I am reading a pcap file and I want to print out the ip address and port number of each packet. I am using code from http://www.tcpdump.org/pcap.htm and http://www.rhyous.com/2011/11/13/how-to-read-a-pcap-file-from-wireshark-with-c/.
Here is my code:
#define SIZE_ETHERNET 14
#define ETHER_ADDR_LEN 6
/* Ethernet header */
struct sniff_ethernet {
u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
u_short ether_type; /* IP? ARP? RARP? etc */
};
/* IP header */
struct sniff_ip {
u_char ip_vhl; /* version << 4 | header length >> 2 */
u_char ip_tos; /* type of service */
u_short ip_len; /* total length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src;
struct in_addr ip_dst; /* source and dest address */
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
/* TCP header */
struct sniff_tcp {
u_short th_sport; /* source port */
u_short th_dport; /* destination port */
u_int32_t th_seq; /* sequence number */
u_int32_t th_ack; /* acknowledgement number */
u_char th_offx2; /* data offset, rsvd */
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
u_short th_win; /* window */
u_short th_sum; /* checksum */
u_short th_urp; /* urgent pointer */
};
int main(int argc, char *argv[])
{
//get file
char *filename = argv[1];
//error buffer
char errbuff[PCAP_ERRBUF_SIZE];
//open file and create pcap handler
pcap_t * handler = pcap_open_offline(filename, errbuff);
//The header that pcap gives us
struct pcap_pkthdr *header;
//The actual packet
const u_char *packet;
int packetCount = 0;
int i;
//write to file
FILE *fp = fopen ( "result.txt", "w" ) ;
//tcp info
const struct sniff_ethernet *ethernet; /* The ethernet header */
const struct sniff_ip *ip; /* The IP header */
const struct sniff_tcp *tcp; /* The TCP header */
u_int size_ip;
u_int size_tcp;
while (pcap_next_ex(handler, &header, &packet) >= 0)
{
// Show the packet number
printf("Packet # %i\n", ++packetCount);
fprintf(fp,"Packet # %i\n", packetCount);
// Show the size in bytes of the packet
printf("Packet size: %d bytes\n", header->len);
fprintf(fp,"Packet size: %d bytes\n", header->len);
// Show a warning if the length captured is different
if (header->len != header->caplen)
printf("Warning! Capture size different than packet size: %ld bytes\n", header->len);
// Show Epoch Time
printf("Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);
fprintf(fp,"Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);
ethernet = (struct sniff_ethernet*)(packet);
ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
size_ip = IP_HL(ip)*4;
if (size_ip < 20) {
printf(" * Invalid IP header length: %u bytes\n", size_ip);
return;
}
tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
printf("src port: %d dest port: %d \n", tcp->th_sport, tcp->th_dport);
fprintf(fp,"src port: %d dest port: %d \n", tcp->th_sport, tcp->th_dport);
printf("src address: %s dest address: %s \n", inet_ntoa(ip->ip_src), inet_ntoa(ip->ip_dst));
fprintf(fp,"src address: %s dest address: %s \n", inet_ntoa(ip->ip_src), inet_ntoa(ip->ip_dst));
printf("seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack);
fprintf(fp,"seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack);
// Add two lines between packets
printf("\n");
fprintf(fp,"\n");
}
fclose (fp);
return(0);
}
this is part of my result:
Packet # 1
Packet size: 74 bytes
Epoch Time: 1348895319:643493 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3071009507 ack number: 2490081174
Packet # 2
Packet size: 66 bytes
Epoch Time: 1348895319:643566 seconds
src port: 15578 dest port: 20480
src address: 192.168.5.162 dest address: 192.168.5.162
seq number: 2490081174 ack number: 3087786723
Packet # 3
Packet size: 207 bytes
Epoch Time: 1348895319:643720 seconds
src port: 15578 dest port: 20480
src address: 192.168.5.162 dest address: 192.168.5.162
seq number: 2490081174 ack number: 3087786723
Packet # 4
Packet size: 66 bytes
Epoch Time: 1348895320:127547 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3087786723 ack number: 560766870
Packet # 5
Packet size: 1514 bytes
Epoch Time: 1348895320:129417 seconds
src port: 20480 dest port: 15578
src address: 128.8.126.92 dest address: 128.8.126.92
seq number: 3087786723 ack number: 560766870
The ip address is the same even though i used src and dst ip address. The seq number and ack number seem to be too large. can anyone see what is causing my problem and how I can fix it. Thanks in advance.
- Are you sure you dump has only IP packets in it?
- The values are in network byte order. You'd need to use
ntohlandntohsto convert them. inet_ntoato uses a static buffer so subsequent calls overwrite the value (hence the matched source and dest addresses).
来源：https://stackoverflow.com/questions/12999538/read-from-a-pcap-file-and-print-out-ip-addresses-and-port-numbers-in-c-but-my-r