method for collecting useful data. The data can be user accounts and passwords, or commercial confidential data. Sniffer is a common method for collecting useful data, which can be user accounts and passwords, or commercial confidential data.
Ethernet sniffing refers to listening for packets transmitted on an Ethernet device to discover packets of interest. If a qualified package is found, store it in a log file. These conditions are usually set to include a package with the word "username" or "password. It aims to put the network layer in the promiscuous mode to do something. The Promiscuous mode means that all devices on the network listen to the data transmitted on the bus, not just their own data. According to the working principle of Ethernet, we can know that when a device sends data to a certain target, it broadcasts data over Ethernet. A device connected to the Ethernet bus receives data at any time. However, it only transmits its own data to applications on the computer. With this, you can set the network connection of a computer to accept data on all Ethernet buses to implement sniffer.
Sniffer usually runs on a vro or a host with the vro function. In this way, you can monitor a large amount of data. Sniffer is a second-level attack. Generally, attackers have already entered the target system and then use sniffer to obtain more information. In addition to passwords or user names, sniffer can also obtain more information, such as other important information and financial information sent online. Sniffer can get almost any packets transmitted over Ethernet. Generally, the sniffer program only looks at the first-bytes of data in a data packet and can find information such as the password and user name.
Next we will introduce the implementation of this program. The structure etherpacket defines a data packet. Ethhdr, iphdr, and tcphdr are three structures used to define the formats of Ethernet frames, IP data headers, and TCP data headers.
Next, a structure variable victim is defined. Next, let's take a look at the int openintf (char * d) function, which is used to open a network interface. In main, eth0 is used as the parameter to call this function. The following structure is used in this function:
Struct ifreq
{
# Define IFHWADDRLEN 6
# Define IFNAMSIZ 16
Union
{
Char ifrn_name [IFNAMSIZ];/* Interface name, e.g. "en0 ".*/
} Ifr_ifrn;
Union
{
Struct sockaddr ifru_addr;
Struct sockaddr ifru_dstaddr;
Struct sockaddr ifru_broadaddr;
Struct sockaddr ifru_netmask;
Struct sockaddr ifru_hwaddr;
Short int ifru_flags;
Int ifru_ivalue;
Int ifru_mtu;
Struct ifmap ifru_map;
Char ifru_slave [IFNAMSIZ];/* Just fits the size */
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
