'ether_header' 태그의 글 목록

'ether_header'에 해당되는 글 1건

2009.09.16 ether_header 구조체와 iphdr 구조체를 이용한 패킷 분석

2009. 9. 16. 19:39

ether_header 구조체와 iphdr 구조체를 이용한 패킷 분석

2009. 9. 16. 19:39 in 공부합시다/소켓프로그래밍

이전 포스팅에서는 바이트별로 직접 골라냈었는데(-ㅅ-;) 이번엔 라이브러리에 있는 구조체를 활용해서 더 쉽게 패킷을 분석해보자.

ether_header 구조체

/usr/include/net/ethernet.h 에 위치한다. (gcc의 버전에 따라 다를 수 있다.)

/* 10Mb/s ethernet header */
struct ether_header
{
    u_int8_t ether_dhost[ETH_ALEN];    /* destination eth addr */
    u_int8_t ether_shost[ETH_ALEN];    /* source ether addr    */
    u_int16_t ether_type;         /* packet type ID field */
} __attribute__ ((__packed__));

iphdr 구조체

/usr/include/netinet/ip.h 에 위치한다. (역시 gcc의 버전에 따라 다를 수 있다.)

   struct iphdr
      {
   #if __BYTE_ORDER == __LITTLE_ENDIAN
        unsigned int ihl:4;                             /* header length */
        unsigned int version:4;                       /* version */
   #elif __BYTE_ORDER == __BIG_ENDIAN
        unsigned int version:4; /* version */
        unsigned int ihl:4;                             /* header length */
   #else
   # error "Please fix <bits/endian.h>"
   #endif
        u_int8_t tos;                                     /* type of service */
        u_int16_t tot_len;                               /* total length */
        u_int16_t id;                                     /* identification */
        u_int16_t frag_off;                              /* fragment offset field */
        u_int8_t ttl;                                       /* time to live */
        u_int8_t protocol;                              /* protocol */
        u_int16_t check;                               /* checksum */
        u_int32_t saddr;                               /* source address */
        u_int32_t daddr;                               /* dest address */
        /*The options start here. */
      };

소스 코드

#include <stdio.h> #include <pcap/pcap.h> #include <net/ethernet.h> #include <netinet/ip.h> #include <netinet/in.h> #define INPUT #define OUTPUT void HexView(const u_char* ucData, int len); void PrintIPHeader(u_char* ucData); void* Ether(INPUT void *vP); void* IpHeader(INPUT void *vP); int main() { char errbuf[PCAP_ERRBUF_SIZE]; char* spNetDevName = pcap_lookupdev(errbuf); const u_char* ucData; int iDataLink; int retv; struct pcap_pkthdr stPInfo; pcap_t* pDes; if(0 == spNetDevName) { printf("Error : [%s]\n", errbuf); return 100; } else { printf("Network Devie Name : [%s]\n", spNetDevName); } pDes = pcap_open_live(spNetDevName, 1500, 1, 0, errbuf); if(0 == pDes) { printf("Error : [%s]\n", errbuf); return 101; } else { iDataLink = pcap_datalink(pDes); } if(DLT_EN10MB == iDataLink) { printf("2Layer Type : [Ethernet (10Mb)]\n", iDataLink); } else { printf("2Layer Type : Not Ethernet Type...\n", iDataLink); return 102; } do { ucData = pcap_next(pDes, &stPInfo); printf("Cap Length : %d Bytes\n", stPInfo.caplen); printf("Length : %d Bytes\n", stPInfo.len); if(400 > stPInfo.caplen) continue; //PrintIPHeader(ucData+14); HexView(ucData, stPInfo.caplen); Ether((void*)ucData); IpHeader((void*)(ucData+sizeof(struct ether_header))); }while(stPInfo.caplen < 400); pcap_close(pDes); return 0; } void* Ether(INPUT void* vP) { struct ether_header* ehP = (struct ether_header *)vP; printf("=============================================================" "==========\n"); printf("======================== Ethernet Infomation ===============" "===========\n"); printf("=============================================================" "==========\n"); printf("== SOURCE -> Destination\n"); printf("== %02X:%02X:%02X:%02X:%02X:%02X -> %02X:%02X:%02X:%02X:%02X:%02X\n", ehP->ether_shost[0], ehP->ether_shost[1], ehP->ether_shost[2], ehP->ether_shost[3], ehP->ether_shost[4], ehP->ether_shost[5], ehP->ether_dhost[0], ehP->ether_dhost[1], ehP->ether_dhost[2], ehP->ether_dhost[3], ehP->ether_dhost[4], ehP->ether_dhost[5] ); printf("== Next Protocol : "); switch(ntohs(ehP->ether_type)) { case ETHERTYPE_IP: printf("[IP]\n"); break; case ETHERTYPE_ARP: printf("[ARP]\n"); break; case ETHERTYPE_REVARP: printf("[Reverse ARP]\n"); break; case ETHERTYPE_PUP: printf("[Xerox PUP]\n"); break; default: printf("[Not Support Protocol]\n"); break; } return 0; } void* IpHeader(void* vP) { struct iphdr *iph = (struct iphdr *)vP; printf("=============================================================" "==========\n"); printf("== IP version : %d\n", iph->version); printf("== Header Length : %d Bytes\n", (iph->ihl)<<2); printf("== Type of Service : %X\n", ntohs(iph->tos)); printf("== Total length : %04d Bytes\n", ntohs(iph->tot_len)); printf("== ID : %d\n", ntohs(iph->id)); printf("== Fragment offset : 0x%04X\n", ntohs(iph->frag_off)); printf("== TTL : %d sec\n", iph->ttl); switch(iph->protocol) { case 6: printf("== Protocol : TCP\n"); break; case 17: printf("== Protocol : UDP\n"); break; default: printf("== Protocol : %d\n", iph->protocol); break; } printf("== Checksum : %d\n", iph->check); printf("== Source Address : %s\n", inet_ntoa(iph->saddr)); printf("== Destination Address : %s\n", inet_ntoa(iph->daddr)); printf("=============================================================" "==========\n"); return 0; } void HexView(const u_char * ucData, int len) { int iCntx, iCnty, iCntz; int addr = 0; u_char * p = (u_char*)ucData; printf("=======================================================================\n"); printf("address 0 1 2 3 4 5 6 7 8 9 A B C D E F ASCII code\n"); printf("=======================================================================\n"); for(iCntx = 0, iCntz = 0; iCntx < len/16+1; ++iCntx) { printf("0x%04X ", addr); for(iCnty = 0; iCnty < 16; ++iCnty) { if(iCntz < len) printf("%02X ", *p); else printf("00 "); ++p; ++iCntz; } p -= 16; iCntz -= 16; for(iCnty = 0; iCnty < 16; ++iCnty) { if((0x21 <= *p) && (0x7E >= *p) && (iCntz < len)) printf("%c", *p); else printf("."); ++p; } putchar('\n'); addr += 16; } }

실행 화면

저작자표시 비영리 변경금지

'공부합시다 > 소켓프로그래밍' 카테고리의 다른 글

TCP 헤더 분석 (3)	2009.09.18
바이트별로 노가다 작업을 통한 패킷 분석-ㅅ-; (1)	2009.09.16
패킷 캡쳐로 살펴본 이더넷 프레임 (0)	2009.09.15
이더넷 프레임의 구조 (0)	2009.09.15
pcap_t, pcap_pkthdr 구조체 (0)	2009.08.21