一個簡單的抓ARP包程式分析

##########################################################################

2014-02-10

參考網上找到的執行個體編譯一個簡單的抓取arp包并從中提取顯示源、目的mac、ip位址的代碼時遇到出錯

源代碼如下(這部分直接複的就不排版了，将就看一下)：

#include <pcap.h> 
#include <stdlib.h>
#include <string.h>
//ARP Header, (assuming Ethernet+ipv4)
#define ARP_REQUEST 1
#define ARP_REPLY 2
typedef struct arphdr{
u_int16_t htype; //hardware type
u_int16_t ptype; //protocol type
u_char hlen;   //hardware address length
u_char plen;   //protocol address length
u_int16_t oper;  //operation code
u_char sha[6];    //sender hardware address
u_char spa[4];    //sender ip address
u_char tha[6];    //target hardware address
u_char tpa[4];    //target ip address
}arphdr_t;
#define MAXBYTES2CAPTURE 2048
int main(int argc, char *argv[])
{
int i=0;
bpf_u_int32 netaddr=0, mask=0;
struct bpf_program filter;
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *descr = NULL;
struct pcap_pkthdr pkthdr;
const unsigned char *packet = NULL;
arphdr_t *arpheader = NULL;
memset(errbuf, 0, PCAP_ERRBUF_SIZE);
if (argc != 2){
printf("Usage: arpsniffer <interface> \n");
exit(1);
} 
descr = pcap_open_live(argv[1], MAXBYTES2CAPTURE, 0,
512, errbuf); 
pcap_lookupnet(argv[1], &netaddr, &mask, errbuf);
pcap_compile(descr, &filter, "arp", 1, mask);
pcap_setfilter(descr, &filter);
while (1){
packet = pcap_next(descr, &pkthdr);
arpheader = (struct arphdr *)(packet + 14)
printf("\n\nReceived Packet Size: %d bytes\n",pkthdr->len);
printf("Hardware type: %s\n", (ntohs(arpheader->htype) == 1)?"Ethernet" : "Unknown");
printf("Protocol type: %s\n", (ntohs(arpheader->ptype) == 0x0800) ? "Ethernet" : "Unknown");
printf("Operation: %s\n", (ntohs(arpheader->oper) == ARP_REQUEST) ?"ARP Request" : "ARP Reply");
if (ntohs(arpheader->htype) == 1 && ntohs(arpheader->ptype) == 0x0800)
{
printf("Sender MAC: ");
for (i=0; i<6; i++)printf("%02x:", arpheader->sha[i]);
printf("\nSender IP: ");
for (i=0; i<4; i++)printf("%d.", arpheader ->spa[i]);
printf("\nTarget MAC: ");
for (i=0; i<6; i++)printf("%02x:", arpheader->tha[i]);
printf("\nTarget IP: ");
for (i=0; i<4; i++)printf("%d.", arpheader ->tpa[i]);
printf("\n");
}
}
return 0;
}
           

第一次編譯不通過，由錯誤資訊可以找到，pkthdr應該是一個對象而不是指針，是以上面

printf("\n\nReceived Packet Size: %d bytes\n",pkthdr->len);

一行應該改為：

printf("\n\nReceived Packet Size: %d bytes\n",pkthdr.len);

第二次編譯通過，不過在運作時顯示

Segmentation fault (core dumped)

經調試，packet在調用了packet_next()函數後得到的傳回值是NULL。

這次的問題出在了pcap_open_live()函數的參數to_ms中，由于被設成了512，而通過man pacp_next可以看到pcap_next() reads the next packet (by calling pcap_dispatch() with the cnt of 1)，可以看出pcap_next()函數實際上是調用了pcap_dispatch()函數，并令其cnt參數為1，但是在pcap_dispatch()函數中需要有回調函數的函數指針作為參數，個人認為是在pcap_next()裡又再定義了一個作為處理包的回調函數，沒翻過代碼，純屬猜測，而pcap_dispatch()函數是受到逾時值限制的，是以當512ms過去後仍沒有抓到arp包，pcap_dispatch()函數就傳回，其定義并傳入回調函數中的pcap_pkthdr結構體也無法得到填充，而使用者定義的通過pcap_next()函數傳入的pcap_pkthdr結構體也自然沒有得到初始化，此時再對其成員進行引用，就會出現段錯誤了。

