网络抓包以及进行简单数据分析

　　经过了好几天的网络编程学习，熟悉了套接字的使用，今天需要我们做的是：实现简单的抓包软件并且对数据进行简单分析，实现校验和使用的回滚算法的编写：

　　下面是简单的抓包软件及分析数据的代码，通过这个程序，我们可以更深层次的了解网络的运行机制，以及数据是怎样在网络中进行传送：

  1 #include <stdio.h>
  2 #include <string.h>
  3 #include <sys/socket.h>
  4 #include <netinet/in.h>
  5 #include <linux/ip.h>
  6 #include <linux/udp.h>
  7 #include <linux/if_ether.h>
  8
  9 void show_mac(unsigned char *data);
 10 void show_ip(unsigned char *data);
 11 void show_udp(unsigned char *data);
 12 void show_app(unsigned char *data);
 13
 14 int main()
 15 {
 16     /*接收所有经过该网卡的包*/
 17     int fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
 18     if(fd < 0) {
 19         perror("socket");
 20         return 1;
 21     }
 22
 23     int ret = 0;
 24     int i = 0;
 25     unsigned char buff[1024] = {0};
 26     while(1) {
 27         memset(buff, 0, 1024);
 28         ret = read(fd, buff, 1024);//将接收的包存在数组里面
 29         printf("%d\n", strlen(buff));
 30         if(ret < 0) {
 31             perror("read");
 32             continue;
 33         }
 34     if(ret < 42) {//不处理错误的包
 35         continue;
 36     }
 37     printf("socrce ip is:\t %x\t%x\t%x\t%x\n",
 38             buff[14 + 12], buff[14 + 13],
 39             buff[14 + 14], buff[14 + 15]);
 40     printf("dest ip is:\t %x\t%x\t%x\t%x\n",
 41             buff[14 + 16], buff[14 + 17],
 42             buff[14 + 18], buff[14 + 19]);
 43
 44     if(buff[14 + 19] != 102) {//只处理发给本机的包
 45         continue;
 46     }
 47
 48     for(i = 0; i < ret; i++) {
 49         printf("%x\t", buff[i]);
 50         if(i % 8 == 0) {
 51             printf("\n");
 52         }
 53     }
 54     printf("\n\n\n");
 55     show_mac(buff);
 56     break;
 57
 58     }
 59
 60     return 0;
 61 }
 62
 63 void show_mac(unsigned char *data)
 64 {
 65     printf("----------------eth--------------------\n");
 66     struct ethhdr *eth = (struct ethhdr *)data;
 67     printf("destination eth addr: %x:%x:%x:%x:%x:%x\n",
 68         eth->h_dest[0], eth->h_dest[1],
 69         eth->h_dest[2], eth->h_dest[3],
 70         eth->h_dest[4], eth->h_dest[5]);
 71     printf("source eth addr: %x:%x:%x:%x:%x:%x\n",
 72         eth->h_source[0], eth->h_source[1],
 73         eth->h_source[2], eth->h_source[3],
 74         eth->h_source[4], eth->h_source[5]);
 75     printf("protocol is: %04x\n", ntohs(eth->h_proto));
 76     if(ntohs(eth->h_proto) == 0x0800) {
 77         show_ip(data + sizeof(struct ethhdr));
 78     }
 79     else {
 80         printf("unkonw mac protocol\n");
 81     }
 82
 83 }
 84
 85 void show_ip(unsigned char *data)
 86 {
 87     printf("----------------ip--------------------\n");
 88     struct iphdr *ip = (struct iphdr *)data;
 89     printf("version is %d\n", ip->version);
 90     printf("head len is %d\n", ip->ihl * 4);
 91     printf("total len is %d\n", ntohs(ip->tot_len));
 92     printf("ttl is %d\n", ip->ttl);
 93     printf("protocol is %d\n", ip->protocol);
 94     printf("check is %x\n", ip->check);
 95     printf("saddr is %s\n", inet_ntoa(ip->saddr));
 96     printf("daddr is %s\n", inet_ntoa(ip->daddr));
 97     if(ip->protocol == 17) {
 98         show_udp(data + sizeof(struct iphdr));
 99     }
100     else {
101         printf("unkown ip procotol\n");
102     }
103
104 }
105
106 void show_udp(unsigned char *data)
107 {
108     printf("----------------udp--------------------\n");
109     struct udphdr *udp = (struct udphdr *)data;
110     printf("source port %d\n", htons(udp->source));
111     printf("dest port %d\n", htons(udp->dest));
112     printf("udp len %d\n", htons(udp->len));
113     printf("check %x\n", htons(udp->check));
114
115     show_app(data + sizeof(struct udphdr));
116 }
117
118 void show_app(unsigned char *data)
119 {
120     printf("data is %s\n", data);
121 }

　　下面是校验和回滚算法的代码：

 1 #include <stdio.h>
 2 #include <linux/if_ether.h>
 3
 4 unsigned short check_sum(unsigned char *data, int len);
 5
 6 int main()
 7 {
 8     //7af7
 9     unsigned char data[1024] = {
10     0x45, 0x00,
11     0x00, 0x20, 0x00, 0x00, 0x40, 0x00, 0x40, 0x11,
12     0x00, 0x00, 0xc0, 0xa8, 0x1f, 0x44, 0xc0, 0xa8,
13     0x1f, 0x41
14     };
15
16     printf("check sum is %x\n", check_sum(data, 20));
17 }
18
19 unsigned short check_sum(unsigned char *data, int len)
20 {
21     unsigned long sum = 0;
22     unsigned long ret = 0;
23     unsigned short *tmp = (unsigned short *)data;
24     unsigned short buff[1024] = {0};
25
26     //以两字节为单位反复累加
27     while(len > 1) {
28         sum = sum +  *tmp++;
29         len = len - 2;
30     }
31
32     //如果是单数，加最后一个
33     if(len) {
34         sum = sum + *tmp;
35     }
36
37     //将累加和的高位与低位相加，直至高位为0（回滚）
38     ret = (sum & 0x00ff0000) >> 16;
39     if(ret != 0) {
40         sum = sum + ret;
41            ret = (sum & 0x00ff0000) >> 16;
42     }
43
44     return ntohs(~sum);
45 }