raw socket 编程资料（linux环境）

#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <linux/if_ether.h>
#include <arpa/inet.h>

//定义常量

#define EPT_IP   0x0800    /* type: IP */
#define EPT_ARP   0x0806    /* type: ARP */
#define EPT_RARP 0x8035    /* type: RARP */
#define ARP_HARDWARE 0x0001    /* Dummy type for 802.3 frames */
#define ARP_REQUEST 0x0001    /* ARP request */
#define ARP_REPLY 0x0002    /* ARP reply */

//定义以太网首部
typedef struct ehhdr
{
unsigned char eh_dst[6];   /* destination ethernet addrress */
unsigned char eh_src[6];   /* source ethernet addresss */
unsigned short eh_type;   /* ethernet pachet type */
}EHHDR, *PEHHDR;

//定义以太网arp字段
typedef struct arphdr
{
//arp首部
unsigned short arp_hrd;    /* format of hardware address */
unsigned short arp_pro;    /* format of protocol address */
unsigned char arp_hln;    /* length of hardware address */
unsigned char arp_pln;    /* length of protocol address */
unsigned short arp_op;     /* ARP/RARP operation */

unsigned char arp_sha[6];    /* sender hardware address */
unsigned long arp_spa;    /* sender protocol address */
unsigned char arp_tha[6];    /* target hardware address */
unsigned long arp_tpa;    /* target protocol address */
}ARPHDR, *PARPHDR;

//定义整个arp报文包，总长度42字节
typedef struct arpPacket
{
EHHDR ehhdr;
ARPHDR arphdr;
} ARPPACKET, *PARPPACKET;

typedef struct _iphdr //定义IP首部
{
unsigned char h_verlen; //4位首部长度+4位IP版本号
unsigned char tos; //8位服务类型TOS
unsigned short total_len; //16位总长度（字节）
unsigned short ident; //16位标识
unsigned short frag_and_flags; //3位标志位
unsigned char ttl; //8位生存时间 TTL
unsigned char proto; //8位协议 (TCP, UDP 或其他)
unsigned short checksum; //16位IP首部校验和
unsigned int sourceIP; //32位源IP地址
unsigned int destIP; //32位目的IP地址
}IP_HEADER;

typedef struct _udphdr //定义UDP首部
{
unsigned short uh_sport;    //16位源端口
unsigned short uh_dport;    //16位目的端口
unsigned short uh_len;//16位UDP包长度
unsigned short uh_sum;//16位校验和
}UDP_HEADER;

typedef struct _tcphdr //定义TCP首部
{
unsigned short th_sport; //16位源端口
unsigned short th_dport; //16位目的端口
unsigned int th_seq; //32位序列号
unsigned int th_ack; //32位确认号
unsigned char th_lenres;//4位首部长度/6位保留字
unsigned char th_flag; //6位标志位
unsigned short th_win; //16位窗口大小
unsigned short th_sum; //16位校验和
unsigned short th_urp; //16位紧急数据偏移量
}TCP_HEADER;

typedef struct _icmphdr {
unsigned char  icmp_type; // 类型
unsigned char  icmp_code; // 代码
unsigned short icmp_cksum; //校验和
unsigned short icmp_id;
unsigned short icmp_seq;
// This is not the std header, but we reserve space for time
unsigned short icmp_timestamp;
}ICMP_HEADER;
void analyseIP(IP_HEADER *ip)
{
unsigned char* p = (unsigned char*)&ip->sourceIP;
if(ip->proto == IPPROTO_TCP)
printf("Source IP: %u.%u.%u.%u   ",p[0],p[1],p[2],p[3]);
p = (unsigned char*)&ip->destIP;
if(ip->proto == IPPROTO_TCP)
printf("Destination IP: %u.%u.%u.%u\n",p[0],p[1],p[2],p[3]);

}

void analyseTCP(TCP_HEADER *tcp)
{
printf("TCP -----\n");
printf("Source port: %u\n", ntohs(tcp->th_sport));
printf("Dest port: %u\n", ntohs(tcp->th_dport));
}

void analyseUDP(UDP_HEADER *udp)
{
//printf("UDP -----\n");
//printf("Source port: %u\n", ntohs(udp->uh_sport));
//printf("Dest port: %u\n", ntohs(udp->uh_dport));
}

void analyseICMP(ICMP_HEADER *icmp)
{
//printf("ICMP -----\n");
//printf("type: %u\n", icmp->icmp_type);
//printf("sub code: %u\n", icmp->icmp_code);
}

class rawsocket
{
public:
int Init()
{
if((sock=socket(PF_PACKET,SOCK_RAW,htons(ETH_P_ALL)))==-1)return 0;
return 1;
}
int Recv(char *buf,int maxlen)
{
return recvfrom(sock,buf,maxlen,0,NULL,NULL);
}
private:
int sock;
};

#include <string>
using namespace std;

char toch(unsigned char ch)
{
if(ch<10)return ch+'0';
else return ch-10+'a';
}
string mactostr(unsigned char *mac)
{
int i;
string str="";
for(i=0;i<6;i++)
{
str+=toch((mac[i]&0xf0)>>4);
str+=toch((mac[i]&0x0f));
if(i<5)str+=':';
}
return str;
}

char Buf[2000],*buf;

#include<time.h>
int main()
{
int L;
int perminute,persecond,tempmin,tempsec;
time_t second,minute,now;
unsigned short *iptype;
IP_HEADER *ip;
rawsocket sniffer;
if(sniffer.Init())
{
second=minute=time(NULL);
tempmin=tempsec=0;
persecond=perminute=0;
while(1)
{
L=sniffer.Recv(Buf,1518);Buf[L-4]=0;
tempsec+=L;
tempmin+=L;
PEHHDR Pehhdr=(PEHHDR)Buf;
if((now=time(NULL))>second)
{
second=now;
persecond=tempsec;
tempsec=0;
if(now-60>=minute)
{
perminute=tempmin;
minute=now;
tempmin=0;
}
printf("流量每秒%d字节，每分钟%d字节\n",persecond,perminute);
}
continue;
buf=Buf+14;
ip = ( IP_HEADER *)(buf);
if(ip->proto == IPPROTO_TCP)
printf("\n\n\n%s==>%s::%x\n\n",mactostr(Pehhdr->eh_src).c_str(),mactostr(Pehhdr->eh_dst).c_str(),Pehhdr->eh_type);
analyseIP(ip);
int iplen=(ip->h_verlen&0x0f)*4;
if (ip->proto == IPPROTO_TCP)
{
TCP_HEADER *tcp = (TCP_HEADER *)(buf+iplen);
analyseTCP(tcp);
int tcpheaderlen=(tcp->th_lenres&0xf0)>>2;
printf("%s\n\n",buf+iplen+tcpheaderlen);
}
else if (ip->proto == IPPROTO_UDP)
{
UDP_HEADER *udp = (UDP_HEADER *)(buf + iplen);
analyseUDP(udp);
}
else if (ip->proto == IPPROTO_ICMP)
{
ICMP_HEADER *icmp = (ICMP_HEADER *)(buf + iplen);
analyseICMP(icmp);
}
else if (ip->proto == IPPROTO_IGMP)
{
//printf("IGMP----\n");
}
else
{
//printf("other protocol! code:%d\n",ip->proto);
}
}
}
else printf("init failed\n");
return 0;
}