<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<META content="MSHTML 6.00.5346.5" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Verdana><FONT size=2>Hello,could you help me for this code?I'll
be crazy!!It workd yesterday noon.</FONT></FONT></DIV>
<DIV><FONT face=Verdana><FONT size=2>But in afternoon,I did some change,it can't
capture any IP Protocol packets.</FONT></FONT></DIV>
<DIV><FONT face=Verdana><FONT size=2>I don't know if I did the wrong judge at
decoding ethernet packets.when it run,</FONT></FONT></DIV>
<DIV><FONT face=Verdana size=2>the protocol number is very strange.</FONT></DIV>
<DIV><FONT face=Verdana size=2></FONT> </DIV>
<DIV><FONT face=Verdana size=2>you can also see <A
href="http://www.icylife.net/simple_capture.cpp">http://www.icylife.net/simple_capture.cpp</A></FONT></DIV>
<DIV><FONT face=Verdana size=2></FONT> </DIV>
<DIV>#include <stdio.h><BR>#include <winsock2.h><BR>#include
<iphlpapi.h><BR>#include "../WpdPack/Include/packet32.h"</DIV>
<DIV> </DIV>
<DIV>#define DEBUG</DIV>
<DIV> </DIV>
<DIV>#define
ETH_IP 0x0800 //IP
Protocol<BR>#define
ETH_ARP 0x0806 //ARP
Protocol</DIV>
<DIV> </DIV>
<DIV>#define TERMINAL_PORT 3389<BR>#define MAX_ADAPTER_NUM
10
//number of network adapter </DIV>
<DIV> </DIV>
<DIV>#define NDIS_PACKET_TYPE_PROMISCUOUS 0x0020 //promiscuous
mode</DIV>
<DIV> </DIV>
<DIV>typedef struct
ethdr //ethernet
packet<BR>{<BR> unsigned char
eth_dst[16]; //mac address of destination
host<BR> unsigned char
eth_src[16]; //mac address of source
host<BR> unsigned short
eth_type; //ethernet type<BR>}ETH_HDR;</DIV>
<DIV> </DIV>
<DIV>typedef struct iphdr //IP
packet<BR>{<BR> unsigned char
h_lenver; //4 bytes Version,4 bytes IP header
length <BR> unsigned char
tos; //8 bytes
TOS<BR> unsigned short total_len; //16
bytes total length<BR> unsigned short
ident; //16 bytes
Identification<BR> unsigned short
frag_and_flags; //3 bytes flag<BR> unsigned
char ttl; //8 bytes
TTL<BR> unsigned char
protocol; //8 bytes protocol(TCP, UDP or
other)<BR> unsigned short checksum; //16
bytes IP header checksum<BR> unsigned int
sourceip; //32 bytes source IP
address<BR> unsigned int
destip; //32 bytes distination ip
address<BR>}IP_HDR;</DIV>
<DIV> </DIV>
<DIV>typedef struct tcp_hdr //TCP
header<BR>{<BR>
USHORT th_sport; //16 source
port<BR>
USHORT th_dport; //16
distination port<BR> unsigned int
th_seq; //32 bytes sequence
number<BR> unsigned int
th_ack; //32 bytes acknowledgment
number<BR> unsigned
char th_lenres; //4 bytes header length
/ reserved<BR> unsigned
char th_flag; //6 bytes
flag<BR>
USHORT th_win; //16
bytes window <BR>
USHORT th_sum; //16
bytes checksum<BR>
USHORT th_urp; //16
bytes data offset<BR>}TCP_HDR;</DIV>
<DIV> </DIV>
<DIV>int main( )<BR>{<BR>
<BR> PIP_ADAPTER_INFO pAdapterInfo;<BR> <BR>
pAdapterInfo = (IP_ADAPTER_INFO *)malloc( sizeof(IP_ADAPTER_INFO)
);<BR> ULONG ulOutBufLen = sizeof(IP_ADAPTER_INFO);<BR>
<BR> //Get the buffer<BR> if( GetAdaptersInfo(
pAdapterInfo, &ulOutBufLen) == ERROR_BUFFER_OVERFLOW
)<BR> {<BR> free(pAdapterInfo);<BR> pAdapterInfo =
