rendered paste body#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pcap.h>
#include <net/if.h>
#include <netinet/in.h>
#include <net/ethernet.h>
#include <signal.h>
#include <gtk/gtk.h>
#define SNAP_LEN 1514
char *interface;
char *port;
char *temp;
char err_buff[PCAP_ERRBUF_SIZE];
struct bpf_program bp;
char *filter = "src port ";
bpf_u_int32 netp, maskp;
pcap_t *pdes;
u_char *user;
u_char *buff = NULL;
u_int16_t handle_ethernet(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char*packet);
u_char* handle_IP(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet);
void gestion_sigint (int signum);
struct my_ip {
u_int8_t ip_vhl; /* header length, version */
#define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4)
#define IP_HL(ip) ((ip)->ip_vhl & 0x0f)
u_int8_t ip_tos; /* type of service */
u_int16_t ip_len; /* total length */
u_int16_t ip_id; /* identification */
u_int16_t ip_off; /* fragment offset field */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_int8_t ip_ttl; /* time to live */
u_int8_t ip_p; /* protocol */
u_int16_t ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
void fenGTK(int argc,char **argv, const char *text);
void fenGTK(int argc,char **argv, const char *text)
{
GtkWidget* pWindow;
GtkWidget* pLabel;
gtk_init(&argc,&argv);
pWindow = gtk_window_new(GTK_WINDOW_TOPLEVEL);
gtk_window_set_title(GTK_WINDOW(pWindow), "Surveillance du systeme");
gtk_window_set_default_size(GTK_WINDOW(pWindow), 320, 200);
/* Creation du label */
pLabel=gtk_label_new(text);
/* On ajoute le label a l'interieur de la fenetre */
gtk_container_add(GTK_CONTAINER(pWindow), pLabel);
/* Affichage de la fenetre et de tout ce qu'il contient */
gtk_widget_show_all(pWindow);
/* Connexion du signal
/* On appelle directement la fonction de sortie de boucle */
g_signal_connect(G_OBJECT(pWindow), "destroy", G_CALLBACK(gtk_main_quit), NULL);
gtk_main();
}
void gestion_sigint (int signum)
{
pcap_close(pdes);
free(temp);
printf ("Libération des ressources et fin de la surveillance\n\n");
exit(0);
}
void callback(u_char *user, const struct pcap_pkthdr *h, const u_char *buf)
{
u_int16_t type = handle_ethernet(user, h, buf);
if(type == ETHERTYPE_IP)
{
}
else if(type == ETHERTYPE_ARP)
{
}
else if(type == ETHERTYPE_REVARP)
{
}
}
u_char* handle_IP(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet)
{
const struct my_ip* ip;
u_int length = pkthdr->len;
u_int hlen,off,version;
int i;
int pfd[2];
char buffer[BUFSIZ];
char buffer2[BUFSIZ];
int len;
/* jump pass the ethernet header */
ip = (struct my_ip*)(packet + sizeof(struct ether_header));
length -= sizeof(struct ether_header);
/* check to see we have a packet of valid length */
if (length < sizeof(struct my_ip))
{
printf("Paquet IP tronqué %d",length);
return NULL;
}
len = ntohs(ip->ip_len);
hlen = IP_HL(ip); /* header length */
version = IP_V(ip);/* ip version */
/* check version */
if(version != 4)
{
fprintf(stdout,"IP version inconnu %d\n",version);
return NULL;
}
if(version == 6)
{
printf("IP version 6, pas encore implémenter");
return NULL;
}
/* check header length */
if(hlen < 5 )
{
fprintf(stdout,"hlen faux %d \n",hlen);
}
/* see if we have as much packet as we should */
if(length < len)
printf("\nPaquet IP tronque - %d octets perdus\n",len - length);
switch(fork())
{
case -1:
printf("Erreur fork\n");
exit(-1);
break;
case 0:
close(pfd[1]);
printf("Processus fils\n");
while (read(pfd[0], buffer2, BUFSIZ) != 0)
printf("child reads %s", buffer2);
fenGTK(NULL, NULL, buffer2);
close(pfd[0]); /* close the pipe */
break;
default:
//char buffer[BUFSIZ];
printf("Processus Pere\n");
close(pfd[0]); /* close read side */
/* send some data into the pipe */
strcpy(buffer, "HelloWorld\n");
write(pfd[1], buffer, strlen(buffer)+1);
/* Check to see if we have the first fragment */
off = ntohs(ip->ip_off);
if((off & 0x1fff) == 0 )/* aka no 1's in first 13 bits */
{/* print SOURCE DESTINATION hlen version len offset */
fprintf(stdout,"IP Source: %s\n",
inet_ntoa(ip->ip_src));
fprintf(stdout,"IP Dest: %s, hlen: %d, version: %d, len: %d, off %d\n",
inet_ntoa(ip->ip_dst),
hlen,version,len,off);
}
close(pfd[2]);
break;
}
return NULL;
}
u_int16_t handle_ethernet(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char *packet)
{
struct ether_header *eptr;
eptr = (struct ether_header *) packet;
printf("Adresse Ethernet source: %s\n",ether_ntoa(eptr->ether_shost));
printf("Adresse Ethernet destination: %s\n",ether_ntoa(eptr->ether_dhost));
/* check to see if we have an ip packet */
if (ntohs (eptr->ether_type) == ETHERTYPE_IP)
{
handle_IP(args,pkthdr,packet);
}
else if (ntohs (eptr->ether_type) == ETHERTYPE_ARP)
{
printf("Paquet reçu: (ARP)\n");
}
else if (ntohs (eptr->ether_type) == ETHERTYPE_REVARP)
{
printf("Paquet reçu: (RARP)\n");
}
else
{
printf("(?)\n");
return(1);
}
printf("\n");
return eptr->ether_type;
}
int main(int argc, char **argv)
{
if(argc <= 2)
{
printf("Utilisation: libpcap [ interface ] [ port ]\n");
printf("Met en ecoute d'un port.\n");
printf("Exemple: libpcap eth0 80\n");
return(-1);
}
interface = argv[1];
port = argv[2];
if (signal (SIGINT, gestion_sigint) == SIG_ERR)
fprintf (stderr, "Probleme d'interception SIGINT\n");
if((pdes = pcap_open_live( interface, SNAP_LEN, IFF_PROMISC, 1000, err_buff)) == NULL)
{
printf("Erreur, pcap_open_live: %s\n", err_buff);
return(-1);
}
temp=calloc(strlen(filter)+strlen(port)+1, 1);
sprintf(temp, "%s%s", filter, port);
printf("filtres: %s\n", temp);
filter = temp;
printf("Ecoute de l'interface: %s, port: %s\n", interface, port);
//Mise en place d'un masque
if( pcap_lookupnet( interface, &netp, &maskp, err_buff ) ==-1 )
{
printf("Erreur, pcap_lookupnet: %s\n", err_buff);
}
//mise en place du filtre
if( pcap_compile( pdes, &bp, filter, 0x100, maskp ) < 0 )
{
printf("Erreur, pcap_compile: %s\n", pcap_geterr(pdes));
return(-1);
}
//on applique le filtre
if( pcap_setfilter(pdes, &bp) < 0 )
{
printf("Erreur, pcap_setfilter: %s", pcap_geterr(pdes));
return(-1);
}
//Et on sniffe enfin :-) ( -1 boucle infini )
if( pcap_loop( pdes, -1, (pcap_handler)callback, buff) <0 )
{
printf("Erreur, pcap_loop: %s", pcap_geterr(pdes));
return(-1);
}
pcap_close(pdes);
free(temp);
return(0);
}