Chinaunix首页 | 论坛 | 博客

腹有诗书气自华

首页　| 　博文目录　| 　关于我

hlqhayq

  • 博客访问： 76111
  • 博文数量： 17
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 67
  • 用 户 组： 普通用户
  • 注册时间： 2015-03-23 11:45
文章分类

全部博文（17）

文章存档

2015年（17）

我的朋友
最近访客
推荐博文
相关博文
原始套接字编程--IP段扫描

分类： LINUX

2015-05-25 22:04:19

        最近写了一个局域网IP段扫描器，思路是发送一个PING数据包，得到后解析，然后循环，这要就能获得局域网中在线主机的信息。
        以下是我的源码：
        

点击(此处)折叠或打开

  1. /*
  2.  *Name:ping.c
  3.  *Module:PING
  4.  *Description:realize the funtion that check a PC's status
  5.  *History:2015/5/13
  6.  */
  7. #include "./ping.h"

  9. static struct timeval tvrecv;
  10. static char send_packet[PACKET_SIZE];
  11. static char recv_packet[PACKET_SIZE];
  12. static struct sockaddr_in send_addr;
  13. static struct sockaddr_in recv_addr;
  14. static int sock_fd;
  15. static int nsend;
  16. static int nrecv;
  17. static pid_t pid;
  18. static int ret;
  19. static int datalength = 56;

  21. static int pack(int seqno);
  22. static int unpack(int len);
  23. static void send_packet_func();
  24. static void recv_packet_func();
  25. static unsigned short cal_chksum(unsigned short *data,int len);

  27. int __ping(char *addr)//接口函数，供外部调用，addr为目的点分十进制IP地址
  28. {
  29.     int size;
  30.     if(inet_addr(addr)==INADDR_NONE){
  31.         printf("IP addr is error\n");
  32.         exit(EXIT_FAILURE);
  33.     }
  34.     nsend=0;
  35.     nrecv=0;

  37.     //get the autority
  38.     //initialize the socket
  39.     sock_fd = socket(AF_INET,SOCK_RAW,IPPROTO_ICMP);
  40.     if(sock_fd == -1){
  41.         perror("socket error");
  42.         exit(EXIT_FAILURE);
  43.     }
  44.     //initialize the addr
  45.     bzero(&send_addr,sizeof(send_addr));
  46.     send_addr.sin_family = AF_INET;
  47.     send_addr.sin_port = htons(0);
  48.     send_addr.sin_addr.s_addr = inet_addr(addr);

  50.     setsockopt(sock_fd,SOL_SOCKET,SO_RCVBUF,&size,sizeof(size) );
  51.     pid = getpid();        
  52.     
  53.     send_packet_func();
  54.     recv_packet_func();

  56.     return 0;
  57. }

  58.
  59. //发送PING数据包
  60. void send_packet_func()
  61. {
  62.     int packetsize;
  63.     while(nsend < SEND_RECV_TIMES){
  64.         packetsize=pack(nsend);
  65.         nsend++;
  66.         ret = sendto(sock_fd,send_packet,packetsize,0,(struct sockaddr *)&send_addr,sizeof(send_addr));
  67.         if(ret < 0){
  68.             perror("sendto error");
  69.             continue;
  70.         }
  71.     }
  72. }
  73. //接收PING数据包
  1. void recv_packet_func()
  2. {
  3.     int recvlen;
  4.     recvlen = sizeof(recv_addr);
  5.     while(nrecv < nsend)
  6.     {
  7.         nrecv++;
  8.         ret = recvfrom(sock_fd,recv_packet,sizeof(recv_packet),0,(struct sockaddr *)&recv_addr,&recvlen);
  9.         if(ret == 84){
  10.             printf("%s is on",inet_ntoa(send_addr.sin_addr));
  11.         }
  12.         else｛
  13.             printf("%s is off",inet_ntoa(send_addr.sin_addr);
  14.         }
  15.     }
  16. }
  17. //构造ICMP报文
  18. int pack(int seqno)
  19. {
  20.     int packetsize;
  21.     struct icmp *_icmp;
  22.     struct timeval *tval;
  23.     
  24.     _icmp = (struct icmp*)send_packet;
  25.     _icmp->icmp_type = ICMP_ECHO;
  26.     _icmp->icmp_code = 0;
  27.     _icmp->icmp_cksum = 0;
  28.     _icmp->icmp_id = pid;
  29.     _icmp->icmp_seq = seqno;
  30.     
  31.     packetsize = 8 + datalength;
  32.     tval = (struct timeval *)_icmp->icmp_data;
  33.     gettimeofday(tval,NULL);
  34.     _icmp->icmp_cksum = cal_chksum((unsigned short *)_icmp,packetsize);
  35.     
  36.     return packetsize;
  37. }
  38. //计算校验位
  39. unsigned short cal_chksum(unsigned short *addr,int len)
  40. {
  41.     int nleft=len;
  42.         int sum=0;
  43.         unsigned short *w=addr;
  44.         unsigned short answer=0;
  45.         
  46.     /*把ICMP报头二进制数据以2字节为单位累加起来*/
  47.         while(nleft>1){
  48.         sum+=*w++;
  49.                 nleft-=2;
  50.         }
  51.     if(nleft==1){
  52.         *(unsigned char *)(&answer)=*(unsigned char *)w;
  53.                 sum+=answer;
  54.         }
  55.         sum=(sum>>16)+(sum&0xffff);
  56.         sum+=(sum>>16);
  57.         answer=~sum;
  58.         return answer;
  59. }
            说明，利用IP地址构建一个网络层原始套接字，然后自己构造ICMP报文，发送数据包。接收的时候，是利用同一个套接字接收的，程序虽然可以运行，但是对于无连接的套接字，建议大家建立一个发送套接字和一个接收套接字。我通过抓取数据包来分析有recvfrom有三种情况（前提，我构造的是ICMP报文64字节，整个IP数据包是84字节）：
            1）正确接收ICMP回显报文，长度是84字节；
            2）接收报文，但是数据字节长度为112字节；
            3）一直没有接收到报文，程序在recvfrom阻塞等待；
            所以我通过recvfrom的返回值--接收到了多少字节来判断是否接收到争取的数据包，如果是第1）中情况，就显示该IP在线，否则，显示不在线。
            此处，任然还有一个问题，若IP段是192.168.1.1/24~192.168.1.254/24；当ping到192.168.1.44的时候，出现了上述的第三种情况，那样程序就一直阻塞等待，想到的方法是在此处加一个定时器alarm。加了定时器的源码如下：
            

点击(此处)折叠或打开

  1. /*
  2.  *Name:ping.c
  3.  *Module:PING
  4.  *Description:realize the funtion that check a PC's status
  5.  *History:2015/5/13
  6.  */
  7. #include "./ping.h"

  9. static struct timeval tvrecv;
  10. static char send_packet[PACKET_SIZE];
  11. static char recv_packet[PACKET_SIZE];
  12. static struct sockaddr_in send_addr;
  13. static struct sockaddr_in recv_addr;
  14. static int sock_fd;
  15. static int nsend;
  16. static int nrecv;
  17. static pid_t pid;
  18. static int ret;
  19. static int datalength = 56;


  22. static void dealSigAlarm(int signo);//定时器退出的时候，要执行的函数

  24. static int pack(int seqno);
  25. static int unpack(int len);
  26. static void send_packet_func();
  27. static void recv_packet_func();
  28. static unsigned short cal_chksum(unsigned short *data,int len);

  30. int __ping(char *addr)
  31. {
  32.     int size;
  33.     if(inet_addr(addr)==INADDR_NONE){
  34.         printf("IP addr is error\n");
  35.         exit(EXIT_FAILURE);
  36.     }
  37.     nsend=0;
  38.     nrecv=0;

  40.     //get the autority
  41.     //initialize the socket
  42.     sock_fd = socket(AF_INET,SOCK_RAW,IPPROTO_ICMP);
  43.     if(sock_fd == -1){
  44.         perror("socket error");
  45.         exit(EXIT_FAILURE);
  46.     }
  47.     //initialize the addr
  48.     bzero(&send_addr,sizeof(send_addr));
  49.     send_addr.sin_family = AF_INET;
  50.     send_addr.sin_port = htons(0);
  51.     send_addr.sin_addr.s_addr = inet_addr(addr);

  53.     setsockopt(sock_fd,SOL_SOCKET,SO_RCVBUF,&size,sizeof(size) );
  54.     pid = getpid();        
  55.     
  56.     send_packet_func();
  57.     recv_packet_func();

  59.     return 0;
  60. }

  62. void send_packet_func()
  63. {
  64.     int packetsize;
  65.     while(nsend < SEND_RECV_TIMES){
  66.         packetsize=pack(nsend);
  67.         nsend++;
  68.         ret = sendto(sock_fd,send_packet,packetsize,0,(struct sockaddr *)&send_addr,sizeof(send_addr));
  69.         if(ret < 0){
  70.             perror("sendto error");
  71.             continue;
  72.         }
  73.     }
  74. }

