IP->ID范围统计

#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

#define SNAP_LEN 1518
#define MIN_LEN    (sizeof(struct ethhdr) + sizeof(struct iphdr))

static struct bpf_program fp;
static pcap_t *handle;
static unsigned int counter[7];

static void sigint(int sig)
{
    int i;
    printf("\n\n");
    for(i = 0; i < 6; i ++) {
        printf(" < %d0000 : %u\n", i+1, counter[i]);
    }
    printf(" < 65535 : %u\n\n\n", counter[i]);
    pcap_freecode(&fp);
    pcap_close(handle);
    exit(EXIT_SUCCESS);
}

static void packet_callback(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
    struct iphdr *iph;

    /*数据包长度校验*/
    if(header->caplen < MIN_LEN)    return;

    packet += sizeof(struct ethhdr);
    iph = (struct iphdr *)packet;
    if (ntohs(iph->id) == 0)    return;
    counter[ntohs(iph->id)/10000]++;

#if 0
    struct in_addr src, dst;
    src.s_addr = iph->saddr;
    dst.s_addr = iph->daddr;
    printf("ipid: %u, %s->", ntohs(iph->id), inet_ntoa(src));
    printf("%s\n", inet_ntoa(dst));
#endif

}

int main(int argc, char **argv) {
    char *dev = NULL;                    /* capture device name */
    char errbuf[PCAP_ERRBUF_SIZE];        /* error buffer */
    char filter_exp[] = "ip";            /* filter expression [3] */
    bpf_u_int32 mask;                    /* subnet mask */
    bpf_u_int32 net;                    /* ip */
    int num_packets = -1;                /* number of packets to capture */

    /* check for capture device name on command-line */
    if (argc == 2) {
        dev = argv[1];
    } else if (argc > 2) {
        fprintf(stderr, "error: unrecognized command-line options\n\n");
        exit(EXIT_FAILURE);
    } else {
        /* find a capture device if not specified on command-line */
        dev = pcap_lookupdev(errbuf);
        if (dev == NULL) {
            fprintf(stderr, "Couldn't find default device: %s\n",
                    errbuf);
            exit(EXIT_FAILURE);
        }
    }

    /* get network number and mask associated with capture device */
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
        fprintf(stderr, "Couldn't get netmask for device %s: %s\n",
                dev, errbuf);
        net = 0;
        mask = 0;
    }

    /* open capture device */
    handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf);
    if (handle == NULL) {
        fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
        exit(EXIT_FAILURE);
    }
#if 1
    /* compile the filter expression */
    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
        fprintf(stderr, "Couldn't parse filter %s: %s\n",
                filter_exp, pcap_geterr(handle));
        exit(EXIT_FAILURE);
    }

    /* apply the compiled filter */
    if (pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr, "Couldn't install filter %s: %s\n",
                filter_exp, pcap_geterr(handle));
        exit(EXIT_FAILURE);
    }
#endif

    if(pcap_setdirection(handle, PCAP_D_IN)<0) {
        pcap_perror(handle,(char*)"pcap_setdirection");
        exit(EXIT_FAILURE);
    }

    signal(SIGINT, sigint);

    /* now we can set our callback function */
    pcap_loop(handle, num_packets, packet_callback, NULL);

    return(EXIT_SUCCESS);
}