使用libpcap过滤arp

上一篇博客简单讲述了libpcap的工作流程及简单使用，今天我们需要做的是继续使用libpcap抓取我们感兴趣的流量，并进行简单的解析：

测试环境是centos 7

下面贴一张arp帧结构图：

下面我们实现的是通过pcap过滤抓取arp报文，解析其中的Ethernet address 和proctocal address并打印出来

分析是arp request还是reply，前面就不做过多解释，代码比较简单，直接贴：

 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <stdint.h>
 #include <pcap.h>
 #include <arpa/inet.h>

 #define MAXBYTES2CAPTURE 2048
 #define ARP_REQUEST     1
 #define ARP_REPLY       2

 typedef struct arphdr {
     u_int16_t htype;        //hardware type
     u_int16_t ptype;        //protocol type
     u_char hlen;            //hardware address length
     u_char plen;            //protocol address length
     u_int16_t oper;         //operation code
     u_char sha[];          //sendHardware address
     u_char spa[];          //sender ip address
     u_char tha[];          //target hardware address
     u_char tpa[];          //target ip address
 } arphdr_t;

 int main(int argc, char **argv)
 {
     int i = ;
     bpf_u_int32 net = ;
     bpf_u_int32 mask = ;
     struct bpf_program filter; /*place to store the filter program*/
     char errbuf[PCAP_ERRBUF_SIZE];
     pcap_t *handle = NULL;   /*interface handle*/
     struct pcap_pkthdr pkthdr; /**/
     const unsigned char *packet = NULL; /*received raw data*/
     arphdr_t *arpheader = NULL; /*point to arp header*/

     if (argc != ) {
         printf("USAGE: arpsniffer <interface>\n");
         exit();
     }

     memset(errbuf, , PCAP_ERRBUF_SIZE);
     /*open network device for packet capture*/
     handle = pcap_open_live(argv[], MAXBYTES2CAPTURE, , , errbuf);
     if (handle == NULL) {
         fprintf(stderr, "Couldn't open device %s: %s\n", argv[], errbuf);
         exit();
     }

     /*look up device network addr and mask*/
     if (pcap_lookupnet(argv[], &net, &mask, errbuf) == -) {
         fprintf(stderr, "Couldn't get netmask for device %s: %s\n", argv[], errbuf);
         exit();
     }

     /*complie the filter expression of filter program*/
     pcap_compile(handle, &filter, "arp", , mask);

     pcap_setfilter(handle, &filter);

     while() {
         /*Get one packet if null continue wait*/
         if ((packet = pcap_next(handle, &pkthdr)) == NULL) {
             continue;
         }

         arpheader = (struct arphdr *)(packet + ); /*Point to the ARP header*/
         printf("\n------------- ARP --------------\n");
         printf("Received Packet Size: %d bytes\n", pkthdr.len);
         printf("Hardware type: %s\n", (ntohs(arpheader->htype) == )?"Ethernet":"Unknown");
         printf("Protocol type: %s\n", (ntohs(arpheader->ptype) == 0x0800)?"IPv4":"Unknown");
         printf("Operation : %s\n", (ntohs(arpheader->oper) == ARP_REQUEST)?"ARP_REQUEST":"ARP_REPLY");

         /*If is Ethernet and IPv4 print packet contents*/
         if (ntohs(arpheader->htype) ==  && ntohs(arpheader->ptype) == 0x0800) {
             printf("\nSoucre MAC:%02x:%02x:%02X:%02x:%02x:%02x\n",
                             arpheader->sha[], arpheader->sha[],
                             arpheader->sha[], arpheader->sha[],
                             arpheader->sha[], arpheader->sha[]);
             printf("Soucre IP:%d.%d.%d.%d\n",
                             arpheader->spa[], arpheader->spa[],
                             arpheader->spa[], arpheader->spa[]);
             printf("\nDestination MAC:%02x:%02x:%02X:%02x:%02x:%02x\n",
                             arpheader->tha[], arpheader->tha[],
                             arpheader->tha[], arpheader->tha[],
                             arpheader->tha[], arpheader->tha[]);
             printf("Destination IP:%d.%d.%d.%d\n",
                             arpheader->tpa[], arpheader->tpa[],
                             arpheader->tpa[], arpheader->tpa[]);
         }
     }
     return ;
 } 

下面是运行结果：

 [root@localhost pcap_arp]# ./pcap enp0s3

 ------------- ARP --------------
 Received Packet Size:  bytes
 Hardware type: Ethernet
 Ptotocol type: IPv4
 Operation : ARP_REQUEST

 Soucre MAC:b0::FE::5a:5b
 Soucre IP:192.168.16.139

 Destination MAC:::::e7:
 Destination IP:192.168.16.125

 ------------- ARP --------------
 Received Packet Size:  bytes
 Hardware type: Ethernet
 Ptotocol type: IPv4
 Operation : ARP_REPLY

 Soucre MAC:::::e7:
 Soucre IP:192.168.16.125

 Destination MAC:b0::FE::5a:5b
 Destination IP:192.168.16.139

Makefile：

 #
 #design of ARP sniffer
 #

 CFLAGS = -g
 LDFLAGS = -lpcap

 OBJS = test.o
 TARGET = pcap

 RM = rm -f  

 $(TARGET):$(OBJS)
     $(CC) $(LDFLAGS) -o $@ $^

 %.o:%.c
     $(CC) $(CFLAGS) -c -o $@ $<

 .PHONY:clean

 clean:
     $(RM) $(TARGET) $(OBJS)