（作者：燕云 出處：http://www.CUOXin.com/SWordTao/ 歡迎轉載，但也請保留這段聲明，謝謝！）
君不見 黃河之水 天上來 奔流到海不復回
君不見 高堂明鏡 悲白發 朝如青絲暮成雪
人生得意須盡歡 莫使金樽空對月
——將進酒
pcap文件格式，為多數的tcpdump、wireshark等重量級的數據包抓取、分析應用程序所直接支持，所以，為我們的程序中嵌入此類文件的解析與生成功能，很是值得。
具體信息請看wireshark wiki：http://wiki.wireshark.org/Development/LibpcapFileFormat
筆者本來想借助開源的tcPReplay與libpcap中的代碼片段來快速實現此目的，沒想到被兩個bug，卡住了幾個小時，真是欲速則不達！
第一處：tcpreplay，如果不是因為宏SEEK_SET恰巧等于0 ...... 不要多說，雖不致命，但禍患無窮。
第二處：libpcap，關于packet header的結構定義，struct timeval長度為16字節，而實際上這段區域長度為8字節，所以，這個結構體根本不能正常工作。只會更糟！
無礙，我們繼續，最終的pcap文件解析函數原型：
上圖是即為解析的核心函數原型，對照著第一個圖一起看會很清晰！下面進行測試 :)
1 int main() 2 { 3 struct pcap_file_header phdr; 4 char * filePathPtr="log.pcap"; 5 int fd; 6 int i; 7 int packet_counter; 8 struct packet pkt; 9 10 if ( ( fd=open(filePathPtr,O_RDONLY) )==-1 )11 {12 printf("error: open file error %s /n",filePathPtr);13 return 1;14 }15 if( is_pcap_file_format(fd,&phdr))16 {17 print_pcap_file_header(&phdr);18 }19 else20 {21 printf("error: file %s format not support /n",filePathPtr);22 return 1;23 }24 packet_counter=0;25 while(1)26 {27 if(pcap_file_get_next_packet(fd,&pkt))28 {29 packet_counter++;30 printf("snaplen: %d actual_len: %d packet_counter: %d /n",pkt.len,pkt.actual_len,packet_counter);31 for(i=0; i<pkt.len; ++i)32 {33 printf(" %02x", pkt.data[i]);34 if( (i + 1) % 16 == 0 )35 {36 printf("/n");37 }38 }39 printf("/n/n");40 }41 else 42 {43 printf("done/n");44 break;45 }46 }47 close(fd);48 }View Code
nice ! pcap文件解析已完成，接下來進行流量重放：
其中，函數build_send_ethernet_packet 是我們的老朋友了，無需多言，重點是pcap_ip_repaly 的實現：
1 int pcap_ip_repaly( char * pcapFilePathPtr, int usecDelayPerPacket, char * devName) 2 { 3 struct pcap_file_header phdr; 4 struct ethernet_ip_hdr * hdrPtr; 5 int packet_counter; 6 struct packet pkt; 7 int fd; 8 int i; 9 10 11 if ( ( fd=open(pcapFilePathPtr,O_RDONLY) )==-1 )12 {13 fprintf(stderr,"error: open file error %s",pcapFilePathPtr);14 return 1;15 }16 17 if( is_pcap_file_format(fd,&phdr) )18 {19 print_pcap_file_header(&phdr);20 }21 else22 {23 fprintf(stderr, "error: the file %s is not .pcap format/n",pcapFilePathPtr); 24 return 1;25 }26 27 packet_counter=0;28 while(1)29 {30 if(pcap_file_get_next_packet(fd,&pkt))31 {32 usleep(usecDelayPerPacket);33 packet_counter++;34 //analyze packet and send it35 hdrPtr=(struct ethernet_ip_hdr *) pkt.data;36 if( hdrPtr->ether_type==0x0008) //filter: ip type: 0x0800 -> little endian 0x000837 {38 // print packet information39 printf("ether: %02x:%02x:%02x:%02x:%02x:%02x ->",hdrPtr->ether_shost[0],hdrPtr->ether_shost[1]40 ,hdrPtr->ether_shost[2],hdrPtr->ether_shost[3],hdrPtr->ether_shost[4],hdrPtr->ether_shost[5]);41 printf(" %02x:%02x:%02x:%02x:%02x:%02x ",hdrPtr->ether_dhost[0],hdrPtr->ether_dhost[1]42 ,hdrPtr->ether_dhost[2],hdrPtr->ether_dhost[3],hdrPtr->ether_dhost[4],hdrPtr->ether_dhost[5]);43 printf("ip: %d.%d.%d.%d ->",hdrPtr->ip_src[0],hdrPtr->ip_src[1],hdrPtr->ip_src[2],hdrPtr->ip_src[3]);44 printf(" %d.%d.%d.