CODEWITHSUNDEEP
cpcappacket-sniffers
Dipsankar Maity
Dipsankar Maity

Reputation: 17

packet capture c code doesn't terminate showing number of packets captured

I am learning to write pcap code in c. Below i have written a simple c code to automatically detect a device for snifiing, getting ip and subnet mask, getting link layer headers and filtering traffic and then printing packet size.

Code complies successfully but gets stuck at

Network device found: wlo1

when run. Removing the filter part does print the packet size. And removing the priting packet part; the program complies and runs successfully.

I think i am lacking understanding of filtering part.

I compile using(on linux): gcc program_name -lpcap

Output of the code is: Network device found: wlo1

wlo1 is wlan device

#include <stdio.h>
#include <pcap.h>

int main(int argc, char *argv[]){

    char *dev; //device automatically detected for sniffing
    char errbuf[PCAP_ERRBUF_SIZE]; //error string
    pcap_t *handle; //session hnadle
    struct bpf_program fp;  //The compiled filter expression
    char filter_exp[] = "port 23";  //The filter expression
    bpf_u_int32 mask;   //The netmask of our sniffing device
    bpf_u_int32 net;    //The IP of our sniffing device
    struct pcap_pkthdr header;
    const unsigned char *packet;

    //device detection block
    dev = pcap_lookupdev(errbuf);
    if (dev == NULL){
            printf("Error finding device: %s\n", errbuf);
            return 1;
        }
    printf("Network device found: %s\n", dev);

    //opening device for sniffing
    handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);
    if(handle == NULL){
        fprintf(stderr,"Couldn't open device %s : %s\n",dev,errbuf);
        return 1;
    }

    // //check for link-layer header of the device
    if(pcap_datalink(handle) != DLT_EN10MB){ //for ethernet data link layer
        if(pcap_datalink(handle) != DLT_IEEE802_11){ //for wlan data link layer
            fprintf(stderr, "Device %s doesn't provide WLAN headers - not supported\n", dev);
            return 1;
        }
        else{
            fprintf(stderr, "Device %s doesn't provide Ethernet headers - not supported\n", dev);
            return 1;
        }
    }

    //block to get device ip and subnet mask
    if(pcap_lookupnet(dev, &net, &mask, errbuf) == -1){
        fprintf(stderr, "Can't get netmask for device %s\n", dev);
        net = 0;
        mask = 0;
    }

    //block for filtering traffic we want to sniff
    if(pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
        fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 1;
    }
    if(pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 1;
    }
    /* Grab a packet */
    packet = pcap_next(handle, &header);
    /* Print its length */
    printf("Jacked a packet with length of [%d]\n", header.len);
    /* And close the session */
    pcap_close(handle);
    return 0;
}

Upvotes: 0

Views: 155

Answers (1)

user9065877
user9065877

Reputation: 193

If wlo1 is capturing in monitor mode on a "protected" network (a network with traffic encrypted at the link layer, using WEP or WPA/WPA2/WPA3), then any filter that works above the link layer - such as a TCP/UDP-layer filter, which "port 80" is - will not work, because the packets, as delivered to the filtering code, will have the 802.11 payload encrypted, so filters won't work on them.

Therefore, no packets will pass the filter.

Upvotes: 1

Related Questions