libpcap 개발 정리

**pc에서 보셔야 잘보임니다...

libpcap 개발 정리
http://webdizen.new21.net/blog/tag/libpcap?TSSESSIONwwwwebdizennet=28ec2c8a6e6437f57135341e774b80fd

 libpcap 노광민 정리
http://kldp.org/KoreanDoc/Libpcap-KLDP

 --- sample code - 장경칩 일부 수정
Linux Fedora_191 2.6.21-1.3194.fc7 
 gcc -o test2 test2.c -lpcap

 THE CODE :  

#include <stdio.h> #include <stdlib.h> #include <pcap.h> #include <errno.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netinet/if_ether.h> #include <linux/ip.h> #include <linux/icmp.h> #include <net/ethernet.h> #include <netinet/tcp.h> #include <netinet/udp.h> #include <arpa/inet.h> #include <netinet/ip6.h> typedef unsigned char uchar; void my_callback(u_char *notused,const struct pcap_pkthdr *pkthdr,const u_char* packet) { int i; struct ether_header *eptr; struct iphdr *ipptr; struct icmphdr *icmpptr; uchar *ptr; if (packet == NULL) { printf("Didn't grab packet\n"); exit(1); } printf("Grabbed packet of length %d\n",pkthdr->len); // printf("Recieved at ..... %s\n",ctime((const time_t*)&pkthdr->ts.tv_sec)); printf("Ethernet address length is %d\n",ETHER_HDR_LEN); eptr = (struct ether_header *) packet; if (ntohs (eptr->ether_type) == ETHERTYPE_IP) { printf("Ethernet type is an IP packet\n"); ipptr = (struct iphdr *) (eptr + 1); if (ipptr->protocol == 1) { icmpptr = (struct icmphdr *) (ipptr + 1); if (icmpptr->code == 16) printf("THIS IS A MOBILE IP ADVERTISEMENT PACKET\n"); } }else if (ntohs (eptr->ether_type) == ETHERTYPE_ARP) { printf("Ethernet type is an ARP packet\n"); }else { printf("Ethernet type is someother Packet"); } ptr = eptr->ether_dhost; i = ETHER_ADDR_LEN; printf(" Destination Address: "); do{ printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++); }while(--i>0); printf("\n"); ptr = eptr->ether_shost; i = ETHER_ADDR_LEN; printf(" Source Address: "); do{ printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++); }while(--i>0); printf("\n"); } int main(int argc, char **argv) { int i,count = 20; char *dev="eth0"; /* (or "eth1" or "any or NULL") */ char errbuf[PCAP_ERRBUF_SIZE]; pcap_t* descr; const u_char *packet; descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf); if(descr == NULL) { printf("pcap_open_live(): %s\n",errbuf); exit(1); } pcap_loop(descr,count,my_callback,NULL); return 0; }