终于写了第一个基于netfilter的抓报代码

#ifndef __KERNEL__
    #define __KERNEL__
#endif
#ifndef MODULE
#define MODULE
#endif

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/netdevice.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <net/tcp.h>
#include <linux/netfilter_ipv4.h>

static struct nf_hook_ops nfho;

/*回调函数，进行报文分析*/
unsigned int hook_func(unsigned int hooknum,
                       struct sk_buff *skb,
                       const struct net_device *in,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
{
    if(skb)
    {
        int static num = 0;
        struct sk_buff *sb = skb;
        struct iphdr *iph = (struct iphdr *)(sb->network_header);

        if(iph)
        {
            char pro_name[10] = {0};
            
            /*先读协议类型*/
            switch(iph->protocol)
            {
                case IPPROTO_UDP:
                    sprintf(pro_name, "UDP"); 
                    break;
           
                case IPPROTO_TCP:
                    sprintf(pro_name, "TCP"); 
                    break;

               default:
                    sprintf(pro_name, "UNKOWN");
           }
            printk("get a ip packet, protocl is :%d(%s)\n", iph->protocol, pro_name);
        }
        else
        {
            printk("iph is null\n");
        }
    }
    else
    {
        printk("skb is null,hooknum:%d\n", hooknum);
    }

    return NF_ACCEPT;         
}


int init_module()
{
 
    nfho.hook = hook_func;        
    nfho.hooknum  = NF_INET_PRE_ROUTING;
    nfho.pf       = PF_INET;
    nfho.priority = NF_IP_PRI_FIRST; 

    nf_register_hook(&nfho);

    printk("init module NF_INET_PRE_ROUTING ok\n");

    return 0;
}

void cleanup_module()
{
    nf_unregister_hook(&nfho);
}