%d /n",hdrPtr->ip_dst[0],hdrPtr->ip_dst[1],hdrPtr->ip_dst[2],hdrPtr->ip_dst[3]);45 if(pkt.len==pkt.actual_len)46 {47 printf("whole packet:padPtr is %x,padLength is %d /n",pkt.data+14,pkt.len-14);48 if (build_send_ethernet_packet(devName,1, hdrPtr->ether_dhost,49 hdrPtr->ether_shost,0x0800,pkt.data+14,pkt.len-14)50 ==051 )52 printf("resend packet success :) /n");53 else54 printf("resend packet fail :( /n");55 }56 else57 {58 fprintf(stderr,"this packet is not entire,cannot resend :(");59 }60 61 }62 else63 { 64 if(hdrPtr->ether_type==0x0608) //filter: ip type: 0x0806 -> little endian 0x060865 {printf("arp packet /n");}66 else if(hdrPtr->ether_type==0x3508) //filter: ip type: 0x0835 -> little endian 0x350867 {printf("rarp packet /n");}68 else69 {printf("unknown packet type/n");}70 }71 //print packet72 printf("snaplen: %d actual_len: %d packet_counter: %d /n",pkt.len,pkt.actual_len,packet_counter);73 for(i=0; i<pkt.len; ++i)74 {75 printf(" %02x", pkt.data[i]);76 if( (i + 1) % 16 == 0 )77 {78 printf("/n");79 }80 }81 printf("/n/n");82 }83 else 84 {85 break;86 }87 }88 89 close(fd);90 return 0;91 92 }View Codeint pcap_ip_repaly( char * pcapFilePathPtr, int usecDelayPerPacket, char * devName)
char * pcapFilePathPtr : 待解析 pcap 文件路徑int usecDelayPerPacket : 每隔多少us發一個包。。即控制發包速率
char * devName : 你想讓哪個網卡做壞事？寫上他的”真名“吧！
進行測試：
int main(){ return pcap_ip_repaly("log.pcap",0,"eth0");}
附錄：
全部代碼
1 #include <sys/time.h> 2 #include <sys/types.h> 3 #include <stdio.h> 4 #include <fcntl.h> 5 #include <unistd.h> 6 #include <sys/types.h> 7 #include <sys/time.h> 8 #include <sys/types.h> 9 #include <stdint.h> 10 #include <libnet.h> 11 12 13 #define PCAP_MAGIC 0xa1b2c3d4 /* magic constants for various pcap file types */ 14 #define DEFAULT_MTU 1500 /* Max Transmission Unit of standard ethernet 15 * don't forget *frames* are MTU + L2 header! */ 16 #define MAXPACKET 16436 /* MTU of linux loopback */ 17 #define MAX_SNAPLEN 65535 /* tell libpcap to capture the entire packet */ 18 19 struct pcap_file_header { 20 unsigned int magic; 21 unsigned short int version_major; 22 unsigned short int version_minor; 23 int thiszone; /* gmt to local correction */ 24 unsigned int sigfigs; /* accuracy of timestamps */ 25 unsigned int snaplen; /* max length saved portion of each pkt */ 26 unsigned int linktype; /* data link type (LINKTYPE_*) */ 27 }; 28 struct pcap_pkthdr { 29 time_t ts;//struct timeval ts; /* time stamp */ 30 unsigned int caplen; /* length of portion present */ 31 unsigned int len; /* length this packet (off wire) */ 32 }; 33 34 struct packet { 35 unsigned char data[MAXPACKET]; /* pointer to packet contents */ 36 unsigned int len; /* length of data (snaplen) */ 37 unsigned int actual_len; /* actual length of the packet */ 38 time_t ts; /* timestamp */ 39 }; 40 41 struct ethernet_ip_hdr 42 { 43 uint8_t ether_dhost[6];/* destination ethernet address */ 44 uint8_t ether_shost[6];/* source ethernet address */ 45 uint16_t ether_type; /* protocol */ 46 uint8_t ip_ver_hdrlen; 47 uint8_t ip_tos; 48 uint16_t ip_total_len; /* total length */ 49 uint16_t ip_id; /* identification */ 50 uint16_t ip_frag; 51 uint8_t ip_ttl; /* time to live */ 52 uint8_t ip_proto; /* protocol */ 53 uint16_t ip_hdrCRC; /* checksum */ 54 uint8_t ip_src[4]; 55 uint8_t ip_dst[4]; 56 }; 57 58 /* return flag if this is a pcap file */ 59 /* 60 retCode 61 0 fail 62 1 success 63 */ 64 int is_pcap_file_format(int fd,struct pcap_file_header * pcapFileHdrPtr) 65 { 66 67 if (lseek(fd, 0, SEEK_SET) != 0) 68 { 69 fprintf(stderr,"Unable to seek to start of file/n"); 70 return 0; 71 } 72 73 if (read(fd, (void *) pcapFileHdrPtr, sizeof( struct pcap_file_header )) != sizeof( struct pcap_file_header )) 74 { 75 fprintf(stderr,"Unable to read whole pcap file