Sniffer

逃离我推掉我的手 2021-11-02 00:12 152阅读 0赞

一、将网卡设置在混杂模式

[lonely@bogon:~/code/sniffer$][lonely_bogon_code_sniffer] su  
密码：  
bogon:/home/lonely/code/sniffer\# ifconfig eth0 promisc  
bogon:/home/lonely/code/sniffer\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:0c:29:14:31:2c  
          inet addr:192.168.26.128  Bcast:192.168.26.255  Mask:255.255.255.0  
          inet6 addr: fe80::20c:29ff:fe14:312c/64 Scope:Link  
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1  
          RX packets:373 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:293 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000  
          RX bytes:40867 (39.9 KiB)  TX bytes:41109 (40.1 KiB)  
          Interrupt:19 Base address:0x2000

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0  
          inet6 addr: ::1/128 Scope:Host  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:22 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:22 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0  
          RX bytes:1981 (1.9 KiB)  TX bytes:1981 (1.9 KiB)

[lonely@bogon:~/code/sniffer$][lonely_bogon_code_sniffer] cat headers.h

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][] 代码

struct  ip\{  
        unsigned  int  ip\_length: 4 ;  
        unsigned  int  ip\_version: 4 ;  
        unsigned  char  ip\_tos;  
        unsigned  short  ip\_total\_length;  
        unsigned  short  ip\_id;  
        unsigned  short  ip\_flags;  
        unsigned  char  ip\_ttl;  
        unsigned  char  ip\_protocol;  
        unsigned  short  ip\_cksum;  
        unsigned  int  ip\_source;  
        unsigned  int  ip\_dest;  
\};  
  
 struct  tcp\{  
        unsigned  short  tcp\_source\_port;  
        unsigned  short  tcp\_dest\_port;  
        unsigned  int  tcp\_seqno;  
        unsigned  int  tcp\_ackno;  
        unsigned  int  tcp\_resl: 4 ,tcp\_hlen: 4 ,tcp\_fin: 1 ,tcp\_syn: 1 ,tcp\_rst: 1 ,tcp\_psh: 1 ,tcp\_ack: 1 ,tcp\_urg: 1 ,tcp\_res2: 2 ;  
        unsigned  short  tcp\_winsize;  
        unsigned  short  tcp\_cksum;  
        unsigned  short  tcp\_urgent;  
\};

[lonely@bogon:~/code/sniffer$][lonely_bogon_code_sniffer] cat simple\_tcp\_sniff.c

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][] 代码

/\*   
 \* stdio.h              printf和std\_out之类的基本输入输出函数  
 \* sys/socket.h SOCK\_RAW和IPPROT\_TCP的定义  
 \* netinet/in.h 定义 sockaddr\_in  
 \* arpa/inet.h  网络函数  
  \*/   
\#include  < stdio.h >   
\#include  < sys / socket.h >   
\#include  < netinet / in .h >   
\#include  < arpa / inet.h >   
  
 /\*  定义ip和tcp字段的结构  \*/   
\#include  " headers.h "   
  
 int  main()  
\{  
         int  sock,bytes\_recieved,fromlen;  
         char  buffer\[ 65535 \];  
         struct  sockaddr\_in from;  
         struct  ip  \* ip;  
         struct  tcp  \* tcp;  
  
        sock = socket(AF\_INET,SOCK\_RAW,IPPROTO\_TCP);  
         while ( 1 )  
        \{  
                fromlen = sizeof  from;  
                bytes\_recieved = recvfrom(sock,buffer, sizeof  buffer, 0 ,( struct  sockaddr  \* ) & from, & fromlen);  
                printf( " \\nBytes received ::: %5d\\n " ,bytes\_recieved);  
                printf( " Source address ::: %s\\n " ,inet\_ntoa(from.sin\_addr));  
                ip = ( struct  ip  \* )buffer;  
                printf( " IP header length ::: %d\\n " ,ip \-> ip\_length);  
                printf( " Protocol ::: %d\\n " ,ip \-> ip\_protocol);  
                tcp = ( struct  tcp  \* )(buffer \+ ( 4 \* ip \-> ip\_length));  
                printf( " Source port ::: %d\\n " ,ntohs(tcp \-> tcp\_source\_port));  
                printf( " Dest port ::: %d\\n " ,ntohs(tcp \-> tcp\_dest\_port));  
        \}  
\}

转载于:https://www.cnblogs.com/zhangyingda/archive/2010/10/30/1864977.html

[lonely_bogon_code_sniffer]: mailto:lonely@bogon:~/code/sniffer%24
[ContractedBlock.gif]: https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif
[ExpandedBlockStart.gif]: /images/20211101/2205e4a9eec4488ca55fb74bb3bfe481.png