an body von tcp-packet kommen...

[Flas]

hallo, ich eier schon längere zeit mit nem kleinen sniffer rum, er soll die gefilterten packete auf das "PUSH" flag prüfen und dann (da es ja data enthält) die daten anzeigen, das heisst bei ner browser abfrage halt:

"GET / HTTP/1.1\r\n
...

aber eben dieses anzeigen klappt bis dato nicht, desshalb wollt ich mal fragen ob einem von euch was dazu einfällt, denn google und zahlreiche irc channels konnten mir nicht helfen:

// mit "-lpcap" compilen

#include <pcap.h>
#include <stdio.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#if !defined(__NetBSD__) || !defined(__OpenBSD__)
 #include <net/ethernet.h>
#else
 #include <netinet/if_ether.h>
 #include <netinet/in.h>
#endif

#include <sys/types.h>    /* \                                 */
#include <sys/socket.h>   /*  > for inet_ntop and its friends. */
#include <arpa/inet.h>    /* /                                 */

void my_callback(u_char*,const struct pcap_pkthdr*,const u_char*);

int main() {
    pcap_t *descr;                        /* Session handle */
    char dev[] = "rl0";                                /* The device to sniff on */
    char f[] = "tcp dst port 80";
    char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
    struct pcap_pkthdr header;          /* The header that pcap gives us */
    const u_char *packet;                 /* The actual packet */
    struct bpf_program fp;      /* hold compiled program     */
    bpf_u_int32 maskp;          /* subnet mask               */
    bpf_u_int32 netp;           /* ip                        */

    pcap_lookupnet(dev,&netp,&maskp,errbuf);
    
    if((descr = pcap_open_live(dev, BUFSIZ, 1, 1, errbuf)) == NULL) {
        perror("[-] pcap_open_live() failed");
        return 1;
    }

    if(pcap_compile(descr,&fp,f,0,netp) == -1) {
        perror("[-] pcap_compile() failed");
        return 2;
    }
    
    if(pcap_setfilter(descr,&fp) == -1) {
        perror("[-] pcap_setfilter() failed");
        return 3;
    }
    
    printf("starting sniffing...\n");

    pcap_loop(descr,0,my_callback,NULL);
    
    printf("finished sniffing\n");
    
    pcap_close(descr);
    return 0;
}

void my_callback(u_char *useless,const struct pcap_pkthdr* header,const u_char* packet) {
    static int count = 1;
    struct ip* ip_hdr;          
    struct tcphdr* tcp_hdr;        
    char src_ip[100], dst_ip[100];
    int src_port, dst_port;

    ip_hdr = (struct ip*) (packet + sizeof(struct ether_header));  

    inet_ntop(AF_INET, &ip_hdr->ip_src, src_ip, sizeof(src_ip));
    inet_ntop(AF_INET, &ip_hdr->ip_dst, dst_ip, sizeof(dst_ip));

    tcp_hdr = (struct tcphdr*)(packet + ip_hdr->ip_hl * 4 + sizeof(struct ether_header));
    src_port = ntohs(tcp_hdr->th_sport);  
    dst_port = ntohs(tcp_hdr->th_dport);

    printf("src %s:%d -> dst %s:%d\n",src_ip, src_port, dst_ip, dst_port);

//das:
    if(tcp_hdr->th_flags & TH_PUSH) {
        char *data = (char*) (packet + sizeof(tcp_hdr) + ip_hdr->ip_hl * 4 + sizeof(struct ether_header) );
        printf("\ndata:\n%s\n\n",data);
    }
//kommt nur mist
    
    count++;
}

mfg und danke, flas!

 

[DJF]

Dein pointer auf data zeigt auf die falsche Adresse:
Wenn ich anstatt *data = (char*) (packet + sizeof(tcp_hdr) + ip_hdr->ip_hl * 4 + sizeof(struct ether_header),
char *data = (char*) (packet + sizeof(struct tcphdr) + sizeof(struct ip)+ sizeof(struct ether_header) );
schreibe klappt's bei mir ohne Probleme.
Das ip_hdr->ip_hl * 4 kam mir sowieso Spanisch vor. Gibt's einen tieferen Grund die ip_hl mit 4 zu multiplizeren?