hdr of file/n"); 76 return 0; 77 } 78 79 switch (pcapFileHdrPtr->magic) 80 { 81 case PCAP_MAGIC: 82 break; 83 default: 84 { 85 fprintf(stderr,"Unable to resolve the magic number %d /n",pcapFileHdrPtr->magic); 86 return 0; 87 } 88 } 89 90 /* version, snaplen, & linktype magic */ 91 if (pcapFileHdrPtr->version_major != 2) 92 { 93 fprintf(stderr,"Unable to resolve the version_major number %d /n",pcapFileHdrPtr->version_major); 94 return 0; 95 } 96 97 98 if (pcapFileHdrPtr->linktype != 1) 99 {100 fprintf(stderr,"Only could resolve the ethernet linktype packet, not %d /n",pcapFileHdrPtr->linktype);101 return 0;102 }103 104 return 1;105 }106 107 void print_pcap_file_header(struct pcap_file_header * pcapFileHdrPtr)108 {109 printf("magic number: %X /n",pcapFileHdrPtr->magic);110 printf("version_major: %d /n",pcapFileHdrPtr->version_major);111 printf("version_minor: %d /n",pcapFileHdrPtr->version_minor);112 printf("gmt to local correction: %d /n",pcapFileHdrPtr->thiszone);113 printf("accuracy of timestamps: %d /n",pcapFileHdrPtr->sigfigs);114 printf("max snap length: %d /n",pcapFileHdrPtr->snaplen);115 printf("linktype(1 for ethernet): %d /n",pcapFileHdrPtr->linktype);116 }117 118 int119 pcap_file_get_next_packet(int fd, struct packet *pkt)120 {121 struct pcap_pkthdr p1, *p;122 123 if (read(fd, &p1, sizeof(p1)) != sizeof(p1))124 return 0;125 p = &p1;126 127 pkt->len = p->caplen;128 /* stupid OpenBSD, won't let me just assign things, so I've got129 * to use a memcpy() instead130 */131 memcpy(&(pkt->ts), &(p->ts), sizeof(time_t));132 pkt->actual_len = p->len;133 134 if (read(fd, &pkt->data, pkt->len) != pkt->len)135 return 0;136 137 return pkt->len;138 }139 140 int pcap_file_print( char * pcapFilePathPtr )141 {142 struct pcap_file_header phdr;143 int packet_counter;144 struct packet pkt;145 int fd;146 int i;147 148 149 if ( ( fd=open(pcapFilePathPtr,O_RDONLY) )==-1 )150 {151 fprintf(stderr,"error: open file error %s",pcapFilePathPtr);152 return 1;153 }154 155 if( is_pcap_file_format(fd,&phdr) )156 {157 print_pcap_file_header(&phdr);158 }159 else160 {161 fprintf(stderr, "error: the file %s is not .pcap format/n",pcapFilePathPtr); 162 return 1;163 }164 165 packet_counter=0;166 while(1)167 {168 if(pcap_file_get_next_packet(fd,&pkt))169 {170 packet_counter++;171 printf("snaplen: %d actual_len: %d packet_counter: %d /n",pkt.len,pkt.actual_len,packet_counter);172 for(i=0; i<pkt.len; ++i)173 {174 printf(" %02x", pkt.data[i]);175 if( (i + 1) % 16 == 0 )176 {177 printf("/n");178 }179 }180 printf("/n/n");181 }182 else 183 {184 break;185 }186 }187 188 close(fd);189 return 0;190 191 }192 193 194 195 int build_send_ethernet_packet(const char * dev,const unsigned int sendTimes,196 const unsigned char * dst_mac,const unsigned char * src_mac,197 const uint16_t protoType,const unsigned char * padPtr,const unsigned int padLength198 )199 {200 libnet_t *net_t = NULL; 201 char err_buf[LIBNET_ERRBUF_SIZE];202 libnet_ptag_t p_tag; 203 unsigned int i=0;204 205 //init the libnet context structure206 net_t = libnet_init(LIBNET_LINK_ADV, dev, err_buf); 207 if(net_t == NULL)208 {209 fprintf(stderr,"libnet_init error:%s/n",err_buf);210 return 1;211 }212 213 //build the ethernet packet214 p_tag = libnet_build_ethernet(//create ethernet header215 dst_mac,//dest mac addr216 src_mac,//source mac addr217 protoType,//protocol type218 padPtr,//payload219 padLength,//payload length220 net_t,//libnet context221 0//0 to build a new one222 );223 if(-1 == p_tag)224 {225 fprintf(stderr,"libnet_build_ethernet error!