dump tcp only

#define _GNU_SOURCE
#include
#include
#include
#include
#include

void dump(const char *ptr, int size)
{
    int i, j;
    char buffer[256], graph[32];

    for (i = 0; i < size; i += 16)
    {
        for (j = 0; j < 16 && i + j < size; ++j)
        {
            sprintf(buffer + j * 3, "%02X ", ((unsigned char *)ptr)[i + j]);
            graph[j] = isprint(ptr[i + j])? ptr[i + j]: '.';
        }
        graph[j] = '\0';
        if (j > 8)
            buffer[23] = '-';
        printf("\t0x%04X:  %-47.47s  %.16s\n", i, buffer, graph);
    }
}

#include
#include
#include

void packet(u_char *arg, const struct pcap_pkthdr *hdr, const u_char *addr)
{
    int el = hdr->caplen;
    const struct ether_header *eh = (const struct ether_header *)addr;

    // check ip header
    if (ntohs(eh->ether_type) == ETHERTYPE_IP && el > sizeof(*eh))
    {
        int il = el - sizeof(*eh);
        const struct iphdr *ih = (const struct iphdr *)(eh + 1);

        // check tcp header
        if (ih->version == 4 && ih->protocol == 6 && il > ih->ihl * 4)
        {
            const struct tcphdr *th = (const struct tcphdr *)((const u_char *)ih + ih->ihl * 4);
            int tl = ntohs(ih->tot_len) - ih->ihl * 4; // length of tcp packet
            int dl = tl - th->doff * 4;  // data length of tcp packet
            char flags[64], *pflags;

            strftime(flags, sizeof(flags), "%T", localtime(&hdr->ts.tv_sec));
            printf("%s.%06d", flags, hdr->ts.tv_usec);

            sprintf(flags, "%s", inet_ntoa(ih->saddr));
            sprintf(flags + 32, "%s", inet_ntoa(ih->daddr));
            printf(" %s:%d > %s:%d:", flags, ntohs(th->source), flags + 32, ntohs(th->dest));
            if (dl)
                printf(" %d(%u)", dl, ntohl(th->seq));
            else
                printf(" .");

            pflags = flags;
            if (th->fin) pflags = stpcpy(pflags, "fin,");
            if (th->syn) pflags = stpcpy(pflags, "syn,");
            if (th->rst) pflags = stpcpy(pflags, "rst,");
            if (th->psh) pflags = stpcpy(pflags, "psh,");
            if (th->ack) pflags += sprintf(pflags, "ack(%u),", ntohl(th->ack_seq));
            if (th->urg) pflags = stpcpy(pflags, "urg,");
            if (pflags == flags) *pflags = '\0';
            else pflags[-1] = '\0';
            printf(" %s\n", flags);

            if (dl)
            {
                dump((const u_char *)th + th->doff * 4, dl);
            }
        }
    }
}

pcap_t *pcap_init()
{
    pcap_t *rc;
    char errbuf[PCAP_ERRBUF_SIZE];

    if ((rc = pcap_open_live("eth0", 65536, 1, 0, errbuf)) == 0)
    {
        printf("initialize: %s\n", errbuf);
        exit(1);
    }

    return rc;
}

static char command[1024];

int main(int argc, char *argv[])
{
    int i, offset;
    struct bpf_program prog;
    pcap_t *cap;

    offset = 0;
    for (i = 1; i < argc; ++i)
        offset += sprintf(command + offset, "%s ", argv[i]);
    if (!offset)
        offset = 1;
    command[offset - 1] = '\0';

    cap = pcap_init();
    if (pcap_compile(cap, &prog, command, 0, 0) < 0
            || pcap_setfilter(cap, &prog) < 0
            || pcap_loop(cap, -1, packet, (u_char *)1234) < 0)
    {
        printf("%s\n", pcap_geterr(cap));
        pcap_close(cap);
        return 1;
    }

    pcap_close(cap);
}

文件:	tdump.zip
大小:	1KB
下载:	下载