CODEWITHSUNDEEP
c++parsingpacketlibpcap
user515766
user515766

Reputation: 369

How can I parse an ethernet packet using libpcap?

I'm using libpcap in C++ for reading packets from pcap files, e.g.:

rc = pcap_next_ex((pcap_t*)handle, &header, (const unsigned char**)packet);

I would like to parse the packets header (without the payload).

For example, how can I parse a given packet in order to extract its source and destintation ip addresses?

thanks

Upvotes: 7

Views: 15443

Answers (2)

Ioannis Pappas
Ioannis Pappas

Reputation: 817

Checkout the code sample for libpcap http://www.tcpdump.org/pcap.html

In the got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet); function you have a pointer *packet that points to the start of the packet. For parsing the ethernet headers you just need to use the corresponding pointer

ethernet = (struct sniff_ethernet*)(packet);

For IP layer

ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);

If you want to parse other protocols, you just need to define your own structures. If you want (or do not want) to parse the payload then you can (or not) define a pointer to the start of the payload.

Upvotes: 6

cpx
cpx

Reputation: 17577

The data fields of IP headers are packed in big-endian order and the packet payload is attached right after at the end of IP header. see an example here

Upvotes: 2

Related Questions