Basic Sniffer
To code a sniffer in C (Linux) the steps would be :
1. Create a Raw Socket.
2. Put it in a recvfrom loop.
A raw socket when put in recvfrom receives all incoming packets. The following code shows an example of such a sniffer. Note that it sniffs only incoming packets. For sniffing all traffic on a network a packet capture library like libpcap can be used.
Code
sniffer.c
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
|
#include<stdio.h> //For standard things
#include<stdlib.h> //malloc
#include<string.h> //memset
#include<netinet/ip_icmp.h> //Provides declarations for icmp header
#include<netinet/udp.h> //Provides declarations for udp header
#include<netinet/tcp.h> //Provides declarations for tcp header
#include<netinet/ip.h> //Provides declarations for ip header
#include<sys/socket.h>
#include<arpa/inet.h>
void
ProcessPacket(unsigned
char
* ,
int
);
void
print_ip_header(unsigned
char
* ,
int
);
void
print_tcp_packet(unsigned
char
* ,
int
);
void
print_udp_packet(unsigned
char
* ,
int
);
void
print_icmp_packet(unsigned
char
* ,
int
);
void
PrintData (unsigned
char
* ,
int
);
int
sock_raw;
FILE
*logfile;
int
tcp=0,udp=0,icmp=0,others=0,igmp=0,total=0,i,j;
struct
sockaddr_in source,dest;
int
main()
{
int
saddr_size , data_size;
struct
sockaddr saddr;
struct
in_addr in;
unsigned
char
*buffer = (unsigned
char
*)
malloc
(65536);
//Its Big!
logfile=
fopen
(
"log.txt"
,
"w"
);
if
(logfile==NULL)
printf
(
"Unable to create file."
);
printf
(
"Starting...\n"
);
//Create a raw socket that shall sniff
sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);
if
(sock_raw < 0)
{
printf
(
"Socket Error\n"
);
return
1;
}
while
(1)
{
saddr_size =
sizeof
saddr;
//Receive a packet
data_size = recvfrom(sock_raw , buffer , 65536 , 0 , &saddr , &saddr_size);
if
(data_size <0 )
{
printf
(
"Recvfrom error , failed to get packets\n"
);
return
1;
}
//Now process the packet
ProcessPacket(buffer , data_size);
}
close(sock_raw);
printf
(
"Finished"
);
return
0;
}
void
ProcessPacket(unsigned
char
* buffer,
int
size)
{
//Get the IP Header part of this packet
struct
iphdr *iph = (
struct
iphdr*)buffer;
++total;
switch
(iph->protocol)
//Check the Protocol and do accordingly...
{
case
1:
//ICMP Protocol
++icmp;
//PrintIcmpPacket(Buffer,Size);
break
;
case
2:
//IGMP Protocol
++igmp;
break
;
case
6:
//TCP Protocol
++tcp;
print_tcp_packet(buffer , size);
break
;
case
17:
//UDP Protocol
++udp;
print_udp_packet(buffer , size);
break
;
default
:
//Some Other Protocol like ARP etc.
++others;
break
;
}
printf
(
"TCP : %d UDP : %d ICMP : %d IGMP : %d Others : %d Total : %d\r"
,tcp,udp,icmp,igmp,others,total);
}
void
print_ip_header(unsigned
char
* Buffer,
int
Size)
{
unsigned
short
iphdrlen;
struct
iphdr *iph = (
struct
iphdr *)Buffer;
iphdrlen =iph->ihl*4;
memset
(&source, 0,
sizeof
(source));
source.sin_addr.s_addr = iph->saddr;
memset
(&dest, 0,
sizeof
(dest));
dest.sin_addr.s_addr = iph->daddr;
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"IP Header\n"
);
fprintf
(logfile,
" |-IP Version : %d\n"
,(unsigned
int
)iph->version);
fprintf
(logfile,
" |-IP Header Length : %d DWORDS or %d Bytes\n"
,(unsigned
int
)iph->ihl,((unsigned
int
)(iph->ihl))*4);
fprintf
(logfile,
" |-Type Of Service : %d\n"
,(unsigned
int
)iph->tos);
fprintf
(logfile,
" |-IP Total Length : %d Bytes(Size of Packet)\n"
,ntohs(iph->tot_len));
fprintf
(logfile,
" |-Identification : %d\n"