// mit "-lpcap" compilen

#include <pcap.h>
#include <stdio.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#if !defined(__NetBSD__) || !defined(__OpenBSD__)
 #include <net/ethernet.h>
#else
 #include <netinet/if_ether.h>
 #include <netinet/in.h>
#endif

#include <sys/types.h>    /* \                                 */
#include <sys/socket.h>   /*  > for inet_ntop and its friends. */
#include <arpa/inet.h>    /* /                                 */

void my_callback(u_char*,const struct pcap_pkthdr*,const u_char*);

int main() {
    pcap_t *descr;                        /* Session handle */
    char dev[] = "rl0";                                /* The device to sniff on */
    char f[] = "tcp dst port 80";
    char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
    struct pcap_pkthdr header;          /* The header that pcap gives us */
    const u_char *packet;                 /* The actual packet */
    struct bpf_program fp;      /* hold compiled program     */
    bpf_u_int32 maskp;          /* subnet mask               */
    bpf_u_int32 netp;           /* ip                        */

    pcap_lookupnet(dev,&netp,&maskp,errbuf);
    
    if((descr = pcap_open_live(dev, BUFSIZ, 1, 1, errbuf)) == NULL) {
        perror("[-] pcap_open_live() failed");
        return 1;
    }

    if(pcap_compile(descr,&fp,f,0,netp) == -1) {
        perror("[-] pcap_compile() failed");
        return 2;
    }
    
    if(pcap_setfilter(descr,&fp) == -1) {
        perror("[-] pcap_setfilter() failed");
        return 3;
    }
    
    printf("starting sniffing...\n");

    pcap_loop(descr,0,my_callback,NULL);
    
    printf("finished sniffing\n");
    
    pcap_close(descr);
    return 0;
}

void my_callback(u_char *useless,const struct pcap_pkthdr* header,const u_char* packet) {
    static int count = 1;
    struct ip* ip_hdr;          
    struct tcphdr* tcp_hdr;        
    char src_ip[100], dst_ip[100];
    int src_port, dst_port;

    ip_hdr = (struct ip*) (packet + sizeof(struct ether_header));  

    inet_ntop(AF_INET, &ip_hdr->ip_src, src_ip, sizeof(src_ip));
    inet_ntop(AF_INET, &ip_hdr->ip_dst, dst_ip, sizeof(dst_ip));

    tcp_hdr = (struct tcphdr*)(packet + ip_hdr->ip_hl * 4 + sizeof(struct ether_header));
    src_port = ntohs(tcp_hdr->th_sport);  
    dst_port = ntohs(tcp_hdr->th_dport);

    printf("src %s:%d -> dst %s:%d\n",src_ip, src_port, dst_ip, dst_port);


    if(tcp_hdr->th_flags & TH_PUSH) {
        
    char *data = (char*) (packet +
                        sizeof(struct tcphdr) +
                        sizeof(struct ip)+
                        sizeof(struct ether_header) );

        printf("\ndata:\n%s\n\n",data);
    }
    
    count++;
}

Wenn ichs laufen lasse krieg ich das:

data:
GET / HTTP/1.1
Host: www.asdf.com
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.6) Gecko/20050409
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.google.ch/search?hl=de&q=asdf&btnG=Google-Suche&meta=
X-Moz: prefetch

Hoffe das hilft Dir weiter.

MfG dave

 

[Flas]

okay, danke erstmal das mit der 4 fachen ip struct kam von jemandem aus dem irc, bessergesagt von einem link den ich nun nicht mehr finde, es kam mir auch komisch vor, ich werd da noch mal bissel sauber machen, danke dir

mfg, flas