CODEWITHSUNDEEP
clinuxlibpcap
user1944267
user1944267

Reputation: 1637

why the ethernet and ip header of packets, which are captured by libpcap function, are distorted

I used libpcap function pcap_next() to capture some tcp packets from other hosts I checked the bytes of the captured packets and notice that the ethernet and ip header of packets are distorted, in a mess with a lot 0's but the TCP header is fine

what are potential reasons for this?

codes:

pcap_t* create_pcap_handler()
{
    pcap_t *handle;                 /* Session handle */
    char *dev;                      /* The device to sniff on */
    char errbuf[PCAP_ERRBUF_SIZE];  /* Error string */
    struct bpf_program fp;          /* The compiled filter */
    char filter_exp[] = "port 32000";  /* The filter expression */
    bpf_u_int32 mask;               /* Our netmask */
    bpf_u_int32 net;                /* Our IP subnet*/

    /* Define the device */
    dev = pcap_lookupdev(errbuf);
    if (dev == NULL) {
            fprintf(stderr, "Couldn't find default device: %s\n", errbuf);
            exit(2);
    }
    /* Find the properties for the device */
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
            fprintf(stderr, "Couldn't get netmask for device %s: %s\n", dev, errbuf);
            net = 0;
            mask = 0;
    }

    struct in_addr tmp;
    tmp.s_addr=net;
    char IPdotdec[20];
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16);
    printf("net is %s\n", IPdotdec);
    tmp.s_addr=mask;
    inet_ntop(AF_INET, (void *)&tmp, IPdotdec, 16);
    printf("mask is %s\n", IPdotdec);
    printf("dev is %s\n",dev);

    handle = pcap_open_live(dev, BUFSIZ, 0, 0, errbuf);
    if (handle == NULL) {
            fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
            exit(2) ;
    }
    /* Compile and apply the filter */
    if (pcap_compile(handle, &fp, filter_exp, 0, mask) == -1) {
            fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
            exit(2);
    }
    if (pcap_setfilter(handle, &fp) == -1) {
            fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
            exit(2);
    }

    return handle;
}

and the main function

int main()
{
    pcap_t * pcap_handler=create_pcap_handler();
    struct pcap_pkthdr pcap_header;      /* The header that pcap gives us */
    const u_char *pcap_packet;           /* The actual packet */
    pcap_packet = pcap_next(pcap_handler, &pcap_header);
    if(pcap_packet !=NULL)
            printf("capture one packet with length of %d\n", pcap_header.len);
    pcap_close(pcap_handler);


    return 0;
}

Upvotes: 1

Views: 393

Answers (1)

user862787
user862787

Reputation: 

pcap_packet = pcap_next(pcap_handler, &pcap_header);
if(pcap_packet !=NULL)
        printf("capture one packet with length of %d\n", pcap_header.len);
pcap_close(pcap_handler);
parse_pkt(pcap_packet,pcap_header.len);

That's not going to work.

When you close pcap_handler, there is no guarantee that any pointer returned by a call to pcap_next() or pcap_next_ex() with pcap_handler will continue to be valid.

Try

pcap_packet = pcap_next(pcap_handler, &pcap_header);
if(pcap_packet !=NULL)
        printf("capture one packet with length of %d\n", pcap_header.len);
parse_pkt(pcap_packet,pcap_header.len);
pcap_close(pcap_handler);

instead.

Upvotes: 1

Related Questions