在Linux下編寫(xiě)網(wǎng)絡(luò )抓包程序，下寫(xiě)網(wǎng)序代我們通常使用libpcap庫，何編li(′?｀)bpcap是絡(luò )抓一個(gè)(????)專(zhuān)門(mén)用于數據包捕獲的庫，它提供了一套完整的包??程API，可以讓我們方便地對網(wǎng)絡(luò )數據包進(jìn)行抓取??、下寫(xiě)網(wǎng)序代分析等(deng)操作。何編

安裝libpcap庫

在(zai)Ubuntu系統中，絡(luò )抓我們可以通過(guò)以下命令安裝┐(′ー｀)┌l(fā)ibpcap庫：

sudo apt-get install libpcap-dev

在其他Linux發(fā)行版中，包程也可以通過(guò)相應的下寫(xiě)網(wǎng)序代包管理器進(jìn)行安裝。

編寫(xiě)網(wǎng)絡(luò )

抓??包

程序

include <pcap.h>include <std(╬?益?)io.h&g??t;incl(T_T)ude <netinet/ip.h>include <netine(′；ω；`)t/tcp.h>void packet_handler(u_char *user_data,包程 const struct pcap_pkthdr *pkthdr, const u_char *packet) {  struct ip *iph; struct tcphdr *tc(′▽?zhuān)?ph; int length; iph = (struct ip *)(packet + 14); tcph = (struct tc(′_ゝ`)phdr *)(pack(′?｀)et + 14 + iph->ip_hl*4); length = pkthdr->len (iph->ip_hl*4 + tcph->doff*4); printf("S(??ヮ?)?*:???ource IP: %s", inet_ntoa(*(in_addr*)(′?_?`)&iph->ip_src)); printf("Destination IP: %s", inet_ntoa(*(in_addr*)&iph->ip_dst)); printf("Source Port: %d", ntohs(tcph->source)); printf("Deヽ(′?｀)ノstination?? Port: %d&??quot;, ntohs(tcph->dest)); printf("Lengt(╯‵□′)╯h: %d", length)(??-)?;}int main() {  pcap_t *handle; char er??rbuf[PCAP_??ERRBUF_SIZE]; struct pcap_pkthdr header; const u_char *packet(?Д?); char *dev; struct bpf_program fcode; bpf_u_int32 net; // 打開(kāi)網(wǎng)絡(luò )設備，這里我們選擇所有設備（"any"） ha??ndle = pcap_open_live("a(′▽?zhuān)?ny",下寫(xiě)網(wǎng)序代 BUFSIZ, 1, 1000, errbu(′?｀)f); if (handle == NULL) {  fprintf(stderr,"Couldn't open='open' device:?? %s", errbuf); return(2); } // 編譯并應用BP??F過(guò)濾器，這里我們選擇TCP協(xié)議的何編數據包 if (pcap_compile(handle, &fcode, "tcp&qu(′?_?`)ot;, 0, net) == -1) {  fprintf(stderr,"Couldn't parse filter %s: %s", "tcp&quo(?Д?)t;, pcap_??geterr(handle)); return(2); } if (pca??p_setfilter(handle, &fc??ode) == -1) {  fprintf(stderr,"Couldn'(′?｀*)t?? install filter %s: %s",?? "tcp", pcap_geterr(handle)); return(2); } // 開(kāi)始抓包，??這里我們?只抓取10個(gè)數據包 while (1) {  packet = pcap_next(handle(?????),絡(luò )抓 &header); printf("Packet size: %d bytes", header.len); packet_handler(NULL, &header, packet); }}

編譯運行網(wǎng)絡(luò )抓包程序

我們可以使用gcc編譯器來(lái)編譯這??個(gè)程序：

gcc -o sniff??er sniffer.c -lpcap -lnetinet -lnsl -lssl -lcrypto -lz -lpthread -ldl -lm -lpcap-linux-gnu -lresolv-conf -lgn( ?ω?)utls-openssl-compa(╯°□°）╯︵ ┻━┻t -lgnutls-open="open"ssl27-compa??t -lgnutls-open=""ssl30-compat -lgnutls-open=""ssl31-compat -lgnutls-openssl32-compat -lgnutls-open=""ssl33-compat -lgnutls-open='open'ssl34-compat -lgnutls-open="open"ssl(??ヮ?)?*:???35-compat -lgnutls-open="open"ssl36-c(◎_◎;)ompat -lgnutls-open=""ssl37-compat -lgnutls-open="open"ssl38-compat -lgnutls-open=""ssl39-compat -lgnutls-open="open"ssl40-compat -lgnutls-open=""ssl41-compat -lgnutls-open='open'ssl42-compat -lgnu(╯°□°)╯tls-open="open"ssl43-compat -lgnutls-opens??sl44-compat -lgnutls-openssヽ(′▽?zhuān)?ノl46-compat -l(//ω//)g(╥_╥)nutls??-o(?_?;)penssl47-compat -lgnutls-openssl48-compat -lgnutls-open=""ssl49-comp??at -l??gnutls-open='open'ssl50-compat -lgnutls-open='open'ssl51-compヾ(′ω｀)?at -lgnutls-open=""ssl5ヽ(′ー｀)ノ2-compat -lgnutls-open="open"ssl53-compat -lgnutls-open=""ssl54-compat -lgnutls-openssl55-compat -lgnutls-open="open"ssl56-compat?? -lgnutls-open='open'ssl57-compat -lgnutls-openssl58-compat -lgnutls-openss??l59-compat -lgnutls-open='open'ssl60-compat -lgnutls-open='open'ssl61ヽ(′ー｀)ノ-compat -lgnutls-open='open'ssl62-compa(′ω｀)t -lgnutls-open='open'ssl63-com??pat -lgnutls-open=""ssl64-compat -lgnu??tls-open="open"ss( ?ヮ?)l65-compat -lgnutls-open="open"ssl66-compat -lgnutls-open='open'ssl67-compat -lgnutls-openssl68-compat -lgnutls-open='open'ssl69-compat -lgnutls-openssl70-compat -l??gnutls-open='open'ssl71-compat -lgnutls-open="open"ssl72-compat -lgnutls