{"id":1006,"date":"2013-09-10T13:05:03","date_gmt":"2013-09-10T05:05:03","guid":{"rendered":"http:\/\/www.dogeye.net\/?p=1006"},"modified":"2013-09-10T13:05:03","modified_gmt":"2013-09-10T05:05:03","slug":"linux%e6%8a%93%e5%8c%85%e6%8a%80%e6%9c%af%e7%ae%80%e4%bb%8b","status":"publish","type":"post","link":"https:\/\/ykyi.net\/?p=1006","title":{"rendered":"Linux\u6293\u5305\u6280\u672f\u7b80\u4ecb"},"content":{"rendered":"
\n

Linux\u6293\u5305\u6280\u672f\u7b80\u4ecb<\/p>\n

Author: zausiu@gmail.com<\/p>\n

1. \u7b80\u4ecb<\/p>\n

\u5927\u591a\u6570\u5e94\u7528\u5e38\u666f\u4e0b\uff0c\u6211\u4eec\u5728IP\u5c42\u4e0a\u7528AF_INET\u6216AF_INET6\u4f5c\u4e3asocket\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\uff0cSOCK_STREAM\u6216SOCK_DGRAM\u4f5c\u4e3asocket\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u521b\u5efa\u6700\u4e3a\u5e38\u89c1\u7684IPv4\u6216IPv6\u7684TCP\u6216UDP\u5957\u63a5\u5b57\u3002\u8fd9\u6837\u7684\u5957\u63a5\u5b57\u6ee1\u8db3\u4e86\u7edd\u5927\u591a\u6570\u7f51\u7edc\u5e94\u7528\u5e38\u666f\u3002<\/p>\n

 <\/p>\n

\u672c\u6587\u7b80\u5355\u4ecb\u7ecd\u4e09\u79cdLinux\u5e73\u53f0\u4e0b\u6293\u5305\uff0c\u622a\u83b7\u5305\u7684\u6280\u672f\u3002\u5b83\u4eec\u63d0\u4f9b\u4e00\u4e9b\u66f4\u9177\u7684\u529f\u80fd\u3002\u6bcf\u79cd\u6280\u672f\u7684\u6c34\u90fd\u5f88\u6df1\uff0c\u4f5c\u8005\u4e2a\u4eba\u6c34\u5e73\u6709\u9650\uff0c\u6309\u7167\u81ea\u5df1\u7684\u7406\u89e3\u505a\u4e00\u822c\u7684\u4ecb\u7ecd\u3002\u4ec5\u4ec5\u65e8\u5728\u8d77\u5230\u79d1\u8c31\u7684\u4f5c\u7528\u3002<\/p>\n

 <\/p>\n

2. RAW SOCKET<\/p>\n

\u53c2\u6570SOCK_RAW\u53ef\u4ee5\u4f5c\u4e3asocket\u51fd\u6570\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u4f20\u5165\uff0c\u8fd9\u6837\u521b\u5efa\u7684\u5957\u63a5\u5b57\u79f0\u4e3a\u539f\u59cb\u5957\u63a5\u5b57\u3002\u8bbe\u7f6eSocket\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u53ef\u4ee5\u8ba9\u6307\u5b9a\u539f\u59cb\u5957\u63a5\u5b57\u5f00\u5728\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u6216\u8005\u7f51\u7edc\u5c42\u3002<\/p>\n

 <\/p>\n

\u4e0b\u9762\u7684\u8bed\u53e5\u521b\u5efa\u5728\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u539f\u59cbsocket\u3002<\/p>\n

Socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));  <\/p>\n

\u5728\u8d1f\u8f7d\u4e0d\u5927\u7684\u60c5\u51b5\u4e0b\uff0c\u8bfb\u8fd9\u4e2asocket\u53ef\u4ee5\u62ff\u5230\u672c\u673a\u6536\u5230\u7684\u6240\u6709\u6570\u636e\u5305\u3002\u5199\u5165\u8fd9\u4e2asocket\u9700\u8981\u7a0b\u5e8f\u5458\u8d1f\u8d23\u586b\u5145\u5404\u79cd\u5305\u5934\u7684\u6570\u636e\u3002<\/p>\n

