snifferC.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netinet/ip_icmp.h>
#include <netinet/udp.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <arpa/inet.h>

void ProcessPacket(unsigned char* , int);
void print_ip_header(unsigned char* ,int);
void print_tcp_packet(unsigned char*, int);
void print_udp_packet(unsigned char*, int);
void print_icmp_packet(unsigned char*, int);
void PrintData (unsigned char*, int);

int sock_raw;
FILE *logfile;
int tcp=0, udp=0, icmp=0, others=0, igmp=0, total=0, i,j;
struct sockaddr_in source,dest;

int main()
{
	int saddr_size, data_size;
	struct sockaddr saddr;
	struct in_addr in;

	unsigned char *buffer = (unsigned char *)malloc (65536);
	logfile=fopen("log.txt", "w");
	if(logfile==NULL) printf("unable to create file.");

	printf("starting....\n");
	//create a raw socket that shall sniff
	sock_raw = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
	if(sock_raw < 0)
	{
		printf("socket error\n");
		return 1;
	}
	while(1)
	{
		saddr_size = sizeof saddr;
		//receive packet
		data_size = recvfrom(sock_raw, buffer, 65536,0, &saddr, &saddr_size);
		if (data_size <0)
		{
			printf("Recvfrom error, failed to get packet\n");
			return 1
		}
		//process packet
		ProcessPacket(buffer,data_size);
	}
	close(sock_raw);
	printf("Finished");
	return 0;
}
void ProcessPacket (unsigned char* buffer, int size)
{
	//get ip header part of this packet
	struct iphdr *iph = (struct iphdr*)buffer;
	++total;
	switch (iph->protocol) //check protocol 
	{ 
		case 1: //icpm protocol
			++icmp;
			//printIcmpPacket(Buffer,Size);
			break;

		case 2: //igmp protocol
			++igmp;
			break;

		case 6: //tcp protocol
			++tcp;
			print_tcp_packet(buffer, size);
			break;

		case 17: //udp protocol
			++udp;
			print_udp_packet(buffer, size);
			break;
		
		default: //some other protocol
			++others;
			break;
	}

	printf("TCP: %d	UDP: %d ICMP: %d IGMP: %d Others: %d Total: %d\r", tcp,udp,icmp,igmp,others,total);
}

void print_ip_header(unsigned char* Buffer, int Size)
{
	unsigned short iphdrlen;

	struct iphdr *iph = (struct iphdr *)Buffer;
	iphdrlen = iph->ihl*4;

	memset(&source, 0, sizeof(source));
	source.sin_addr.s_addr =iph->saddr;

	memset($dest, 0, sizeof(dest));
	dest.sin_addr.s_addr = iph->daddr;

	fprintf(logfile,"\n");
	fprintf(logfile,"IP Header\n");
	fprintf(logfile,"	|-IP Version		: %d\n",(unsigned int )iph->version);
	fprintf(logfile,"	|-IP Header  length     : %d DWORDS or %d Bytes\n",(unsigned int)iph->ihl,((unsigned int)(iph->ihl))*4);
	fprintf(logfile,"	|-Type of Service       : %d\n", (unsigned int)iph->tos);
	fprintf(logfile,"	|-IP Total Length       : %d Bytes(Size of Packet)\n",ntohs(iph->tot len));
	fprintf(logfile,"	|-Identification        : %d\n", ntohs(iph->id));
	//fprintf(logfile,"	|-Reserved ZERO Field   : %d\n", (unsigned int)iphdr->ip_reserved_zero);
	//fprintf(logfile,"	|-Dont Fragment Field	: %d\n", (unsigned int)iphdr->ip_dont_fragment);
	//fprintf(logfile,"	|-More Fragment Field	: %d\n", (unsigned int)iphdr->ip_more_fragment);
	fprintf(logfile,"	|-TTL		: %d\n", (unsigned int)iph->ttl);
	fprintf(logfile,"	|-Protocol	: %d\n", (unsigned int)iph->protocol);
	fprintf(logfile," 	|-Checksum	: %d\n",ntohs(iph->check));
	fprintf(logfile,"	|-Source IP		: %s\n",inet_ntoa(source.sin_addr));
	fprintf(logfile,"	|-Destination IP	: %s\n",inet_ntoa(dest.sin_addr));
}

