学步园

 printf("Acknowledgement Number %u /n",acknowledgement);

 printf("Header Length %d /n",header_length);

 printf("Reserved  %d /n",tcp_protocol->tcp_reserved);

 printf("Flags:");

 if (flags & 0x08)  printf("PSH");

 if (flags & 0x10)  printf("ACK");
 
 if (flags & 0x02)  printf("SYN");

 if (flags & 0x20)  printf("URG");

 if (flags & 0x01)  printf("FIN");

 if (flags & 0x04)  printf("RST");

 printf("/n");

 printf("Windows Size :%d /n",windows);

 printf("Checksum :%d/n",checksum);

 printf("Urgent pointer :%d/n",urgent_pointer);

}

/*下边实现IP数据包分析的函数定义ethernet_protocol_packet_callback*/
void ip_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr*

packet_header,const u_char* packet_content)
 {
  struct ip_header *ip_protocol;   /*ip协议变量*/
  u_int  header_length;    /*长度*/
  u_int  offset;     /*偏移*/
  u_char  tos;     /*服务质量*/
  u_int16_t checksum;    /*校验和*/
  ip_protocol=(struct ip_header*) (packet_content+14);
       /*获得ip数据包的内容去掉以太头部*/
 
  checksum=ntohs(ip_protocol->ip_checksum);  /*获得校验和*/
  header_length=ip_protocol->ip_header_length*4; /*获得长度*/
  tos=ip_protocol->ip_tos;    /*获得tos*/
  offset=ntohs(ip_protocol->ip_off);   /*获得偏移量*/

 printf("***************IP Protocol network layer***************/n /n");
 printf("IP Version :%d/n",ip_protocol->ip_version);
 printf("Header length :%d/n",header_length);
 printf("Tos :%d/n",tos);
 printf("Total length:%d/n",ntohs(ip_protocol->ip_length));/*获得总长度*/
 printf("Identification:%d/n",ntohs(ip_protocol->ip_id));  /*获得标识*/
 printf("Offset:%d/n",(offset&0x1fff)*8);    /**/
 printf("TTL:%d/n",ip_protocol->ip_ttl);     /*获得ttl*/ 
 printf("protocol:%d/n",ip_protocol->ip_protocol);         /*获得协议类型*/
 

 printf("Header checksum:%d/n",checksum);

 printf("Source address:%s/n",inet_ntoa(ip_protocol->ip_source_address));          /*

获得源ip地址*/
 printf("Destinastion address :%s/n",inet_ntoa(ip_protocol->ip_destination_address));

/*获得目的ip地址*/

 switch(ip_protocol->ip_protocol)
 {
   case 6 :printf("The Transport Layer Protocol is TCP#####################################/n");
        tcp_protocol_packet_callback(argument,packet_header,packet_content);
       
     break; /*协议类型是6代表TCP*/

   case 17:printf("The Transport Layer Protocol is  UDP/n");break;/*17代表UDP*/

    case 1:printf("The Transport Layer Protocol is ICMP/n");break;/*代表ICMP*/

   case 2:printf("The Transport Layer Protocol is IGMP/n");break;/*代表IGMP*/

  default :break;
 }

 }

void ethernet_protocol_packet_callback(u_char *argument,const struct pcap_pkthdr *packet_header,const u_char* packet_content)

 {
 u_short ethernet_type;     /*以太网协议类型*/

 struct ethernet_header *ethernet_protocol;  /*以太网协议变量*/

 u_char *mac_string;

 static int packet_number=1;

 

 printf("*******************************************************************************/n");

 printf("The %d ip packet is captured,/n",packet_number);

 printf("**********ethernet protocol (link Layer)*******************/n");

 ethernet_protocol =(struct ethernet_header *) packet_content;  /*获得一太网协议数据内容*/

 printf("Ethernet type is :/n");

 ethernet_type=ntohs(ethernet_protocol->ether_type);

       /*获得以太网类型*/

  printf("%04x/n",ethernet_type);

  switch(ethernet_type)            /*判断以太网类型的值*/

      {

  case 0x0800 :  printf("The network layer is ip protocol/n");break;

        case 0x0806 :  printf("The network layer is ARP protocol/n");break;

  case 0x8035 :  printf("The network layer is RARP protocol/n");break;

  default: break;

      }
printf("Mac souce address is :/n");

mac_string=ethernet_protocol->ether_shost;

printf("%02x:%02x:%02x:%02x:%02x:%02x:/n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));

/*获得以太网地址*/

 

printf("Mac Destination Address is :/n");

mac_string=ethernet_protocol->ether_dhost;

printf("%02x:%02x:%02x:%02x:%02x:%02x:/n",*mac_string,*(mac_string+1),*(mac_string+2),*(mac_string+3),*(mac_string+4),*(mac_string+5));

 

/*获得目的端口地址*/

 

  switch (ethernet_type)

 {case 0x0800:   ip_protocol_packet_callback(argument,packet_header,packet_content);break;

  /*如果上层是ip协议,就调用分析ip协议的函数对ip包进行贩治*/ 

  default :break;

        }

 

  packet_number++;

}

 

main()
{
  pcap_if_t  *alldevs;
  pcap_if_t *d;
  int inum=0;
  int i=0;
  pcap_t *adhandle;
  char errbuf[PCAP_ERRBUF_SIZE];
 
  /* 获得网卡的列表 */
  if (pcap_findalldevs(&alldevs, errbuf) == -1)
  {
    fprintf(stderr,"Error in pcap_findalldevs: %s/n", errbuf);
    exit(1);
  }
 
  /* 打印网卡信息 */
  for(d=alldevs; d; d=d->next)
  {
    printf("%d. %s", ++i, d->name);
    if (d->description)
        printf(" (%s)/n", d->description);
    else
        printf(" (No description available)/n");
  }
 
  if(i==0)
  {
    printf("/nNo interfaces found! Make sure LibPcap is installed./n");
    return -1;
  }
 
  printf("Enter the interface number (1-%d):",i);
  scanf("%d", &inum);               //输入要选择打开的网卡号
 
  if(inum < 1 || inum > i) //判断号的合法性
  {
    printf("/nInterface number out of range./n");
    /* Free the device list */
    pcap_freealldevs(alldevs);
    return -1;
  }
 
  /* 找到要选择的网卡结构 */
  for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);
 
  /* 打开选择的网卡 */
  if ( (adhandle= pcap_open_live(d->name, /* 设备名称*/
                  65536,   /* portion of the packet to capture.*/
                  /* 65536 grants that the whole packet will be captured on allthe MACs.*/
                  1,       /* 混杂模式*/
                  1000,     /* 读超时为1秒*/
                  errbuf   /* error buffer*/
                  ) ) == NULL)
  {
    fprintf(stderr,"/nUnable to open the adapter. %s is not supported by LibPcap/n");
    /* Free the device list */
    pcap_freealldevs(alldevs);
    return -1;
  }
 
  printf("/nlistening on %s.../n", d->description);
 
  /* At this point, we don't need any more the device list. Free it */
  pcap_freealldevs(alldevs);
 
  /* 开始捕获包 */
  pcap_loop(adhandle, 0, ethernet_protocol_packet_callback, NULL);
 
  return 0;
}