,ntohs(iph->id));
//fprintf(logfile," |-Reserved ZERO Field : %d\n",(unsigned int)iphdr->ip_reserved_zero);
//fprintf(logfile," |-Dont Fragment Field : %d\n",(unsigned int)iphdr->ip_dont_fragment);
//fprintf(logfile," |-More Fragment Field : %d\n",(unsigned int)iphdr->ip_more_fragment);
fprintf
(logfile,
" |-TTL : %d\n"
,(unsigned
int
)iph->ttl);
fprintf
(logfile,
" |-Protocol : %d\n"
,(unsigned
int
)iph->protocol);
fprintf
(logfile,
" |-Checksum : %d\n"
,ntohs(iph->check));
fprintf
(logfile,
" |-Source IP : %s\n"
,inet_ntoa(source.sin_addr));
fprintf
(logfile,
" |-Destination IP : %s\n"
,inet_ntoa(dest.sin_addr));
}
void
print_tcp_packet(unsigned
char
* Buffer,
int
Size)
{
unsigned
short
iphdrlen;
struct
iphdr *iph = (
struct
iphdr *)Buffer;
iphdrlen = iph->ihl*4;
struct
tcphdr *tcph=(
struct
tcphdr*)(Buffer + iphdrlen);
fprintf
(logfile,
"\n\n***********************TCP Packet*************************\n"
);
print_ip_header(Buffer,Size);
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"TCP Header\n"
);
fprintf
(logfile,
" |-Source Port : %u\n"
,ntohs(tcph->source));
fprintf
(logfile,
" |-Destination Port : %u\n"
,ntohs(tcph->dest));
fprintf
(logfile,
" |-Sequence Number : %u\n"
,ntohl(tcph->seq));
fprintf
(logfile,
" |-Acknowledge Number : %u\n"
,ntohl(tcph->ack_seq));
fprintf
(logfile,
" |-Header Length : %d DWORDS or %d BYTES\n"
,(unsigned
int
)tcph->doff,(unsigned
int
)tcph->doff*4);
//fprintf(logfile," |-CWR Flag : %d\n",(unsigned int)tcph->cwr);
//fprintf(logfile," |-ECN Flag : %d\n",(unsigned int)tcph->ece);
fprintf
(logfile,
" |-Urgent Flag : %d\n"
,(unsigned
int
)tcph->urg);
fprintf
(logfile,
" |-Acknowledgement Flag : %d\n"
,(unsigned
int
)tcph->ack);
fprintf
(logfile,
" |-Push Flag : %d\n"
,(unsigned
int
)tcph->psh);
fprintf
(logfile,
" |-Reset Flag : %d\n"
,(unsigned
int
)tcph->rst);
fprintf
(logfile,
" |-Synchronise Flag : %d\n"
,(unsigned
int
)tcph->syn);
fprintf
(logfile,
" |-Finish Flag : %d\n"
,(unsigned
int
)tcph->fin);
fprintf
(logfile,
" |-Window : %d\n"
,ntohs(tcph->window));
fprintf
(logfile,
" |-Checksum : %d\n"
,ntohs(tcph->check));
fprintf
(logfile,
" |-Urgent Pointer : %d\n"
,tcph->urg_ptr);
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
" DATA Dump "
);
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"IP Header\n"
);
PrintData(Buffer,iphdrlen);
fprintf
(logfile,
"TCP Header\n"
);
PrintData(Buffer+iphdrlen,tcph->doff*4);
fprintf
(logfile,
"Data Payload\n"
);
PrintData(Buffer + iphdrlen + tcph->doff*4 , (Size - tcph->doff*4-iph->ihl*4) );
fprintf
(logfile,
"\n###########################################################"
);
}
void
print_udp_packet(unsigned
char
*Buffer ,
int
Size)
{
unsigned
short
iphdrlen;
struct
iphdr *iph = (
struct
iphdr *)Buffer;
iphdrlen = iph->ihl*4;
struct
udphdr *udph = (
struct
udphdr*)(Buffer + iphdrlen);
fprintf
(logfile,
"\n\n***********************UDP Packet*************************\n"
);
print_ip_header(Buffer,Size);
fprintf
(logfile,
"\nUDP Header\n"
);
fprintf
(logfile,
" |-Source Port : %d\n"
, ntohs(udph->source));
fprintf
(logfile,
" |-Destination Port : %d\n"
, ntohs(udph->dest));
fprintf
(logfile,
" |-UDP Length : %d\n"
, ntohs(udph->len));
fprintf
(logfile,
" |-UDP Checksum : %d\n"
, ntohs(udph->check));
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"IP Header\n"
);
PrintData(Buffer , iphdrlen);
fprintf
(logfile,
"UDP Header\n"
);