 <\/p>\n

Socket(AF_INET, SOCK_RAW, xxxxx\u534f\u8bae\u53f7)\uff1b<\/p>\n

\u5728IP\u5c42\u4e0a\u521b\u5efaIPv4\u7684RAW socket\uff0c\u53ef\u4ee5\u62ff\u5230\u5404\u79cd\u7ecf\u7531IPv4\u7684\u6570\u636e\u5305\uff0c\u6bd4\u5982ICMP\u5305\uff0cIGMP\u5305\u7b49\u3002Steven\u7684<Unix\u7f51\u7edc\u7f16\u7a0b>\u7b2c\u4e09\u7248\u7b2c28.4\u8282\uff0c\u7b2c\u4e8c\u6bb5\uff1a“\u7cfb\u7edf\u6536\u5230\u7684UDP\u5305\u548cTCP\u5305\u4e0d\u4f1a\u4f20\u7ed9\u539f\u59cb\u5957\u63a5\u5b57”\u3002\u4f46\u8bfbtcpcopy\u7684\u6e90\u4ee3\u7801\u65f6\uff0c\u786e\u5b9e\u7528\u4e86\u539f\u59cb\u5957\u63a5\u5b57\u5728\u7f51\u7edc\u5c42\u8bfbUDP\u548cTCP\u5305\u3002\u96be\u9053\u4e66\u4e0a\u5199\u7684\u8fc7\u65f6\u4e86\u3002\u89c1\u4ee3\u7801\uff0c\u6765\u81eatcpcopy\uff1a<\/p>\n

#if (TCPCOPY_UDP)<\/p>\n

        fd = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);<\/p>\n

#else<\/p>\n

        fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);<\/p>\n

#endif<\/p>\n

\u53e6\u5916\uff0c\u5728IP\u5c42\u4e0a\u521b\u5efa\u7684\u539f\u59cb\u5957\u63a5\u5b57\u6709\u4e00\u4e2a\u9009\u9879\uff1aIP_HDRINCL\uff0c\u5b83\u88ab\u5f00\u542f\u65f6\uff0c\u5219\u5185\u6838\u5e2e\u52a9\u586b\u5145IP\u5305\u5934\u3002Linux\u9ed8\u8ba4\u6ca1\u6709\u5f00\u542f\u8fd9\u4e2a\u9009\u9879\u3002<\/p>\n

 <\/p>\n

3. NF_Queue<\/p>\n

NF_Queue\u662f\u7528\u6237\u7a7a\u95f4\u7684\u4e00\u4e2a\u5e93\uff0c\u9700\u8981\u5185\u6838\u6a21\u5757NETFILTER_NETLINK_QUEUE\u7684\u652f\u6301\u3002\u5b98\u65b9\u7f51\u5740\uff1ahttp:\/\/www.netfilter.org<\/a>\u3002\u901a\u8fc7\u8fd9\u4e2a\u5e93\u53ef\u4ee5\u5728\u6570\u636e\u5305\u88ab\u53d1\u5f80\u7528\u6237\u7a7a\u95f4\u5904\u7406\u524d\u622a\u83b7\u6570\u636e\u5305\uff0c\u6216\u8005\u5728\u6570\u636e\u5305\u88ab\u53d1\u5f80\u7f51\u5361\u524d\u622a\u83b7\u6570\u636e\u5e93\u3002\u622a\u83b7\u540e\uff0c\u53ef\u4ee5\u4fee\u6539\u6570\u636e\u5305\u7684\u5185\u5bb9\uff0c\u5e76\u51b3\u5b9a\u662f\u5426\u4e22\u5145\u8fd9\u4e2a\u6570\u636e\u5e93\u3002<\/p>\n

NF_Queue\u53ef\u4ee5\u7528\u6765\u7f16\u5199\u9632\u706b\u5899\u7b49\u5b89\u5168\u8f6f\u4ef6\u3002<\/p>\n

Tcpcopy\u4f7f\u7528NF_Queue\u4e22\u5f03\u6d4b\u8bd5\u4e2d\u7684\u7a0b\u5e8f\u56de\u590d\u7ed9\u771f\u5b9e\u5ba2\u6237\u7a0b\u5e8f\u7684\u6570\u636e\u5305\uff0c\u4f7f\u6d4b\u8bd5\u4e2d\u7a0b\u5e8f\u56de\u590d\u7684\u62a5\u6587\u4e0d\u5f71\u54cd\u771f\u5b9e\u5ba2\u6237\u7a0b\u5e8f\u3002<\/p>\n

\u53e6\u4e00\u4e2a\u63d0\u4f9b\u7c7b\u4f3c\u529f\u80fd\u7684\u5e93\u662fIP_Queue\uff0c\u5b83\u5df2\u7ecf\u88ab\u5e9f\u5f03\u3002NF_Queue\u53ef\u4ee5\u5b8c\u5168\u53d6\u4ee3IP_Queue\u3002\u6211\u4eec\u7528\u7684tlinux\uff0c\u5185\u6838\u4e2dbuilt-in\u4e86NF_Queue\u6a21\u5757\u3002<\/p>\n

 <\/p>\n

4. libpcap<\/p>\n

\u5927\u540d\u9f0e\u9f0e\u7684Libpcap\u662f\u4e00\u4e2a\u53e4\u8001\u7684\u53ef\u4ee5\u5de5\u4f5c\u5728\u6240\u6709Unix-like\u5e73\u53f0\u4e0a\u7684\u6293\u5305\u5e93\uff0c\u6bd4linux\u5e74\u7eaa\u66f4\u5927\u3002Tcpdump\u7684\u5e7f\u6cdb\u4f7f\u7528\u8ba9libpcap\u6210\u4e3a\u4e8b\u5b9e\u4e0a\u7684\u884c\u4e1a\u6807\u51c6\u3002\u5b83\u53ef\u4ee5\u5f88\u65b9\u4fbf\u7684\u7f16\u5199\u6293\u53d6\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u6570\u636e\u5305\uff0c\u5e76\u53ef\u4ee5\u8bbe\u7f6e\u8fc7\u6ee4\u6761\u4ef6\u5728\u5185\u6838\u7ea7\u522b\u53ea\u590d\u5236\u5173\u5fc3\u7684\u6570\u636e\u5305\uff0c\u800c\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u539f\u59cb\u5957\u63a5\u5b57\u4f1a\u5c3d\u6700\u5927\u52aa\u529b\u590d\u5236\u6240\u6709\u7684\u5305\uff0c\u6240\u4ee5libpcap\u7684\u5de5\u4f5c\u6548\u7387\u9ad8\u3002\u800c\u4e14\uff0cpcap\u4f7f\u7528\u65b9\u4fbf\u3002\u4e0b\u9762\u662f\u4e00\u4e2a\u5f88\u7b80\u5355\u7684\u4f7f\u7528pcap\u6293\u5230\u53d1\u5f8080\u7aef\u53e3\u7684tcp\u5305\u5e76\u6253\u5370\u6e90IP\uff0c\u76ee\u7684IP\uff0c\u548c\u76ee\u7684\u7aef\u53e3\u53f7\u7684\u7a0b\u5e8f\u3002\u975e\u5e38\u77ed\uff0c\u5f88\u5bb9\u6613\u770b\uff0c\u8d77\u5230\u4ecb\u7ecdlibpcap\u7684\u4f5c\u7528\u3002<\/p>\n

 int main(int argc, char *argv[])<\/p>\n

 {<\/p>\n

pcap_t *handle; \/\/ pcap\u7528\u7684\u53e5\u67c4\uff0c\u548c\u5176\u5b83\u5404\u79cd\u53e5\u67c4\u4e00\u6837\u3002<\/p>\n

char *dev;         \/\/ \u7f51\u7edc\u63a5\u53e3\u540d\uff0c\u5982eth0, eth1, tunl0 \u4e4b\u7c7b<\/p>\n

char errbuf[PCAP_ERRBUF_SIZE]; \/\/ \u5b58\u63cf\u8ff0\u51fa\u9519\u539f\u56e0\u7684\u7f13\u51b2<\/p>\n

struct bpf_program fp;         \/\/ pcap\u7528\u6765\u8fc7\u6ee4\u6570\u636e\u5305\u7528<\/p>\n

char filter_exp[] = "tcp and dst port 80"; \/\/ \u8fc7\u6ee4\u5b57\u7b26\u4e32\uff0c\u548ctcpdump\u7684\u5199\u6cd5\u4e00\u6837<\/p>\n

struct pcap_pkthdr header;      \/\/ pcap\u81ea\u5df1\u7528\u7684\u5305\u5934<\/p>\n

const u_char *packet;         \/\/ pcap\u5305\u5934\u540e\u7684\u6570\u636e\uff0c\u5373\u6293\u5230\u7684\u6570\u636e<\/p>\n

 <\/p>\n

int len_of_iphdr;         \/\/ ip\u5934\u7684\u957f\u5ea6<\/p>\n

struct in_addr src_ip;    \/\/ \u6e90IP\u5730\u5740<\/p>\n

struct in_addr dst_ip;    \/\/ \u76ee\u7684IP<\/p>\n

const u_char *ip_hdr_addr; \/\/ IP\u5934\u7684\u9996\u5730\u5740<\/p>\n

const u_char *tcp_hdr_addr;     \/\/ tcp\u5934\u7684\u9996\u5730\u5740<\/p>\n

struct tcphdr *tcp_hdr;         \/\/ tcp\u5934\u7ed3\u6784\u4f53<\/p>\n

u_short dst_port;             \/\/ \u76ee\u7684\u7aef\u53e3<\/p>\n

 <\/p>\n

\/\/ \u5982\u679c\u547d\u4ee4\u884c\u6307\u5b9a\u7f51\u5361\u540d<\/p>\n

if (argv[1])<\/p>\n

dev = argv[1]; \/\/\u5c31\u7528\u6307\u5b9a\u7684\u7f51\u5361<\/p>\n

else<\/p>\n

dev = "eth0"; \/\/\u5426\u5219\u7528eth0<\/p>\n

 <\/p>\n

}<\/p>\n

        <\/p>\n

        \/\/ \u7528pcap\u6253\u5f00\u8fd9\u4e2a\u7f51\u5361<\/p>\n

handle = pcap_open_live(dev, BUFSIZ, 0, 1000, errbuf);<\/p>\n

if (handle == NULL) {  \/\/ \u6253\u5f00\u7f51\u5361\u51fa\u9519<\/p>\n

fprintf(stderr, "Couldn't open device %s: %s\\n", dev, errbuf);<\/p>\n

return(2);<\/p>\n

}<\/p>\n

      <\/p>\n

        \/\/ \u7f16\u8bd1\u8fc7\u6ee4\u6587\u4ef6<\/p>\n

if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {<\/p>\n

fprintf(stderr, "Couldn't parse filter %s: %s\\n", filter_exp, pcap_geterr(handle));<\/p>\n

return(2);<\/p>\n

}<\/p>\n

        \/\/ \u8bbe\u7f6e\u8fc7\u6ee4\u6761\u4ef6<\/p>\n

if (pcap_setfilter(handle, &fp) == -1) {<\/p>\n

fprintf(stderr, "Couldn't install filter %s: %s\\n", filter_exp, pcap_geterr(handle));<\/p>\n

return(2);<\/p>\n

}<\/p>\n

 <\/p>\n

        \/\/ \u6293\u5305<\/p>\n

packet = pcap_next(handle, &header);<\/p>\n

 <\/p>\n

\/\/ \u81f3\u6b64packet\u6307\u5411\u6293\u5230\u7684\u4e00\u4e2a\u76ee\u6807\u7aef\u53e3\u53f7\u662f80\u7684\u6570\u636e\u94fe\u8def\u5c42\u7684\u5305<\/p>\n

\/\/ \u5b83\u7684\u5305\u7ed3\u6784\u662f 14\u5b57\u8282\u4ee5\u592a\u7f51\u5305\u5934 + \u53ef\u53d8IPv4\u5305\u5934 + TCP\u5305\u5934<\/p>\n

ip_hdr_addr = (u_char*)(packet + sizeof(struct ethernet_hdr));<\/p>\n

src_ip.s_addr = ((struct iphdr*)ip_hdr_addr)->saddr;<\/p>\n

dst_ip.s_addr = ((struct iphdr*)ip_hdr_addr)->daddr;<\/p>\n

len_of_iphdr = ((struct iphdr*)ip_hdr_addr)->ihl * 4;<\/p>\n

tcp_hdr_addr = ip_hdr_addr + len_of_iphdr;<\/p>\n

tcp_hdr = (struct tcphdr*)tcp_hdr_addr;<\/p>\n

dst_port = tcp_hdr->dest;<\/p>\n

 <\/p>\n

\/\/ \u7ecf\u8fc7\u4e0a\u9762\u7684\u5404\u79cd\u6307\u9488\u504f\u79fb\uff0c\u4e0b\u9762\u6253\u5370\u6e90IP\u548c\u76ee\u6807IP\u548c\u76ee\u6807\u7aef\u53e3.<\/p>\n

printf("src addr %s\\n", inet_ntoa(src_ip));<\/p>\n

printf("dst addr %s\\n", inet_ntoa(dst_ip));<\/p>\n

printf("dst_port %d\\n", ntohs(dst_port));<\/p>\n

 <\/p>\n

\/* And close the session *\/<\/p>\n

pcap_close(handle);<\/p>\n

 <\/p>\n

return(0);<\/p>\n

 }<\/p>\n

 <\/p>\n

5. \u603b\u7ed3<\/p>\n

\u672c\u6587\u53ea\u662f\u4e00\u4e2a\u975e\u5e38\u7b80\u5355\u7684\u4ecb\u7ecd\u3002\u5982\u9700\u8981\u8fdb\u9636\u5b66\u4e60\uff0cStevens\u7684\u7f51\u7edc\u7f16\u8bd1\u6709\u66f4\u8be6\u7ec6\u5730\u5173\u4e8eRaw Socket\u7684\u5185\u5bb9\uff0c\u7814\u7a76NF_Queue\u6280\u672f\u5219\u9700\u8981\u8bfb\u6e90\u4ee3\u7801\u548c\u6536\u96c6\u6563\u5728\u793e\u533a\u5404\u4e2a\u89d2\u843d\u7684\u8d44\u6599\u4e86\uff0c\u800c\u8bb2libpcap\u6709\u4e24\u7bc7\u5f88\u597d\u7684\u6587\u7ae0\uff1a<\/p>\n

"Programming with Libpcap – Sniffing the network from our own application <\/a>"\u7528Libpcap\u7f16\u7a0b\uff0c\u5728\u6211\u4eec\u7684\u7a0b\u5e8f\u4e2d\u55c5\u63a2\u7f51\u7edc\u3002\u975e\u5e38\u6f02\u4eae\u7684pdf\u6587\u6863\u3002<\/p>\n

http:\/\/recursos.aldabaknocking.com\/libpcapHakin9LuisMartinGarcia.pdf<\/a><\/p>\n

The Sniffer’s Guide to Raw Traffic<\/a> \u55c5\u63a2\u5668\u6559\u7a0b\u3002\u65af\u5766\u798f\u5927\u5b66\u7684Geek\u4e8e\u5927\u69822001\u5e74\u5199\u7684\u3002<\/p>\n

http:\/\/yuba.stanford.edu\/~casado\/pcap\/section1.html<\/a><\/p>\n

copyright ykyi.net<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Linux\u6293\u5305\u6280\u672f\u7b80\u4ecb Author: zausiu@gmail.com 1. \u7b80\u4ecb \u5927\u591a\u6570\u5e94\u7528\u5e38\u666f\u4e0b\uff0c\u6211\u4eec\u5728IP\u5c42\u4e0a\u7528AF_INET\u6216AF_INET6\u4f5c\u4e3asocket\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\uff0cSOCK_STREAM\u6216SOCK_DGRAM\u4f5c\u4e3asocket\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u521b\u5efa\u6700\u4e3a\u5e38\u89c1\u7684IPv4\u6216IPv6\u7684TCP\u6216UDP\u5957\u63a5\u5b57\u3002\u8fd9\u6837\u7684\u5957\u63a5\u5b57\u6ee1\u8db3\u4e86\u7edd\u5927\u591a\u6570\u7f51\u7edc\u5e94\u7528\u5e38\u666f\u3002   \u672c\u6587\u7b80\u5355\u4ecb\u7ecd\u4e09\u79cdLinux\u5e73\u53f0\u4e0b\u6293\u5305\uff0c\u622a\u83b7\u5305\u7684\u6280\u672f\u3002\u5b83\u4eec\u63d0\u4f9b\u4e00\u4e9b\u66f4\u9177\u7684\u529f\u80fd\u3002\u6bcf\u79cd\u6280\u672f\u7684\u6c34\u90fd\u5f88\u6df1\uff0c\u4f5c\u8005\u4e2a\u4eba\u6c34\u5e73\u6709\u9650\uff0c\u6309\u7167\u81ea\u5df1\u7684\u7406\u89e3\u505a\u4e00\u822c\u7684\u4ecb\u7ecd\u3002\u4ec5\u4ec5\u65e8\u5728\u8d77\u5230\u79d1\u8c31\u7684\u4f5c\u7528\u3002   2. RAW SOCKET \u53c2\u6570SOCK_RAW\u53ef\u4ee5\u4f5c\u4e3asocket\u51fd\u6570\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u4f20\u5165\uff0c\u8fd9\u6837\u521b\u5efa\u7684\u5957\u63a5\u5b57\u79f0\u4e3a\u539f\u59cb\u5957\u63a5\u5b57\u3002\u8bbe\u7f6eSocket\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u53ef\u4ee5\u8ba9\u6307\u5b9a\u539f\u59cb\u5957\u63a5\u5b57\u5f00\u5728\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u6216\u8005\u7f51\u7edc\u5c42\u3002   \u4e0b\u9762\u7684\u8bed\u53e5\u521b\u5efa\u5728\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u539f\u59cbsocket\u3002 Socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));   \u5728\u8d1f\u8f7d\u4e0d\u5927\u7684\u60c5\u51b5\u4e0b\uff0c\u8bfb\u8fd9\u4e2asocket\u53ef\u4ee5\u62ff\u5230\u672c\u673a\u6536\u5230\u7684\u6240\u6709\u6570\u636e\u5305\u3002\u5199\u5165\u8fd9\u4e2asocket\u9700\u8981\u7a0b\u5e8f\u5458\u8d1f\u8d23\u586b\u5145\u5404\u79cd\u5305\u5934\u7684\u6570\u636e\u3002   Socket(AF_INET, SOCK_RAW, xxxxx\u534f\u8bae\u53f7)\uff1b \u5728IP\u5c42\u4e0a\u521b\u5efaIPv4\u7684RAW socket\uff0c\u53ef\u4ee5\u62ff\u5230\u5404\u79cd\u7ecf\u7531IPv4\u7684\u6570\u636e\u5305\uff0c\u6bd4\u5982ICMP\u5305\uff0cIGMP\u5305\u7b49\u3002Steven\u7684<Unix\u7f51\u7edc\u7f16\u7a0b>\u7b2c\u4e09\u7248\u7b2c28.4\u8282\uff0c\u7b2c\u4e8c\u6bb5\uff1a“\u7cfb\u7edf\u6536\u5230\u7684UDP\u5305\u548cTCP\u5305\u4e0d\u4f1a\u4f20\u7ed9\u539f\u59cb\u5957\u63a5\u5b57”\u3002\u4f46\u8bfbtcpcopy\u7684\u6e90\u4ee3\u7801\u65f6\uff0c\u786e\u5b9e\u7528\u4e86\u539f\u59cb\u5957\u63a5\u5b57\u5728\u7f51\u7edc\u5c42\u8bfbUDP\u548cTCP\u5305\u3002\u96be\u9053\u4e66\u4e0a\u5199\u7684\u8fc7\u65f6\u4e86\u3002\u89c1\u4ee3\u7801\uff0c\u6765\u81eatcpcopy\uff1a #if (TCPCOPY_UDP)         fd = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); #else         fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP); #endif \u53e6\u5916\uff0c\u5728IP\u5c42\u4e0a\u521b\u5efa\u7684\u539f\u59cb\u5957\u63a5\u5b57\u6709\u4e00\u4e2a\u9009\u9879\uff1aIP_HDRINCL\uff0c\u5b83\u88ab\u5f00\u542f\u65f6\uff0c\u5219\u5185\u6838\u5e2e\u52a9\u586b\u5145IP\u5305\u5934\u3002Linux\u9ed8\u8ba4\u6ca1\u6709\u5f00\u542f\u8fd9\u4e2a\u9009\u9879\u3002   3. NF_Queue NF_Queue\u662f\u7528\u6237\u7a7a\u95f4\u7684\u4e00\u4e2a\u5e93\uff0c\u9700\u8981\u5185\u6838\u6a21\u5757NETFILTER_NETLINK_QUEUE\u7684\u652f\u6301\u3002\u5b98\u65b9\u7f51\u5740\uff1ahttp:\/\/www.netfilter.org\u3002\u901a\u8fc7\u8fd9\u4e2a\u5e93\u53ef\u4ee5\u5728\u6570\u636e\u5305\u88ab\u53d1\u5f80\u7528\u6237\u7a7a\u95f4\u5904\u7406\u524d\u622a\u83b7\u6570\u636e\u5305\uff0c\u6216\u8005\u5728\u6570\u636e\u5305\u88ab\u53d1\u5f80\u7f51\u5361\u524d\u622a\u83b7\u6570\u636e\u5e93\u3002\u622a\u83b7\u540e\uff0c\u53ef\u4ee5\u4fee\u6539\u6570\u636e\u5305\u7684\u5185\u5bb9\uff0c\u5e76\u51b3\u5b9a\u662f\u5426\u4e22\u5145\u8fd9\u4e2a\u6570\u636e\u5e93\u3002 NF_Queue\u53ef\u4ee5\u7528\u6765\u7f16\u5199\u9632\u706b\u5899\u7b49\u5b89\u5168\u8f6f\u4ef6\u3002 Tcpcopy\u4f7f\u7528NF_Queue\u4e22\u5f03\u6d4b\u8bd5\u4e2d\u7684\u7a0b\u5e8f\u56de\u590d\u7ed9\u771f\u5b9e\u5ba2\u6237\u7a0b\u5e8f\u7684\u6570\u636e\u5305\uff0c\u4f7f\u6d4b\u8bd5\u4e2d\u7a0b\u5e8f\u56de\u590d\u7684\u62a5\u6587\u4e0d\u5f71\u54cd\u771f\u5b9e\u5ba2\u6237\u7a0b\u5e8f\u3002 \u53e6\u4e00\u4e2a\u63d0\u4f9b\u7c7b\u4f3c\u529f\u80fd\u7684\u5e93\u662fIP_Queue\uff0c\u5b83\u5df2\u7ecf\u88ab\u5e9f\u5f03\u3002NF_Queue\u53ef\u4ee5\u5b8c\u5168\u53d6\u4ee3IP_Queue\u3002\u6211\u4eec\u7528\u7684tlinux\uff0c\u5185\u6838\u4e2dbuilt-in\u4e86NF_Queue\u6a21\u5757\u3002   4. libpcap \u5927\u540d\u9f0e\u9f0e\u7684Libpcap\u662f\u4e00\u4e2a\u53e4\u8001\u7684\u53ef\u4ee5\u5de5\u4f5c\u5728\u6240\u6709Unix-like\u5e73\u53f0\u4e0a\u7684\u6293\u5305\u5e93\uff0c\u6bd4linux\u5e74\u7eaa\u66f4\u5927\u3002Tcpdump\u7684\u5e7f\u6cdb\u4f7f\u7528\u8ba9libpcap\u6210\u4e3a\u4e8b\u5b9e\u4e0a\u7684\u884c\u4e1a\u6807\u51c6\u3002\u5b83\u53ef\u4ee5\u5f88\u65b9\u4fbf\u7684\u7f16\u5199\u6293\u53d6\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u6570\u636e\u5305\uff0c\u5e76\u53ef\u4ee5\u8bbe\u7f6e\u8fc7\u6ee4\u6761\u4ef6\u5728\u5185\u6838\u7ea7\u522b\u53ea\u590d\u5236\u5173\u5fc3\u7684\u6570\u636e\u5305\uff0c\u800c\u6570\u636e\u94fe\u8def\u5c42\u4e0a\u7684\u539f\u59cb\u5957\u63a5\u5b57\u4f1a\u5c3d\u6700\u5927\u52aa\u529b\u590d\u5236\u6240\u6709\u7684\u5305\uff0c\u6240\u4ee5libpcap\u7684\u5de5\u4f5c\u6548\u7387\u9ad8\u3002\u800c\u4e14\uff0cpcap\u4f7f\u7528\u65b9\u4fbf\u3002\u4e0b\u9762\u662f\u4e00\u4e2a\u5f88\u7b80\u5355\u7684\u4f7f\u7528pcap\u6293\u5230\u53d1\u5f8080\u7aef\u53e3\u7684tcp\u5305\u5e76\u6253\u5370\u6e90IP\uff0c\u76ee\u7684IP\uff0c\u548c\u76ee\u7684\u7aef\u53e3\u53f7\u7684\u7a0b\u5e8f\u3002\u975e\u5e38\u77ed\uff0c\u5f88\u5bb9\u6613\u770b\uff0c\u8d77\u5230\u4ecb\u7ecdlibpcap\u7684\u4f5c\u7528\u3002  int main(int argc, char *argv[])  { pcap_t *handle; \/\/ pcap\u7528\u7684\u53e5\u67c4\uff0c\u548c\u5176\u5b83\u5404\u79cd\u53e5\u67c4\u4e00\u6837\u3002 char *dev;         \/\/ \u7f51\u7edc\u63a5\u53e3\u540d\uff0c\u5982eth0, eth1, tunl0 \u4e4b\u7c7b char errbuf[PCAP_ERRBUF_SIZE]; \/\/ \u5b58\u63cf\u8ff0\u51fa\u9519\u539f\u56e0\u7684\u7f13\u51b2 struct bpf_program fp;         \/\/ pcap\u7528\u6765\u8fc7\u6ee4\u6570\u636e\u5305\u7528 char filter_exp[] = "tcp and dst port 80"; \/\/ \u8fc7\u6ee4\u5b57\u7b26\u4e32\uff0c\u548ctcpdump\u7684\u5199\u6cd5\u4e00\u6837 struct pcap_pkthdr header;      \/\/ pcap\u81ea\u5df1\u7528\u7684\u5305\u5934 const u_char *packet;         \/\/ pcap\u5305\u5934\u540e\u7684\u6570\u636e\uff0c\u5373\u6293\u5230\u7684\u6570\u636e   int len_of_iphdr;         \/\/ ip\u5934\u7684\u957f\u5ea6 struct in_addr src_ip;    \/\/ \u6e90IP\u5730\u5740 struct in_addr dst_ip;    \/\/ \u76ee\u7684IP const u_char *ip_hdr_addr; \/\/ IP\u5934\u7684\u9996\u5730\u5740 const u_char *tcp_hdr_addr;     \/\/ tcp\u5934\u7684\u9996\u5730\u5740 struct tcphdr *tcp_hdr;         \/\/ tcp\u5934\u7ed3\u6784\u4f53 u_short dst_port;             \/\/ \u76ee\u7684\u7aef\u53e3 … Continue reading “Linux\u6293\u5305\u6280\u672f\u7b80\u4ecb”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,7],"tags":[50,78,102],"class_list":["post-1006","post","type-post","status-publish","format-standard","hentry","category-network","category-unix_linux","tag-libpcap","tag-tcpdump","tag-102"],"_links":{"self":[{"href":"https:\/\/ykyi.net\/index.php?rest_route=\/wp\/v2\/posts\/1006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ykyi.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ykyi.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ykyi.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ykyi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1006"}],"version-history":[{"count":0,"href":"https:\/\/ykyi.net\/index.php?rest_route=\/wp\/v2\/posts\/1006\/revisions"}],"wp:attachment":[{"href":"https:\/\/ykyi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ykyi.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ykyi.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}