  76. void recv_packet_func()
  77. {
  78.     int recvlen;
  79.     recvlen = sizeof(recv_addr);
  80.     
  81.     //定时器初始化
  82.     struct sigaction alrmact;
  83.     bzero(&alrmact,sizeof(alrmact));
  84.     alrmact.sa_handler=dealSigAlarm;
  85.     alrmact.sa_flags=SA_NOMASK;
  86.     alrmact.sa_restorer=NULL;
  87.     sigaction(SIGALRM,&alrmact,NULL);
  88.     
  89.     while(nrecv < nsend)
  90.     {
  91.         alarm(5)//定时5秒
  92.         nrecv++;
  93.         ret = recvfrom(sock_fd,recv_packet,sizeof(recv_packet),0,(struct sockaddr *)&recv_addr,&recvlen);
  94.         if(ret == 84){
  95.             printf("%s is on",inet_ntoa(send_addr.sin_addr));
  96.         }
  97.         else{
  98.             printf("%s is off",inet_ntoa(send_addr.sin_addr));
  99.         }
  100.     }
  101.     alarm(0);//定时器退出
  102. }
  103. int pack(int seqno)
  104. {
  105.     int packetsize;
  106.     struct icmp *_icmp;
  107.     struct timeval *tval;
  108.     
  109.     _icmp = (struct icmp*)send_packet;
  110.     _icmp->icmp_type = ICMP_ECHO;
  111.     _icmp->icmp_code = 0;
  112.     _icmp->icmp_cksum = 0;
  113.     _icmp->icmp_id = pid;
  114.     _icmp->icmp_seq = seqno;
  115.     
  116.     packetsize = 8 + datalength;
  117.     tval = (struct timeval *)_icmp->icmp_data;
  118.     gettimeofday(tval,NULL);
  119.     _icmp->icmp_cksum = cal_chksum((unsigned short *)_icmp,packetsize);
  120.     
  121.     return packetsize;
  122. }

  124. unsigned short cal_chksum(unsigned short *addr,int len)
  125. {
  126.     int nleft=len;
  127.         int sum=0;
  128.         unsigned short *w=addr;
  129.         unsigned short answer=0;
  130.         
  131.     /*把ICMP报头二进制数据以2字节为单位累加起来*/
  132.         while(nleft>1){
  133.         sum+=*w++;
  134.                 nleft-=2;
  135.         }
  136.     if(nleft==1){
  137.         *(unsigned char *)(&answer)=*(unsigned char *)w;
  138.                 sum+=answer;
  139.         }
  140.         sum=(sum>>16)+(sum&0xffff);
  141.         sum+=(sum>>16);
  142.         answer=~sum;
  143.         return answer;
  144. }
            定时器定时5s,此处也可以设置为2s，这个具体看响应时间来设定。此时就避免了第三种情况。这样整个IP段都扫描到了。

           新问题的出现：需要获取到在线主机的MAC地址。
           思路：将上述程序的socket()函数中的AF_INET，改成PF_PACKET,第三个参数改成htons(ETH_P_IP),创建一个链路层原始套接字，然后封包的时候，自己构造IP头部，以太头。
           结果：报错，说sendto的参数invalid；
           办法：当使用链路层原始套接字的时候，地址信息不能用sockaddr_in这个结构体，而要使用sockaddr_ll这个结构体。并且联合struct ifreq 这个结构体和相关函数获取指定网口的IP地址和MAC地址信息。并且思路应该改为用一个网络层原始套接字发送PING数据包，然后另外创建一个链路层原始套接字，来接收PING回显数据包。
           改进后的源码如下：

点击(此处)折叠或打开

  1. /*
  2.  *Name:ping.c
  3.  *Module:PING
  4.  *Description:realize the funtion that check a PC's status
  5.  *History:2015/5/13
  6.  */
  7. #include "./ping.h"

  9. static struct timeval tvrecv;
  10. static char send_packet[PACKET_SIZE];
  11. static char recv_packet[PACKET_SIZE];
  12. static struct sockaddr_in send_addr;
  13. static int sock_fd;

  15. static struct sockaddr_ll test_addr;
  16. static int test_fd;
  17. static void display_mac(char *ptr);
  18. static u_int8_t mac[ETH_ALEN];
  19. char mac_address[32];


  22. static int nsend;
  23. static int nrecv;
  24. static pid_t pid;
  25. static int ret;
  26. static int datalength = 56;
  27. static int times=0;


  30. static void dealSigAlarm(int signo);
  31. static int pack(int seqno);
  32. static int unpack(int len);
  33. static void send_packet_func();
  34. static void recv_packet_func();
  35. static unsigned short cal_chksum(unsigned short *data,int len);

  37. int __ping(char *addr)
  38. {
  39.     int size;
  40.     if(inet_addr(addr)==INADDR_NONE){
  41.         printf("IP addr is error\n");
  42.         exit(EXIT_FAILURE);
  43.     }
  44.     nsend=0;
  45.     nrecv=0;

  47.     //get the autority
  48.     //initialize the socket
  49.     sock_fd = socket(AF_INET,SOCK_RAW,IPPROTO_ICMP);
  50.     if(sock_fd == -1){
  51.         perror("socket error");
  52.         exit(EXIT_FAILURE);
  53.     }
  54.     //initialize the addr
  55.     bzero(&send_addr,sizeof(send_addr));
  56.     send_addr.sin_family = AF_INET;
  57.     send_addr.sin_port = htons(0);
  58.     send_addr.sin_addr.s_addr = inet_addr(addr);

