WINPCAP HTTP SNIFFER HOW TO

Void PrintIpHeader (unsigned char* Buffer, int Size) Printf('TCP : %d UDP : %d ICMP : %d IGMP : %d Others : %d Total : %d ', tcp, udp, icmp, igmp, others, total) Switch (iphdr->ip_protocol) //Check the Protocol and do accordingly.ĭefault: //Some Other Protocol like ARP etc. Iphdr = (IPV4_HDR *)(Buffer + sizeof(ETHER_HDR)) Void ProcessPacket(u_char* Buffer, int Size) ProcessPacket(pkt_data, header->caplen) įprintf(stderr, 'Error reading the packets: %s ', pcap_geterr(fp) )

fprintf(logfile, ' Next Packet : %ld:%ld (Packet Length : %ld bytes) ', header->ts.tv_sec, header->ts.tv_usec, header->len) įprintf(logfile, ' Next Packet : %s.%ld (Packet Length : %ld bytes) ', buffer, header->ts.tv_usec, header->len) While((res = pcap_next_ex( fp, &header, (const u_char **)&pkt_data)) >= 0) Printf('Enter the interface number you would like to sniff : ') įprintf(stderr,' Error opening adapter ') If (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) = -1)įprintf(stderr,'Error in pcap_findalldevs_ex: %s ', errbuf) įprintf(stderr,'No interfaces found! Exiting. ') * The user didn't provide a packet source: Retrieve the local device list */ Restore the byte boundary back to the previous value Unsigned short urgent_pointer // urgent pointer Unsigned char cwr :1 //Congestion Window Reduced Flag Unsigned char ack :1 //Acknowledgement Flag The length of the TCP header is always a multiple Unsigned char data_offset:4 /*The number of 32-bit words in the TCP header. Unsigned char reserved_part1:3 //according to rfc Unsigned char ns :1 //Nonce Sum Flag Added in RFC 3540. Unsigned int acknowledge // acknowledgement number - 32 bits Unsigned int sequence // sequence number - 32 bits Unsigned short dest_port // destination port Unsigned short source_port // source port Unsigned short udp_checksum // Udp checksum (optional) Unsigned short udp_length // Udp packet length Unsigned short source_port // Source port no. Unsigned int ip_destaddr // Source address Unsigned int ip_srcaddr // Source address Unsigned short ip_checksum // IP checksum Unsigned char ip_protocol // Protocol(TCP,UDP etc) Unsigned char ip_frag_offset1 //fragment offset Unsigned char ip_frag_offset :5 // Fragment offset field Unsigned short ip_id // Unique identifier Unsigned short ip_total_length // Total length Unsigned char ip_tos // IP type of service Unsigned char ip_version :4 // 4-bit IPv4 version Unsigned char ip_header_len:4 // 4-bit header length (in 32-bit words) normally=5 (Means 20 Bytes may be 24 also) } ETHER_HDR, *PETHER_HDR, FAR * LPETHER_HDR, ETHERHeader

WINPCAP HTTP SNIFFER HOW TO

Void ProcessPacket (u_char*, int) //This will decide how to digest #pragma comment(lib, 'wpcap.lib') //For winpcap #pragma comment(lib, 'ws2_32.lib') //For winsock #include 'winsock2.h' //need winsock for inet_ntoa and ntohs methods Simple Sniffer with winpcap, prints ethernet, ip, tcp, udp and icmp headers along with data dump in hex

Winpcap http sniffer