(IP_ADAPTER_INFO *) malloc (ulOutBufLen);<BR> }</DIV>
<DIV> </DIV>
<DIV> //Get network adapter information<BR> int ret = 0;<BR> if(
(ret = GetAdaptersInfo( pAdapterInfo, &ulOutBufLen)) == NO_ERROR
)<BR> {<BR> #ifdef
DEBUG<BR> <BR> PIP_ADAPTER_INFO pAdapter =
pAdapterInfo;</DIV>
<DIV> </DIV>
<DIV> int i =
1;<BR> <BR> while(pAdapter)<BR> {<BR> printf(
"MAC%d\n", i++ );<BR> printf( "Adapter Name: \t%s\n",
pAdapter->AdapterName );<BR> printf( "Adapter Desc:
\t%s\n", pAdapter->Description );<BR> printf( "Adapter
Addr: \t%ld\n", pAdapter->Address );<BR> printf( "IP
Address: \t%s\n", pAdapter->IpAddressList.IpAddress.String
);<BR> <BR> pAdapter =
pAdapter->Next;<BR> }</DIV>
<DIV> </DIV>
<DIV> #endif<BR> }<BR> else<BR> {<BR> printf(
"GetAdaptersInfo error: %d\n", GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }<BR> <BR> char
openName[128] = "<A
href="file://\\Device\\NPF">\\Device\\NPF</A>_";<BR>
<BR> //if the adapter is wrong,please change pAdapterInfo->AdapterName
to pAdapterInfo->Next->AdapterName <BR> //or more Next,
^_^<BR> strcat( openName, pAdapterInfo->AdapterName
);<BR> <BR> #ifdef DEBUG<BR> printf( "Will
open£º%s\n", openName );<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //Open adapter<BR> LPADAPTER hAdapter =
PacketOpenAdapter( openName );</DIV>
<DIV> </DIV>
<DIV> if( !hAdapter || ( hAdapter->hFile == INVALID_HANDLE_VALUE )
)<BR> {<BR> printf( "PacketOpenAdapter error: %d\n",
GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }<BR> <BR> #ifdef
DEBUG<BR> printf( "PacketOpenAdapter successful\n"
);<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //set promiscuous type<BR> if( PacketSetHwFilter( hAdapter,
NDIS_PACKET_TYPE_PROMISCUOUS ) == FALSE )<BR> {<BR> printf(
"PacketSetHwFilter promiscuous error: %d\n", GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }<BR> <BR> #ifdef
DEBUG<BR> printf( "PacketSetHwFilter promiscuous successful\n"
);<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //set the size of buffer<BR> if( PacketSetBuff( hAdapter,
600*1024 ) == FALSE )<BR> {<BR> printf( "PacketSetBuff error:
%d\n", GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }</DIV>
<DIV> </DIV>
<DIV> #ifdef DEBUG<BR> printf( "PacketSetBuff successful\n"
);<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //set time out<BR> if( PacketSetReadTimeout( hAdapter, 1) ==
FALSE )<BR> {<BR> printf("PacketSetReadTimeout error: %d\n",
GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }</DIV>
<DIV> </DIV>
<DIV> #ifdef DEBUG<BR> printf( "PacketSetReadTimeout
successful\n" );<BR> #endif</DIV>
<DIV> </DIV>
<DIV> LPPACKET hPacket;</DIV>
<DIV> </DIV>
<DIV> if( (hPacket = PacketAllocatePacket()) == FALSE
)<BR> {<BR> printf( "PacketAllocatePacket error: %d\n",
GetLastError() );</DIV>
<DIV> </DIV>
<DIV> return -1;<BR> }<BR> <BR> #ifdef
DEBUG<BR> printf( "PacketAllocatePackesuccessful\n"
);<BR> #endif</DIV>
<DIV> </DIV>
<DIV> char recvBuff[1024 * 500] = { 0 };</DIV>
<DIV> </DIV>
<DIV> //init<BR> PacketInitPacket( hPacket, (char *)recvBuff,
