I have assignment and it is like this:
Use the software called wireshark and capture a few packets from the live network and save the filename as test1. Download the netdump.c source code and modify the program to display only TCP/IP packets
May someone explain or give the code example for this?
Thank you.
Below is the netdump.c code
#define NULL 0
#define TCPDUMP_MAGIC 0xa1b2c3d4 /* Tcpdump Magic Number (Preamble) */
#define PCAP_VERSION_MAJOR 2 /* Tcpdump Version Major (Preamble) */
#define PCAP_VERSION_MINOR 4 /* Tcpdump Version Minor (Preamble) */
#define DLT_NULL 0 /* Data Link Type Null */
#define DLT_EN10MB 1 /* Data Link Type for Ethernet II 100 MB and above */
#define DLT_EN3MB 2 /* Data Link Type for 3 Mb Experimental Ethernet */
#define ETHER_ADDR_LEN 6
#include <stdio.h>
#include <iostream>
#include <fstream>
using namespace std;
FILE *input;
typedef struct packet_header
{
unsigned int magic;
unsigned short version_major;
unsigned short version_minor;
unsigned int thiszone;
unsigned int sigfigs;
unsigned int snaplen;
unsigned int linktype;
} hdr;
typedef struct packet_timestamp
{
unsigned int tv_sec;
unsigned int tv_usec;
unsigned int caplen;
unsigned int len;
} tt;
typedef struct ether_header
{ unsigned char edst[ETHER_ADDR_LEN];
unsigned char esrc[ETHER_ADDR_LEN];
unsigned short etype;
} eth;
int main(int argc, char *argv[])
{
unsigned int remain_len = 0;
unsigned char temp=0, hlen, version, tlen;
int i, count=0;
struct packet_header hdr;
struct packet_timestamp tt;
struct ether_header eth;
unsigned char buff, array[1500];
input = fopen("abc", "rb");
if(fopen == NULL)
cout << "Cannot open saved windump file" << endl;
else
{
fread((char *) &hdr, sizeof(hdr), 1, input);
cout << "\n********** ********** PACKET HEADER **********
***********" << endl;
cout << "Preamble " << endl;
cout << "Packet Header Length : " << sizeof(hdr) << endl;
cout << " Magic Number : " << hdr.magic << endl;
cout << "Version Major : " << hdr.version_major << endl;
cout << "Version Minor : " << hdr.version_minor << endl;
cout << "GMT to Local Correction : " << hdr.thiszone << endl;
cout << "Jacked Packet with Length of : " << hdr.snaplen << endl;
cout << "Accuracy to Timestamp : " << hdr.sigfigs << endl;
cout << "Data Link Type (Ethernet Type II = 1) : " << hdr.linktype
<< endl;
while(fread((char *) &tt, sizeof(tt), 1, input))
{
++count;
cout << "********** ********** TIMESTAMP & ETHERNET FRAME
********** ***********" << endl;
cout << " Packet Number: " << count << endl;
cout << " The Packets are Captured in : " << tt.tv_sec << "
Seconds" << endl;
cout << "The Packets are Captured in : " << tt.tv_usec << "
Micro-seconds" << endl;
cout << "The Actual Packet Length: " << tt.caplen << "Bytes"
<< endl;
cout << "Packet Length (Off Wire): " << tt.len << "Bytes" <<
endl;
fread((char *) ð, sizeof(eth), 1, input);
cout << "Ethernet Header Length : " << sizeof(eth) << "
bytes" << endl;
printf("MAC Destination Address : [hex] %x :%x :%x :%x :%x
:%x \n\t\t\t [dec] %d :%d :%d :%d :%d :%d\n",
eth.edst[0], eth.edst[1],
eth.edst[2], eth.edst[3], eth.edst[4], eth.edst[5],
eth.edst[0], eth.edst[1],
eth.edst[2], eth.edst[3], eth.edst[4], eth.edst[5],
eth.edst[6]);
printf("MAC Source Address : [hex] %x :%x :%x :%x :%x :%x
\n\t\t\t [dec] %d :%d :%d :%d :%d :%d\n",
eth.esrc[0], eth.esrc[1], eth.esrc[2],
eth.esrc[3], eth.esrc[4], eth.esrc[5], eth.esrc[0],
eth.esrc[1],
eth.esrc[2], eth.esrc[3], eth.esrc[4], eth.esrc[5]);
printf("\n\n C Cout\n\n");
cout << "MAC Address " << eth.esrc[0] << " " << eth.esrc[1] <<
endl;
for (i=0;i<tt.caplen -14;i++)
{ fread((char *) &buff, sizeof(buff), 1 , input);
printf(" %x", buff);
line if neccessary
array[i] = buff;
}
A FILE ******
HERE.********************************************
**********
code
you may affect
printf("\n ");
}
}
fclose(input);
return (0);
}