#include #include #include #include #include #include #include #include #include #define SNAP_LEN 1514 char *interface; char *port; char *temp; char err_buff[PCAP_ERRBUF_SIZE]; struct bpf_program bp; char *filter = "src port "; bpf_u_int32 netp, maskp; pcap_t *pdes; u_char *user; u_char *buff = NULL; u_int16_t handle_ethernet(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char*packet); u_char* handle_IP(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet); void gestion_sigint (int signum); struct my_ip { u_int8_t ip_vhl; /* header length, version */ #define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4) #define IP_HL(ip) ((ip)->ip_vhl & 0x0f) u_int8_t ip_tos; /* type of service */ u_int16_t ip_len; /* total length */ u_int16_t ip_id; /* identification */ u_int16_t ip_off; /* fragment offset field */ #define IP_DF 0x4000 /* dont fragment flag */ #define IP_MF 0x2000 /* more fragments flag */ #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ u_int8_t ip_ttl; /* time to live */ u_int8_t ip_p; /* protocol */ u_int16_t ip_sum; /* checksum */ struct in_addr ip_src,ip_dst; /* source and dest address */ }; void fenGTK(int argc,char **argv, const char *text); void fenGTK(int argc,char **argv, const char *text) { GtkWidget* pWindow; GtkWidget* pLabel; gtk_init(&argc,&argv); pWindow = gtk_window_new(GTK_WINDOW_TOPLEVEL); gtk_window_set_title(GTK_WINDOW(pWindow), "Surveillance du systeme"); gtk_window_set_default_size(GTK_WINDOW(pWindow), 320, 200); /* Creation du label */ pLabel=gtk_label_new(text); /* On ajoute le label a l'interieur de la fenetre */ gtk_container_add(GTK_CONTAINER(pWindow), pLabel); /* Affichage de la fenetre et de tout ce qu'il contient */ gtk_widget_show_all(pWindow); /* Connexion du signal /* On appelle directement la fonction de sortie de boucle */ g_signal_connect(G_OBJECT(pWindow), "destroy", G_CALLBACK(gtk_main_quit), NULL); gtk_main(); } void gestion_sigint (int signum) { pcap_close(pdes); free(temp); printf ("Libération des ressources et fin de la surveillance\n\n"); exit(0); } void callback(u_char *user, const struct pcap_pkthdr *h, const u_char *buf) { u_int16_t type = handle_ethernet(user, h, buf); if(type == ETHERTYPE_IP) { } else if(type == ETHERTYPE_ARP) { } else if(type == ETHERTYPE_REVARP) { } } u_char* handle_IP(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet) { const struct my_ip* ip; u_int length = pkthdr->len; u_int hlen,off,version; int i; int pfd[2]; char buffer[BUFSIZ]; char buffer2[BUFSIZ]; int len; /* jump pass the ethernet header */ ip = (struct my_ip*)(packet + sizeof(struct ether_header)); length -= sizeof(struct ether_header); /* check to see we have a packet of valid length */ if (length < sizeof(struct my_ip)) { printf("Paquet IP tronqué %d",length); return NULL; } len = ntohs(ip->ip_len); hlen = IP_HL(ip); /* header length */ version = IP_V(ip);/* ip version */ /* check version */ if(version != 4) { fprintf(stdout,"IP version inconnu %d\n",version); return NULL; } if(version == 6) { printf("IP version 6, pas encore implémenter"); return NULL; } /* check header length */ if(hlen < 5 ) { fprintf(stdout,"hlen faux %d \n",hlen); } /* see if we have as much packet as we should */ if(length < len) printf("\nPaquet IP tronque - %d octets perdus\n",len - length); switch(fork()) { case -1: printf("Erreur fork\n"); exit(-1); break; case 0: close(pfd[1]); printf("Processus fils\n"); while (read(pfd[0], buffer2, BUFSIZ) != 0) printf("child reads %s", buffer2); fenGTK(NULL, NULL, buffer2); close(pfd[0]); /* close the pipe */ break; default: //char buffer[BUFSIZ]; printf("Processus Pere\n"); close(pfd[0]); /* close read side */ /* send some data into the pipe */ strcpy(buffer, "HelloWorld\n"); write(pfd[1], buffer, strlen(buffer)+1); /* Check to see if we have the first fragment */ off = ntohs(ip->ip_off); if((off & 0x1fff) == 0 )/* aka no 1's in first 13 bits */ {/* print SOURCE DESTINATION hlen version len offset */ fprintf(stdout,"IP Source: %s\n", inet_ntoa(ip->ip_src)); fprintf(stdout,"IP Dest: %s, hlen: %d, version: %d, len: %d, off %d\n", inet_ntoa(ip->ip_dst), hlen,version,len,off); } close(pfd[2]); break; } return NULL; } u_int16_t handle_ethernet(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char *packet) { struct ether_header *eptr; eptr = (struct ether_header *) packet; printf("Adresse Ethernet source: %s\n",ether_ntoa(eptr->ether_shost)); printf("Adresse Ethernet destination: %s\n",ether_ntoa(eptr->ether_dhost)); /* check to see if we have an ip packet */ if (ntohs (eptr->ether_type) == ETHERTYPE_IP) { handle_IP(args,pkthdr,packet); } else if (ntohs (eptr->ether_type) == ETHERTYPE_ARP) { printf("Paquet reçu: (ARP)\n"); } else if (ntohs (eptr->ether_type) == ETHERTYPE_REVARP) { printf("Paquet reçu: (RARP)\n"); } else { printf("(?)\n"); return(1); } printf("\n"); return eptr->ether_type; } int main(int argc, char **argv) { if(argc <= 2) { printf("Utilisation: libpcap [ interface ] [ port ]\n"); printf("Met en ecoute d'un port.\n"); printf("Exemple: libpcap eth0 80\n"); return(-1); } interface = argv[1]; port = argv[2]; if (signal (SIGINT, gestion_sigint) == SIG_ERR) fprintf (stderr, "Probleme d'interception SIGINT\n"); if((pdes = pcap_open_live( interface, SNAP_LEN, IFF_PROMISC, 1000, err_buff)) == NULL) { printf("Erreur, pcap_open_live: %s\n", err_buff); return(-1); } temp=calloc(strlen(filter)+strlen(port)+1, 1); sprintf(temp, "%s%s", filter, port); printf("filtres: %s\n", temp); filter = temp; printf("Ecoute de l'interface: %s, port: %s\n", interface, port); //Mise en place d'un masque if( pcap_lookupnet( interface, &netp, &maskp, err_buff ) ==-1 ) { printf("Erreur, pcap_lookupnet: %s\n", err_buff); } //mise en place du filtre if( pcap_compile( pdes, &bp, filter, 0x100, maskp ) < 0 ) { printf("Erreur, pcap_compile: %s\n", pcap_geterr(pdes)); return(-1); } //on applique le filtre if( pcap_setfilter(pdes, &bp) < 0 ) { printf("Erreur, pcap_setfilter: %s", pcap_geterr(pdes)); return(-1); } //Et on sniffe enfin :-) ( -1 boucle infini ) if( pcap_loop( pdes, -1, (pcap_handler)callback, buff) <0 ) { printf("Erreur, pcap_loop: %s", pcap_geterr(pdes)); return(-1); } pcap_close(pdes); free(temp); return(0); }