解決方法是将to_ms參數值設定為0，這樣就會一直阻塞直到抓到arp包。

最後，其實第二次調試時還犯了一個錯誤，直接定義了一個pcap_pkthdr結構體的指針并把它傳給了pcap_next()函數，理論上是沒錯的，但是實際上我定義的這個指針并沒有配置設定到實際的記憶體，到真正抓到包要對其成員指派時，就又出現段錯誤了，兩個錯誤混在一起足足弄了我半天。引以為戒啊。

附上最後的代碼：

#include <pcap.h>
#include <stdlib.h>
#include <string.h>

#define ARP_REQUEST 1
#define ARP_REPLY 2
#define MAXBYTES2CAPTURE 2048

typedef struct arphdr
{
	u_int16_t htype;
	u_int16_t ptype;
	u_char hlen;
	u_char plen;
	u_int16_t oper;
	u_char sha[6];
	u_char spa[4];
	u_char tha[6];
	u_char tpa[4];
}arphdr_t;

int main()
{
	int i=0;
	char *dev;
	bpf_u_int32 netaddr=0,mask=0;
	struct bpf_program filter;
	char errbuf[PCAP_ERRBUF_SIZE];
	pcap_t *descr;
	struct pcap_pkthdr pkthdr;
	const unsigned char *packet;
	arphdr_t *arpheader=NULL;
	memset(errbuf, 0, PCAP_ERRBUF_SIZE);
	if((dev=pcap_lookupdev(errbuf)) == NULL)
	{
		printf("pcap_lookupdev(): %s\n",errbuf);
		exit(1);
	}
	else
		printf("found device: %s\n",dev);
	if((descr=pcap_open_live(dev, MAXBYTES2CAPTURE, 1, 0, errbuf)) == NULL)
	{
		printf("pcap_open_live(): %s\n",errbuf);
		exit(1);
	}
	else
		printf("Open device success\n");
	if((i=pcap_lookupnet(dev, &netaddr, &mask, errbuf)) == -1)
	{
		printf("pcap_lookupnet(): %s\n",errbuf);
		exit(1);
	}
	else
		printf("Lookupnet success\n");
	i=0;
	if((i=pcap_compile(descr, &filter, "arp", 1, mask)) == -1)
	{
		printf("Compile error\n");
		exit(1);
	}
	else
		printf("Compile success\n");
	i=0;
	if((i=pcap_setfilter(descr, &filter)) == -1)
	{
		printf("Setfilter error\n");
		exit(1);
	}
	else
		printf("Setfilter success\n");
	while(1)
	{
		if((packet=pcap_next(descr, &pkthdr)) == NULL)
		{
			printf("pcap_next() error\n");
			exit(1);
		}
		printf("Received Packet Size: %d bytes\n",pkthdr.len);
		arpheader=(struct arphdr *)(packet+14);
		printf("Hardware type: %s\n",(ntohs(arpheader->htype) == 1)?"Ethernet":"Unknown");
		printf("Protocol type: %s\n",(ntohs(arpheader->ptype) == 0x0800)?"Ethernet":"Unknown");
		printf("Operation: %s\n",(ntohs(arpheader->oper) == ARP_REQUEST)?"ARP Request":"ARP Reply");
		if(ntohs(arpheader->htype) == 1 && ntohs(arpheader->ptype) == 0x0800)
		{
			printf("Sender MAC: ");
			for(i=0; i<6; i++)
				printf("%02x:",arpheader->sha[i]);
			printf("\nSender IP: ");
			for(i=0; i<4; i++)
				printf("%d.",arpheader->spa[i]);
			printf("\nTarget MAC: ");
			for(i=0; i<6; i++)
				printf("%02x:",arpheader->tha[i]);
			printf("\nTarget IP: ");
			for(i=0; i<4; i++)
				printf("%d.",arpheader->tpa[i]);
			printf("\n");
		}
	}
	return 0;
}