/n");226 fprintf(stderr,"BuildAndSendEthernetPacket: %s",net_t->err_buf);227 goto FAIL;228 }229 230 for(i=0;i<sendTimes;i++)231 if(-1 == libnet_write(net_t))232 {233 fprintf(stderr,"B libnet_write error!/n");234 fprintf(stderr,"BuildAndSendEthernetPacket: %s",net_t->err_buf);235 goto FAIL;236 }237 238 libnet_destroy(net_t);239 return 0;240 FAIL: 241 libnet_destroy(net_t);242 return 1;243 }244 245 246 int pcap_ip_repaly( char * pcapFilePathPtr, int usecDelayPerPacket, char * devName)247 {248 struct pcap_file_header phdr;249 struct ethernet_ip_hdr * hdrPtr;250 int packet_counter;251 struct packet pkt;252 int fd;253 int i;254 255 256 if ( ( fd=open(pcapFilePathPtr,O_RDONLY) )==-1 )257 {258 fprintf(stderr,"error: open file error %s",pcapFilePathPtr);259 return 1;260 }261 262 if( is_pcap_file_format(fd,&phdr) )263 {264 print_pcap_file_header(&phdr);265 }266 else267 {268 fprintf(stderr, "error: the file %s is not .pcap format/n",pcapFilePathPtr); 269 return 1;270 }271 272 packet_counter=0;273 while(1)274 {275 if(pcap_file_get_next_packet(fd,&pkt))276 {277 usleep(usecDelayPerPacket);278 packet_counter++;279 //analyze packet and send it280 hdrPtr=(struct ethernet_ip_hdr *) pkt.data;281 if( hdrPtr->ether_type==0x0008) //filter: ip type: 0x0800 -> little endian 0x0008282 {283 // print packet information284 printf("ether: %02x:%02x:%02x:%02x:%02x:%02x ->",hdrPtr->ether_shost[0],hdrPtr->ether_shost[1]285 ,hdrPtr->ether_shost[2],hdrPtr->ether_shost[3],hdrPtr->ether_shost[4],hdrPtr->ether_shost[5]);286 printf(" %02x:%02x:%02x:%02x:%02x:%02x ",hdrPtr->ether_dhost[0],hdrPtr->ether_dhost[1]287 ,hdrPtr->ether_dhost[2],hdrPtr->ether_dhost[3],hdrPtr->ether_dhost[4],hdrPtr->ether_dhost[5]);288 printf("ip: %d.%d.%d.%d ->",hdrPtr->ip_src[0],hdrPtr->ip_src[1],hdrPtr->ip_src[2],hdrPtr->ip_src[3]);289 printf(" %d.%d.%d.%d /n",hdrPtr->ip_dst[0],hdrPtr->ip_dst[1],hdrPtr->ip_dst[2],hdrPtr->ip_dst[3]);290 if(pkt.len==pkt.actual_len)291 {292 printf("whole packet:padPtr is %x,padLength is %d /n",pkt.data+14,pkt.len-14);293 if (build_send_ethernet_packet(devName,1, hdrPtr->ether_dhost,294 hdrPtr->ether_shost,0x0800,pkt.data+14,pkt.len-14)295 ==0296 )297 printf("resend packet success :) /n");298 else299 printf("resend packet fail :( /n");300 }301 else302 {303 fprintf(stderr,"this packet is not entire,cannot resend :(");304 }305 306 }307 else308 { 309 if(hdrPtr->ether_type==0x0608) //filter: ip type: 0x0806 -> little endian 0x0608310 {printf("arp packet /n");}311 else if(hdrPtr->ether_type==0x3508) //filter: ip type: 0x0835 -> little endian 0x3508312 {printf("rarp packet /n");}313 else314 {printf("unknown packet type/n");}315 }316 //print packet317 printf("snaplen: %d actual_len: %d packet_counter: %d /n",pkt.len,pkt.actual_len,packet_counter);318 for(i=0; i<pkt.len; ++i)319 {320 printf(" %02x", pkt.data[i]);321 if( (i + 1) % 16 == 0 )322 {323 printf("/n");324 }325 }326 printf("/n/n");327 }328 else 329 {330 break;331 }332 }333 334 close(fd);335 return 0;336 337 }338 339 int main()340 {341 return pcap_ip_repaly("/home/yun/Codes/wp.pcap",0,"eth0");342 }View Code如有問題或者建議，歡迎留言討論:)
新聞熱點
疑難解答