PrintData(Buffer+iphdrlen ,
sizeof
udph);
fprintf
(logfile,
"Data Payload\n"
);
PrintData(Buffer + iphdrlen +
sizeof
udph ,( Size -
sizeof
udph - iph->ihl * 4 ));
fprintf
(logfile,
"\n###########################################################"
);
}
void
print_icmp_packet(unsigned
char
* Buffer ,
int
Size)
{
unsigned
short
iphdrlen;
struct
iphdr *iph = (
struct
iphdr *)Buffer;
iphdrlen = iph->ihl*4;
struct
icmphdr *icmph = (
struct
icmphdr *)(Buffer + iphdrlen);
fprintf
(logfile,
"\n\n***********************ICMP Packet*************************\n"
);
print_ip_header(Buffer , Size);
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"ICMP Header\n"
);
fprintf
(logfile,
" |-Type : %d"
,(unsigned
int
)(icmph->type));
if
((unsigned
int
)(icmph->type) == 11)
fprintf
(logfile,
" (TTL Expired)\n"
);
else
if
((unsigned
int
)(icmph->type) == ICMP_ECHOREPLY)
fprintf
(logfile,
" (ICMP Echo Reply)\n"
);
fprintf
(logfile,
" |-Code : %d\n"
,(unsigned
int
)(icmph->code));
fprintf
(logfile,
" |-Checksum : %d\n"
,ntohs(icmph->checksum));
//fprintf(logfile," |-ID : %d\n",ntohs(icmph->id));
//fprintf(logfile," |-Sequence : %d\n",ntohs(icmph->sequence));
fprintf
(logfile,
"\n"
);
fprintf
(logfile,
"IP Header\n"
);
PrintData(Buffer,iphdrlen);
fprintf
(logfile,
"UDP Header\n"
);
PrintData(Buffer + iphdrlen ,
sizeof
icmph);
fprintf
(logfile,
"Data Payload\n"
);
PrintData(Buffer + iphdrlen +
sizeof
icmph , (Size -
sizeof
icmph - iph->ihl * 4));
fprintf
(logfile,
"\n###########################################################"
);
}
void
PrintData (unsigned
char
* data ,
int
Size)
{
for
(i=0 ; i < Size ; i++)
{
if
( i!=0 && i%16==0)
//if one line of hex printing is complete...
{
fprintf
(logfile,
" "
);
for
(j=i-16 ; j<i ; j++)
{
if
(data[j]>=32 && data[j]<=128)
fprintf
(logfile,
"%c"
,(unsigned
char
)data[j]);
//if its a number or alphabet
else
fprintf
(logfile,
"."
);
//otherwise print a dot
}
fprintf
(logfile,
"\n"
);
}
if
(i%16==0)
fprintf
(logfile,
" "
);
fprintf
(logfile,
" %02X"
,(unsigned
int
)data[i]);
if
( i==Size-1)
//print the last spaces
{
for
(j=0;j<15-i%16;j++)
fprintf
(logfile,
" "
);
//extra spaces
fprintf
(logfile,
" "
);
for
(j=i-i%16 ; j<=i ; j++)
{
if
(data[j]>=32 && data[j]<=128)
fprintf
(logfile,
"%c"
,(unsigned
char
)data[j]);
else
fprintf
(logfile,
"."
);
}
fprintf
(logfile,
"\n"
);
}
}
}
|
Compile and Run
|
1
|
$ gcc sniffer.c && sudo ./a.out
|
The program must be run as root user or superuser privileges. e.g. sudo ./a.out in ubuntu
The program creates raw sockets which require root access.
The output in the log file is something like this :
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
***********************TCP Packet*************************
IP Header
|-IP Version : 4
|-IP Header Length : 5 DWORDS or 20 Bytes
|-Type Of Service : 32
|-IP Total Length : 137 Bytes(Size of Packet)
|-Identification : 35640
|-TTL : 51
|-Protocol : 6
|-Checksum : 54397
|-Source IP : 174.143.119.91
|-Destination IP : 192.168.1.6
TCP Header
|-Source Port : 6667
|-Destination Port : 38265
|-Sequence Number : 1237278529
|-Acknowledge Number : 65363511
|-Header Length : 5 DWORDS or 20 BYTES
|-Urgent Flag : 0
|-Acknowledgement Flag : 1
|-Push Flag : 1
|-Reset Flag : 0
|-Synchronise Flag : 0
|-Finish Flag : 0
|-Window : 9648
|-Checksum : 46727
|-Urgent Pointer : 0
DATA Dump
IP Header
45 20 00 89 8B 38 40 00 33 06 D4 7D AE 8F 77 5B E ...8@.3..}..w[
C0 A8 01 06 ....