sizeof(recvBuff) );</DIV>
<DIV> </DIV>
<DIV> ETH_HDR *ethr;<BR> IP_HDR *ipr;<BR> TCP_HDR *tcpr;</DIV>
<DIV> </DIV>
<DIV> int bytesReceived; //bytes of
received<BR> char *pBuff; //buffer
of
data<BR> int off; //offset<BR> struct bpf_hdr *hdr; //the
structure of
packet<BR> char *pchar; //the
real data!!</DIV>
<DIV> </DIV>
<DIV> while( 1 )<BR> {<BR> //recevie
data<BR> if( PacketReceivePacket( hAdapter,hPacket,TRUE ) == FALSE
)<BR> {<BR> break;
<BR> }<BR> <BR> //received
length<BR> bytesReceived =
hPacket->ulBytesReceived;<BR>
<BR> //data<BR> pBuff = (char
*)hPacket->Buffer;</DIV>
<DIV> </DIV>
<DIV> off = 0;</DIV>
<DIV> </DIV>
<DIV> //real data's structure
|bpf_hdr|data|Padding|bpf_hdr|data|Padding|<BR>
while( off < bytesReceived
)<BR> {<BR> //change
type<BR> hdr = (struct bpf_hdr *)( pBuff+off
);</DIV>
<DIV> </DIV>
<DIV> //hdr->bh_hdrlen is the length of recevied
packet<BR> off +=
hdr->bh_hdrlen;<BR> <BR> #ifdef
DEBUG<BR> printf( "\nlength of packet header£º%d\n",
hdr->bh_hdrlen );<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //jump to real
data<BR> pchar = (char *)( pBuff+off
);</DIV>
<DIV> </DIV>
<DIV> #ifdef DEBUG<BR> printf( "length
of data£º%d\n", strlen(pchar) );<BR> #endif</DIV>
<DIV> </DIV>
<DIV> //jump to next packet<BR>
off = Packet_WORDALIGN(off+hdr->bh_caplen);</DIV>
<DIV> </DIV>
<DIV> //get ethernet header<BR>
ethr = (ETH_HDR *)pchar;<BR>
<BR> #ifdef DEBUG<BR> printf(
"Protocol£º%04x\n", ntohs(ethr->eth_type)
);<BR> printf( "Source
MAC£º%02x:%02x:%02x:%02x:%02x:%02x\n",
*(ethr->eth_src),*(ethr->eth_src+1),*(ethr->eth_src+2),*(ethr->eth_src+3),*(ethr->eth_src+4),*(ethr->eth_src+5)
);<BR> printf( "Destination
MAC£º%02x:%02x:%02x:%02x:%02x:%02x\n",
*(ethr->eth_dst),*(ethr->eth_dst+1),*(ethr->eth_dst+2),*(ethr->eth_dst+3),*(ethr->eth_dst+4),*(ethr->eth_dst+5)
);<BR>
#endif</DIV>
<DIV> </DIV>
<DIV> //if IP
Protocol<BR> if( ethr->eth_type ==
htons(ETH_IP)
)<BR> {<BR>
#ifdef DEBUG<BR> printf( "recevied IP packet\n"
);<BR>
#endif<BR>
<BR> //get ip header<BR>
ipr = (IP_HDR *)(pchar+sizeof(ETH_HDR));</DIV>
<DIV> </DIV>
<DIV> if( ipr->protocol == IPPROTO_TCP
)<BR> {<BR>
printf( "recevied TCP packet\n"
);<BR>
<BR> tcpr = (TCP_HDR *)(
pchar+sizeof(ETH_HDR)+sizeof(IP_HDR) );</DIV>
<DIV> </DIV>
<DIV> if( tcpr->th_dport == htons(TERMINAL_PORT)
)<BR> {<BR> #ifdef
DEBUG<BR> printf( "recevied 3389
packet\n"
);<BR> #endif<BR> <BR> printf(
"MAC£º%s\n", ethr->eth_src );<BR> printf(
"MAC£º%s\n", ethr->eth_dst );<BR> printf(
"IP£º%d\n", ipr->sourceip
);<BR> }<BR> }<BR> }<BR> else
if( ethr->eth_type == htons(ETH_ARP)
)<BR> {<BR>
#ifdef DEBUG<BR> printf( "recevied ARP packet\n"
);<BR>
#endif<BR> }<BR> }<BR> }</DIV>
<DIV> </DIV>
<DIV> return 0;<BR>}<BR><BR></DIV>
<DIV><FONT face=Verdana size=2></FONT> </DIV>
<DIV align=left><FONT face=Verdana size=2>
<HR style="WIDTH: 122px; HEIGHT: 2px" SIZE=2>
</FONT></DIV>
<DIV><FONT color=#c0c0c0><FONT face=Verdana
size=2>yunshu@ph4nt0m.org</FONT></DIV>
<DIV><FONT face=Verdana size=2>2006-05-25</FONT></FONT></DIV></BODY></HTML>