Linux Network Programming--Raw Socket instance: Simple version Network Data Analyzer

Through the Linux network programming-the original socket programming, we know that we can get the link layer packets through the raw sockets and recvfrom (), what is the link Layer Packet we receive ?

Link Layer envelope format

MAC head (wired LAN)

Note : CRC, PAD can be ignored when group package

One of the scenarios of a link-layer packet:

unsigned char msg[1024] = {//--------------group mac--------------0xb8, 0x88, 0xe3, 0xe1, 0x10, 0xe6,//Dst_mac:b8:88:e3:e1 : 10:e60xc8, 0x9c, 0xdc, 0xb7, 0x0f, 0x19,//src_mac:c8:9c:dc:b7:0f:190x08, 0x00,                         //type: 0X0800 IP protocol//...............

Receive the link-layer packets and perform a simple analysis of them:

#include <stdio.h> #include <string.h> #include <stdlib.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netinet/ether.h>int main (int Argc,char *argv[]) {int i = 0;unsigned char buf[1024] = ""; int sock_raw_fd = socket (Pf_packet, Sock_raw, htons (Eth_p_all)); while (1) {unsigned char SRC_MAC[18] = ""; unsigned char dst_mac[18] = "";//Gets the data frame of the link layer recvfrom (sock_raw_fd, buf, sizeof (BUF), 0,null,null);// Extract the destination Mac from buf, source macsprintf (Dst_mac, "%02x:%02x:%02x:%02x:%02x:%02x", Buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]); sprintf (Src_mac, "%02x:%02x:%02x:%02x:%02x:%02x", Buf[6], buf[7], buf[8], buf[9 [buf[10], buf[11]);//Determine if the IP packet if ( buf[12]==0x08 && buf[13]==0x00) {printf ("______________ip datagram _______________\n");p rintf ("mac:%s >>%s\ n ", Src_mac,dst_mac);} Determines whether the ARP packet else if (buf[12]==0x08 && buf[13]==0x06) {printf ("______________arp datagram _______________\n"); printf ("mac:%s >>%s\n", Src_mac,dst_mac);} Determine if the RARP packet is ELSE if (buf[12]==0x80 && buf[13]==0x35) {printf ("______________rarp datagram _______________\n");p rintf ("mac:%s> >%s\n ", Src_mac,dst_mac);}} return 0;}

Remember to run the program with Administrator privileges:

Please click here for source code download.

Linux Network Programming--Raw Socket instance: Simple version Network Data Analyzer