  60.     setsockopt(sock_fd,SOL_SOCKET,SO_RCVBUF,&size,sizeof(size) );
  61.     pid = getpid();        
  62.     
  63.     send_packet_func();
  64.     close(sock_fd);
  65.     test_fd = socket(PF_PACKET,SOCK_RAW,htons(ETH_P_IP));
  66.     recv_packet_func();
  67.     close(test_fd);
  68.     
  69.     return 0;
  70. }

  72. void send_packet_func()
  73. {
  74.     int packetsize;
  75.     while(nsend < SEND_RECV_TIMES){
  76.         packetsize=pack(nsend);
  77.         nsend++;
  78.         ret = sendto(sock_fd,send_packet,packetsize,0,(struct sockaddr *)&send_addr,sizeof(send_addr));
  79.         if(ret < 0){
  80.             perror("sendto error");
  81.             continue;
  82.         }
  83.     }
  84. }

  86. void recv_packet_func()
  87. {
  88.     int recvlen;
  89.     int used;
  90.     u_int8_t protocol=1;
  91.     u_int8_t type=0;
  92.     recvlen = sizeof(test_addr);

  94.     while(nrecv < nsend)
  95.     {
  96.         nrecv++;
  97.         times++;
  98.         ret = recvfrom(sock_fd,recv_packet,sizeof(recv_packet),0,(struct sockaddr *)&test_addr,&recvlen);
  99.         if(recv_packet[23]==protocol){
  100.                 if(recv_packet[34]==type){
  101.                     printf("MAC\t%02X:%02X:%02X:%02X:%02X:%02X\n",recv_packet[6],recv_packet[7],recv_packet[8],\
  102.                                     recv_packet[9],recv_packet[10],recv_packet[11]);
  103.                     printf("IP \t%s\n",inet_ntoa(send_addr.sin_addr));
  104.                     printf("is on!\n");   
  105.             }
  106.         }
  107.         else{
  108.                     printf("MAC\t%02X:%02X:%02X:%02X:%02X:%02X\n",recv_packet[6],recv_packet[7],recv_packet[8],\           
  109.                                 recv_packet[9],recv_packet[10],recv_packet[11]);
  110.                     printf("IP \t%s\n",inet_ntoa(send_addr.sin_addr));
  111.                     printf("is off!\n"); 
  112.         }
  113.     }
  114. }

  116. int pack(int seqno)
  117. {
  118.     int packetsize;
  119.     struct icmp *_icmp;
  120.     struct timeval *tval;
  121.     
  122.     _icmp = (struct icmp*)send_packet;
  123.     _icmp->icmp_type = ICMP_ECHO;
  124.     _icmp->icmp_code = 0;
  125.     _icmp->icmp_cksum = 0;
  126.     _icmp->icmp_id = pid;
  127.     _icmp->icmp_seq = seqno;
  128.     
  129.     packetsize = 8 + datalength;
  130.     tval = (struct timeval *)_icmp->icmp_data;
  131.     gettimeofday(tval,NULL);
  132.     _icmp->icmp_cksum = cal_chksum((unsigned short *)_icmp,packetsize);
  133.     
  134.     return packetsize;
  135. }

  137. unsigned short cal_chksum(unsigned short *addr,int len)
  138. {
  139.     int nleft=len;
  140.         int sum=0;
  141.         unsigned short *w=addr;
  142.         unsigned short answer=0;
  143.         
  144.     /*把ICMP报头二进制数据以2字节为单位累加起来*/
  145.         while(nleft>1){
  146.         sum+=*w++;
  147.                 nleft-=2;
  148.         }
  149.     if(nleft==1){
  150.         *(unsigned char *)(&answer)=*(unsigned char *)w;
  151.                 sum+=answer;
  152.         }
  153.         sum=(sum>>16)+(sum&0xffff);
  154.         sum+=(sum>>16);
  155.         answer=~sum;
  156.         return answer;
  157. }
            通过抓包有两种情况：
            1）正确接收，立刻就能接收到，数据帧字节为98字节(84字节的IP数据报+14字节的以太头)；
            2）没有回显，是其他不相关数据包；
            此时，不能通过接收到的数据包字节长度来唯一确定PING回显数据包，所以我通过链路层的协议字段和IP层类型字段来判断是否是ICMP回显。
            此时没有阻塞等待的情况，应为该接收原始套接字能匹配上发往本机IP的所有IP数据包。



阅读(1946) | 评论(0) | 转发(0) |
0

上一篇：Shell自启动脚本

下一篇：Linux内核分析（一）之反汇编一个C代码

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6