void print_tcp_packet(unsigned char* Buffer, int Size)
{
	unsigned short iphdrlen;

	struct iphdr *iph = (struct iphdr *)Buffer;
	iphdrlen = iph->ihl*4;

	struct tcphdr *tcph=(struct tcphdr*)(Buffer + iphdrlen);

	fprintf(logfile,"\n\n**********************TCP PACKET******************\n");
	print_ip_header(Buffer,Size);
	fprintf(logfile,"\n");
	fprintf(logfile,"TCP Header\n");
	fprintf(logfile,"	|-Source Port		: %u\n",ntohs(tcph->source));
	fprintf(logfile,"	|-Destination Port	: %u\n",ntohs(tcph->dest));
	fprintf(logfile,"	|-Sequence Number	: %u\n",ntohl(tcph->seq));
	fprintf(logfile,"	|-Acknowledgement Number: %u\n",ntohl(tcph->seq));
	fprintf(logfile,"	|-Header Length		: %d DWORDS or %d BYTES\n", (unsigned int)tcph->doff,(unsigned int)tcp->doff*4);
	fprintf(logfile,"	|-Urgent Flag		: %d\n",(unsigned:int)tcph->urg);
	fprintf(logfile,"	|-Acknowledgment Flag   : %d\n",(unsigned int)tcph->ack);
	fprintf(logfile,"	|-Push Flag		: %d\n",(unsigned int)tcph->psh);
	fpritnf(logfile,"	|-Reset Flag		: %d\n",(unsigned int)tcph->rst);
	fprintf(logfile,"	|-Synchronise Flag	: %d\n",(unsigned int)tcph->syn);
	fprintf(logfile,"	|-Finish Flag		: %d\n",(unsigned int)tcph->fin);
	fprintf(logfile,"	|-Window		: %d\n",ntohs(tcph->window));
	fprintf(logfile,"	|-Checksum		: %d\n",ntohs(tcph->check));
	fprintf(logfile,"	|-Urgent Pointer	: %d\n",tcph->urg_ptr);
	fprintf(logfile,"\n");
	fprintf(logfile,"	DATA 		DUMP");
	fprintf(logfile,"\n");

	fprintf(logfile,"IP Header\n");
	PrintData(Buffer,iphdrlen);

	fprintf(logfile,"TCP Header\n");
	PrintData(Buffer+iphdrlen,tcph->doff*4);

	fprintf(logfile,"Data Payload\n");
	PrintData(Buffer+iphdrlen+tcph+->doff*4, (Size - tcph->doff*4-iph->ihl*4);
	fprintf(logfile,"\n########");
	}

void PrintData (unsigned char* data, int Size)
{
	for (i=0; i< Size; i++)
	{	
		if(i!=0; && i!==16)
		{
			fprintf(logfile,"	");
			for(j=i-16; j<i; j++)
			{
				if(data[j]>=32 && data[j]<=128)
				fprintf(logfile, "%c",(unsigned char)data[j]);
				else fprintf(logfile,".");
			}
				fprintf(logfile,"\n");
		}
		if(i%16==0) fprintf(logfile,"	");
			fprintf(logfile," %02X"(unsigned int)data[i]);

		if(i==Size-1)
		{
			for(j=0; j<15-i%16;j++) fprintf(logfile,"	");
			fprintf(logfile,"	");

			for(j=i-i%16;j<=i;j++)
			{	
				if(data[j]>=32 && data[j]<=128)fprintf(logfile,"%c",(unsigned char)data[j]);
				else fprintd(logfile,".");
			}
			fprintf(logfile,"\n");
		}