Question

我试图从数据包捕获中获取UDP信息，并且我对这些信息的位置感到困惑。我知道Ethernet Header是14个字节，IPv6头是40个字节。此外，UDP源端口是UDP标头中的前2个字节。因此，它应该是14 + 40 - 1 = 53.因此UDP源端口应该是字节54和55.它不对，我得到20016.对于我使用的示例pcap文件，它是＆＃39; s应该是51216.其他一切都是正确的，确定IPv4或IPv6并确定它是否是UDP或TCP。

int main(int argc, char *argv[]) {

    pcap_t *pcap_handle = NULL;             /* Handle for PCAP library */
    struct pcap_pkthdr *packet_hdr = NULL;  /* Packet header from PCAP */
    const u_char *packet_data = NULL;       /* Packet data from PCAP */
    int ret = 0;                            /* Return value from library calls */
    char use_file = 0;                      /* Flag to use file or live capture */

    /* Setup the capture and get the valid handle. */
    pcap_handle = setup_capture(argc, argv, &use_file);

    /* Loop through all the packets in the trace file.
     * ret will equal -2 when the trace file ends.
     * ret will never equal -2 for a live capture. */
    ret = pcap_next_ex(pcap_handle, &packet_hdr, &packet_data);

  struct ether_header
  {
    u_int8_t  ether_dhost[6];   /* destination eth addr */
    u_int8_t  ether_shost[6];   /* source ether addr    */
    u_int16_t ether_type;               /* packet type ID field */
  };

  struct ether_header *eptr;
  char src[INET_ADDRSTRLEN];
  char dst[INET_ADDRSTRLEN];
  char src6[INET6_ADDRSTRLEN];
  char dst6[INET6_ADDRSTRLEN];

  while( ret != -2 ) {
        if( valid_capture(ret, pcap_handle, use_file) ){
      eptr = (struct ether_header *) packet_data;

      fprintf(stdout,"%s -> ",ether_ntoa((const struct ether_addr *)&eptr->ether_shost));
      fprintf(stdout,"%s \n",ether_ntoa((const struct ether_addr *)&eptr->ether_dhost));
      if(packet_data[12] == 0x08 && packet_data[13] == 0x00)
      {
        printf("    [IPv4] ");
        fprintf(stdout,"%s -> ", inet_ntop(AF_INET,(const void *)packet_data+26,src,INET_ADDRSTRLEN));
        fprintf(stdout,"%s\n", inet_ntop(AF_INET,(const void *)packet_data+30,dst,INET_ADDRSTRLEN));
        if(packet_data[23] == 0x06)
        {
            printf("    [TCP] \n");
        }
        else if(packet_data[23] == 0x11)
        {
        }
        else{
        printf("    [%d] \n",packet_data[23]);
        }
      }
      else if(packet_data[12] == 0x86 && packet_data[13] == 0xdd)
      {
        printf("[IPv6] ");
        printf("%s -> ", inet_ntop(AF_INET6, (const void *)packet_data+22, src6, INET6_ADDRSTRLEN));
        printf("%s \n", inet_ntop(AF_INET6, (const void *)packet_data+38, dst6, INET6_ADDRSTRLEN));
        if(packet_data[20] == 0x06)
        {
            printf("    [TCP] \n");
        }
        else if(packet_data[20] == 0x11)
        {
            printf("[UDP] Source: %d",packet_data[54]); //problem here
            printf("%d \n",packet_data[55]); //problem here
        }
        else{
        printf("    [%d] \n",packet_data[20]);
        }
      } else {
          fprintf(stdout,"    [%d] \n",ntohs(eptr->ether_type));
      }

感谢您的帮助或指导

Answer 1

        printf("[UDP] Source: %d",packet_data[54]); //problem here
        printf("%d \n",packet_data[55]); //problem here

UDP端口是网络字节顺序的16位整数。而是将其打印为两个8位整数。鉴于您打印20016 data[54]可能是200而data[55]是16。因此，端口的正确值为200*256+16=51216，这正是您所期望的。

PCAP标头，获取UDP信息

1 个答案: