🚀 go-pugleaf

salu2, estoy con un problema, estoy haciendo un sniffer con pcap y
tengo problema con la impresion del payload (el paquete en si), segun
lo que he leido en teoria esto deberia de funcionar, pero se me va de
las manos saber cual es el error a continuacion les doy el codigo por
si un alma caritativa se apiada de mi y me ayuda

de ante mano  muchas gracias

/*****************************­******************************­*********************

 # snifer v1.0
 #


 Base de un sniffer
 Requiere pcap
 jimmy


 use:     'gcc sniffer2.c -o salida -pcap'
******************************­******************************­********************/



#define __FAVOR_BSD


#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <sysexits.h>
/* capa 2 */
#include <net/ethernet.h>
/* capa 3 */
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <net/if_arp.h>


/* capa 4 */
#include "tcp.h"
#include "udp.h"
#include <netinet/ip_icmp.h>


#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>


#include "sniffer.h"


u_char *payload; /*  payload */
u_char *payload2;


int
main (int argc, char *argv[])
{
        char *dev; //el dispositivo
        char errbuf[PCAP_ERRBUF_SIZE]; //el error
        pcap_t *descr; //la conexion
        u_char* args=NULL;
        dev=pcap_lookupdev(errbuf);
        if(dev==NULL)
        {
                 printf("Error abriendo interface: %s\n",errbuf);
                 exit(1);
        }
        descr=pcap_open_live(dev,BUFSI­Z,1,-1,errbuf);
        if(descr==NULL)
        {
                printf("error abriendo conexion: %s\n",errbuf);
                exit(1);
        }
        while(1) //creo la conexion
        {
                pcap_loop(descr,1,do_pcap,NULL­);
        }
        return 0;



}


//funcion para pasar al pcap_loop pkt tiene el paquete, hdr tiene la
informacion de llegada del paquete
void do_pcap(u_char * udata, const struct pcap_pkthdr * hdr, const
u_char * pkt)
{

  if (hdr->caplen < ETHER_HDR_LEN)
  {
    printf("error paquete con tamano menor al que deberia");
    return;
  }
   int size_ethernet = sizeof(struct ether_header);
   int size_ip = sizeof(struct  ip);
   int size_tcp = sizeof(struct tcphdr);
   int size_udp=sizeof(struct udphdr);


  // payload2 = (u_char *)(pkt + size_ethernet + size_ip + size_udp);*/



  printf("paquete!!!!\n");
  printf("Tiempo: %d %d\n",hdr->ts.tv_sec,hdr->ts.t­v_usec);
  do_ethernet(pkt, hdr->caplen);
  payload = (u_char *)(pkt + size_ethernet + size_ip + size_tcp);//HERE

IS THE PROBLEM
  printf("%s\n",payload); //HERE IS THE PROBLEM



}


int do_ethernet(const u_char * pkt, int length)
{
  char buffer[PCAP_SNAPLEN];
  struct ether_header *eth =(void*) pkt;
  u_char *ptr; int i;
  u_short ether_type;
  ether_type=ntohs(eth->ether_ty­pe);
  int size_ethernet=sizeof(struct ether_header);
  int size_ip=sizeof(struct ip);
  int size_tcp=sizeof(struct tcphdr);
  payload = (u_char *)(pkt + size_ethernet + size_ip + size_tcp);
  if(ether_type==ETHERTYPE_ARP)
  {
    printf("CAPA 3 ARP");
    do_arp((struct arphdr*)buffer,length-ETHER_HD­R_LEN);
    return 0;
 }
 if(ether_type==ETHERTYPE_REVAR­P)
 {
    printf("CAPA 3 RARP");
    do_arp((struct arphdr*)buffer,length-ETHER_HD­R_LEN);
    return 0;
 }
  memcpy(buffer, pkt + ETHER_HDR_LEN, length - ETHER_HDR_LEN);

  printf("CAPA 2 -> TAMANO %d: ", length);
  printf(" Fuente MAC:");
  ptr = eth->ether_shost; i = ETHER_ADDR_LEN;
  do{
    printf("%s%x", (i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
  }while(--i>0);
  ptr = eth->ether_dhost; i = ETHER_ADDR_LEN;
  printf("\t Destino MAC:");
  do{
    printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
  }while(--i>0);
  printf(" tipo:0x %x\n", ntohs(eth->ether_type));


  return do_ip((struct ip*)buffer, length - ETHER_HDR_LEN,pkt);



}


//funcion para que ejecute si es ip
int do_ip(const struct ip * ip, int length, const u_char * pkt)
{
  char buffer[PCAP_SNAPLEN];
  int offset = ip->ip_hl << 2;
  char* p;
  printf("capa 3 -> IPv %d ", ip->ip_v);
  printf("Fuente IP %s ", inet_ntoa(ip->ip_src));
  printf("Destino IP %s ", inet_ntoa(ip->ip_dst));
  printf("protocolo %d\n", ip->ip_p);

  memcpy(buffer, (void*)ip + offset, length - offset);


  switch(ip->ip_p) {
  case IPPROTO_TCP:
    do_tcp((struct tcphdr*)buffer, length - offset);
    break;
  case IPPROTO_UDP:
    do_udp((struct udphdr*)buffer, length - offset);
    break;
  case IPPROTO_ICMP:
    do_icmp((struct icmp*)buffer, length - offset);
    break;
  default:
    return 0;
  }
  return 1;



}


//funcion para que ejecute si es tcp
int do_tcp(const struct tcphdr * tcp, int length)
{
  u_char flags;
  printf("CAPA 4 TCP-> puerto fuente:%d puerto destino:%d sequencia:
0x%x ack: 0x%x flags:", htons(tcp->th_sport), htons(tcp->th_dport),
ntohl(tcp->th_seq), ntohl(tcp->th_ack));

  if ((flags = tcp->th_flags) &
(TH_FIN|TH_SYN|TH_RST|TH_PUSH|­TH_ACK|TH_URG|TH_ECE|TH_CWR)) {
    if (flags & TH_FIN) printf(" FIN");
    if (flags & TH_SYN) printf(" SYN");
    if (flags & TH_RST) printf(" RST");
    if (flags & TH_PUSH) printf(" PUSH");
    if (flags & TH_ACK) printf(" ACK");
    if (flags & TH_URG) printf(" URG");
    if (flags & TH_ECE) printf(" ECE");
    if (flags & TH_CWR) printf(" CWR");
  }
  printf("\n\nTamano:  Payload %s\n\n",payload);
  return 1;



}


//funcion para que ejecute si es udp
int do_udp(const struct udphdr * udp, int length)
{
  printf("CAPA 4 UDP-> puerto fuente:%d puerto destino: %d\n\n",
htons(udp->uh_sport), htons(udp->uh_dport));
  return 1;


}


//funcion para que ejecute si es icmp
int do_icmp(const struct icmp * icmp, int length)
{
  printf("CAPA 4 ICMP-> tipo %d codigo %d\n\n", icmp->icmp_type,
icmp->icmp_code);
  return 1;


}


int do_arp(const struct arphdr *arp,int length)
{
 printf("-> ar_hrd:%d ar_pro %d",arp->ar_hrd,arp->ar_pro);
return 1;


}


well, kinda lame and noob, but i am started with this library, if u see

in the function do_pcap is a printf of the payload, in theory that
print the info of the package, but he only print garbage

i put the library tcp.h and udp.h if that have someting of valor


tcp.h


#ifndef _NETINET_TCP_H
#define _NETINET_TCP_H  1


#include <features.h>


/*
 * User-settable options (used with setsockopt).
 */
#define TCP_NODELAY      1      /* Don't delay send to coalesce packets
 */
#define TCP_MAXSEG       2      /* Set maximum segment size  */
#define TCP_CORK         3      /* Control sending of partial frames
*/
#define TCP_KEEPIDLE     4      /* Start keeplives after this period */

#define TCP_KEEPINTVL    5      /* Interval between keepalives */
#define TCP_KEEPCNT      6      /* Number of keepalives before death */

#define TCP_SYNCNT       7      /* Number of SYN retransmits */
#define TCP_LINGER2      8      /* Life time of orphaned FIN-WAIT-2
state */
#define TCP_DEFER_ACCEPT 9      /* Wake up listener only when data
arrive */
#define TCP_WINDOW_CLAMP 10     /* Bound advertised window */
#define TCP_INFO         11     /* Information about this connection.
*/
#define TCP_QUICKACK     12     /* Bock/reenable quick ACKs.  */


#ifdef __USE_MISC
# include <sys/types.h>


typedef u_int32_t tcp_seq;
/*
 * TCP header.
 * Per RFC 793, September, 1981.
 */
struct tcphdr
  {
    u_int16_t th_sport;         /* source port */
    u_int16_t th_dport;         /* destination port */
    tcp_seq th_seq;             /* sequence number */
    tcp_seq th_ack;             /* acknowledgement number */
#  if __BYTE_ORDER == __LITTLE_ENDIAN
    u_int8_t th_x2:4;           /* (unused) */
    u_int8_t th_off:4;          /* data offset */
#  endif
#  if __BYTE_ORDER == __BIG_ENDIAN
    u_int8_t th_off:4;          /* data offset */
    u_int8_t th_x2:4;           /* (unused) */
#  endif
    u_int8_t th_flags;
#  define TH_FIN        0x01
#  define TH_SYN        0x02
#  define TH_RST        0x04
#  define TH_PUSH       0x08
#  define TH_ACK        0x10
#  define TH_URG        0x20
#  define TH_ECE        0x40
#  define TH_CWR        0x80
    u_int16_t th_win;           /* window */
    u_int16_t th_sum;           /* checksum */
    u_int16_t th_urp;           /* urgent pointer */



};


enum
{
  TCP_ESTABLISHED = 1,
  TCP_SYN_SENT,
  TCP_SYN_RECV,
  TCP_FIN_WAIT1,
  TCP_FIN_WAIT2,
  TCP_TIME_WAIT,
  TCP_CLOSE,
  TCP_CLOSE_WAIT,
  TCP_LAST_ACK,
  TCP_LISTEN,
  TCP_CLOSING   /* now a valid state */


};


# define TCPOPT_EOL             0
# define TCPOPT_NOP             1
# define TCPOPT_MAXSEG          2
# define TCPOLEN_MAXSEG         4
# define TCPOPT_WINDOW          3
# define TCPOLEN_WINDOW         3
# define TCPOPT_SACK_PERMITTED  4               /* Experimental */
# define TCPOLEN_SACK_PERMITTED 2
# define TCPOPT_SACK            5               /* Experimental */
# define TCPOPT_TIMESTAMP       8
# define TCPOLEN_TIMESTAMP      10
# define TCPOLEN_TSTAMP_APPA    (TCPOLEN_TIMESTAMP+2) /* appendix A */

# define TCPOPT_TSTAMP_HDR      \


(TCPOPT_NOP<<24|TCPOPT_NOP<<16­|TCPOPT_TIMESTAMP<<8|TCPOLEN_T­IMESTAMP)



/*
 * Default maximum segment size for TCP.
 * With an IP MSS of 576, this is 536,
 * but 512 is probably more convenient.
 * This should be defined as MIN(512, IP_MSS - sizeof (struct
tcpiphdr)).
 */
# define TCP_MSS        512


# define TCP_MAXWIN     65535   /* largest value for (unscaled) window
*/


# define TCP_MAX_WINSHIFT       14      /* maximum window shift */


# define SOL_TCP                6       /* TCP level */


# define TCPI_OPT_TIMESTAMPS    1
# define TCPI_OPT_SACK          2
# define TCPI_OPT_WSCALE        4
# define TCPI_OPT_ECN           8


/* Values for tcpi_state.  */
enum tcp_ca_state
{
  TCP_CA_Open = 0,
  TCP_CA_Disorder = 1,
  TCP_CA_CWR = 2,
  TCP_CA_Recovery = 3,
  TCP_CA_Loss = 4



};


struct tcp_info
{
  u_int8_t      tcpi_state;
  u_int8_t      tcpi_ca_state;
  u_int8_t      tcpi_retransmits;
  u_int8_t      tcpi_probes;
  u_int8_t      tcpi_backoff;
  u_int8_t      tcpi_options;
  u_int8_t      tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4;

  u_int32_t     tcpi_rto;
  u_int32_t     tcpi_ato;
  u_int32_t     tcpi_snd_mss;
  u_int32_t     tcpi_rcv_mss;


  u_int32_t     tcpi_unacked;
  u_int32_t     tcpi_sacked;
  u_int32_t     tcpi_lost;
  u_int32_t     tcpi_retrans;
  u_int32_t     tcpi_fackets;


  /* Times. */
  u_int32_t     tcpi_last_data_sent;
  u_int32_t     tcpi_last_ack_sent;     /* Not remembered, sorry.  */
  u_int32_t     tcpi_last_data_recv;
  u_int32_t     tcpi_last_ack_recv;


  /* Metrics. */
  u_int32_t     tcpi_pmtu;
  u_int32_t     tcpi_rcv_ssthresh;
  u_int32_t     tcpi_rtt;
  u_int32_t     tcpi_rttvar;
  u_int32_t     tcpi_snd_ssthresh;
  u_int32_t     tcpi_snd_cwnd;
  u_int32_t     tcpi_advmss;
  u_int32_t     tcpi_reordering;



};


#endif /* Misc.  */

#endif /* netinet/tcp.h */


udp.h


#ifndef __NETINET_UDP_H
#define __NETINET_UDP_H    1


#include <sys/cdefs.h>
#include <sys/types.h>


__BEGIN_DECLS


/* UDP header as specified by RFC 768, August 1980. */


struct udphdr {
         u_int16_t uh_sport;           /* source port */
         u_int16_t uh_dport;           /* destination port */
         u_int16_t uh_ulen;            /* udp length */
         u_int16_t uh_sum;             /* udp checksum */



};


#define SOL_UDP            17      /* sockopt level for UDP */

__END_DECLS


#endif /* netinet/udp.h */


sniffer.h


/*****************************­******************************­*********************

 #
 #


 see 'sniffer2.c'


******************************­******************************­********************/



#define PCAP_SNAPLEN 1518
pcap_t *pcap = NULL;


void
do_pcap(u_char *, const struct pcap_pkthdr *, const u_char *);


int
do_ethernet(const u_char *, int);


int
do_ip(const struct ip *, int);


int
do_tcp(const struct tcphdr *, int);


int
do_udp(const struct udphdr *, int);


int
do_icmp(const struct icmp *, int);


int do_arp(const struct arphdr * ip, int length);




si me pueden ayudar lo aprecieria