TCP Header
1A 0B 95 79 49 BF 5F 41 03 E5 5E 37 50 18 25 B0 ...yI._A..^7P.%.
B6 87 00 00 ....
Data Payload
3A 6B 61 74 65 60 21 7E 6B 61 74 65 40 75 6E 61 :kate`!~kate@una
66 66 69 6C 69 61 74 65 64 2F 6B 61 74 65 2F 78 ffiliated/kate/x
2D 30 30 30 30 30 30 31 20 50 52 49 56 4D 53 47 -0000001 PRIVMSG
20 23 23 63 20 3A 69 20 6E 65 65 64 20 65 78 61 ##c :i need exa
63 74 6C 79 20 74 68 65 20 72 69 67 68 74 20 6E ctly the right n
75 6D 62 65 72 20 6F 66 20 73 6F 63 6B 73 21 0D umber of socks!.
0A .
###########################################################
***********************TCP Packet*************************
IP Header
|-IP Version : 4
|-IP Header Length : 5 DWORDS or 20 Bytes
|-Type Of Service : 32
|-IP Total Length : 186 Bytes(Size of Packet)
|-Identification : 56556
|-TTL : 48
|-Protocol : 6
|-Checksum : 22899
|-Source IP : 74.125.71.147
|-Destination IP : 192.168.1.6
TCP Header
|-Source Port : 80
|-Destination Port : 49374
|-Sequence Number : 3136045905
|-Acknowledge Number : 2488580377
|-Header Length : 5 DWORDS or 20 BYTES
|-Urgent Flag : 0
|-Acknowledgement Flag : 1
|-Push Flag : 1
|-Reset Flag : 0
|-Synchronise Flag : 0
|-Finish Flag : 0
|-Window : 44765
|-Checksum : 15078
|-Urgent Pointer : 0
DATA Dump
IP Header
45 20 00 BA DC EC 00 00 30 06 59 73 4A 7D 47 93 E ......0.YsJ}G.
C0 A8 01 06 ....
TCP Header
00 50 C0 DE BA EC 43 51 94 54 B9 19 50 18 AE DD .P....CQ.T..P...
3A E6 00 00 :...
Data Payload
48 54 54 50 2F 31 2E 31 20 33 30 34 20 4E 6F 74 HTTP/1.1 304 Not
20 4D 6F 64 69 66 69 65 64 0D 0A 58 2D 43 6F 6E Modified..X-Con
74 65 6E 74 2D 54 79 70 65 2D 4F 70 74 69 6F 6E tent-Type-Option
73 3A 20 6E 6F 73 6E 69 66 66 0D 0A 44 61 74 65 s: nosniff..Date
3A 20 54 68 75 2C 20 30 31 20 44 65 63 20 32 30 : Thu, 01 Dec 20
31 31 20 31 33 3A 31 36 3A 34 30 20 47 4D 54 0D 11 13:16:40 GMT.
0A 53 65 72 76 65 72 3A 20 73 66 66 65 0D 0A 58 .Server: sffe..X
2D 58 53 53 2D 50 72 6F 74 65 63 74 69 6F 6E 3A -XSS-Protection:
20 31 3B 20 6D 6F 64 65 3D 62 6C 6F 63 6B 0D 0A 1; mode=block..
0D 0A ..
###########################################################
|
Note
1. The above sniffer picks up only TCP packets, because of the declaration :
|
1
|
sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);
|
For UDP and ICMP the declaration has to be :
|
1
2
|
sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_UDP);
sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_ICMP);
|
You might be tempted to think of doing :
|
1
|
sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);
|
but this will not work , since IPPROTO_IP is a dummy protocol not a real one.
2. This sniffer picks up only incoming packets.
3. It provides the application with IP frames, which means that ethernet headers are not available.
4. It is not very accurate since it misses out some packets even in the incoming ones.
5. libpcap can also be used to write sniffers. Code example here.
In Part 2 we shall see how the above mentioned drawbacks can be overcome.
