从PCap文件读取并打印出c中的IP地址和端口号，但我的结果似乎不对

我正在读一个pcap文件，我想打印出每个数据包的IP地址和端口号。 我正在使用来自http://www.tcpdump.org/pcap.htm和http://www.rhyous.com/2011/11/13/how-to-read-a-pcap-file-from-wireshark的代码-with-c / 。

这是我的代码：

#define SIZE_ETHERNET 14 #define ETHER_ADDR_LEN 6 /* Ethernet header */ struct sniff_ethernet { u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */ u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */ u_short ether_type; /* IP? ARP? RARP? etc */ }; /* IP header */ struct sniff_ip { u_char ip_vhl; /* version <> 2 */ u_char ip_tos; /* type of service */ u_short ip_len; /* total length */ u_short ip_id; /* identification */ u_short ip_off; /* fragment offset field */ #define IP_RF 0x8000 /* reserved fragment flag */ #define IP_DF 0x4000 /* dont fragment flag */ #define IP_MF 0x2000 /* more fragments flag */ #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ u_char ip_ttl; /* time to live */ u_char ip_p; /* protocol */ u_short ip_sum; /* checksum */ struct in_addr ip_src; struct in_addr ip_dst; /* source and dest address */ }; #define IP_HL(ip) (((ip)->ip_vhl) & 0x0f) #define IP_V(ip) (((ip)->ip_vhl) >> 4) /* TCP header */ struct sniff_tcp { u_short th_sport; /* source port */ u_short th_dport; /* destination port */ u_int32_t th_seq; /* sequence number */ u_int32_t th_ack; /* acknowledgement number */ u_char th_offx2; /* data offset, rsvd */ #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4) u_char th_flags; #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) u_short th_win; /* window */ u_short th_sum; /* checksum */ u_short th_urp; /* urgent pointer */ }; int main(int argc, char *argv[]) { //get file char *filename = argv[1]; //error buffer char errbuff[PCAP_ERRBUF_SIZE]; //open file and create pcap handler pcap_t * handler = pcap_open_offline(filename, errbuff); //The header that pcap gives us struct pcap_pkthdr *header; //The actual packet const u_char *packet; int packetCount = 0; int i; //write to file FILE *fp = fopen ( "result.txt", "w" ) ; //tcp info const struct sniff_ethernet *ethernet; /* The ethernet header */ const struct sniff_ip *ip; /* The IP header */ const struct sniff_tcp *tcp; /* The TCP header */ u_int size_ip; u_int size_tcp; while (pcap_next_ex(handler, &header, &packet) >= 0) { // Show the packet number printf("Packet # %i\n", ++packetCount); fprintf(fp,"Packet # %i\n", packetCount); // Show the size in bytes of the packet printf("Packet size: %d bytes\n", header->len); fprintf(fp,"Packet size: %d bytes\n", header->len); // Show a warning if the length captured is different if (header->len != header->caplen) printf("Warning! Capture size different than packet size: %ld bytes\n", header->len); // Show Epoch Time printf("Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec); fprintf(fp,"Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec); ethernet = (struct sniff_ethernet*)(packet); ip = (struct sniff_ip*)(packet + SIZE_ETHERNET); size_ip = IP_HL(ip)*4; if (size_ip th_sport, tcp->th_dport); fprintf(fp,"src port: %d dest port: %d \n", tcp->th_sport, tcp->th_dport); printf("src address: %s dest address: %s \n", inet_ntoa(ip->ip_src), inet_ntoa(ip->ip_dst)); fprintf(fp,"src address: %s dest address: %s \n", inet_ntoa(ip->ip_src), inet_ntoa(ip->ip_dst)); printf("seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack); fprintf(fp,"seq number: %u ack number: %u \n", (unsigned int)tcp-> th_seq, (unsigned int)tcp->th_ack); // Add two lines between packets printf("\n"); fprintf(fp,"\n"); } fclose (fp); return(0); } 

这是我的结果的一部分：

 Packet # 1 Packet size: 74 bytes Epoch Time: 1348895319:643493 seconds src port: 20480 dest port: 15578 src address: 128.8.126.92 dest address: 128.8.126.92 seq number: 3071009507 ack number: 2490081174 Packet # 2 Packet size: 66 bytes Epoch Time: 1348895319:643566 seconds src port: 15578 dest port: 20480 src address: 192.168.5.162 dest address: 192.168.5.162 seq number: 2490081174 ack number: 3087786723 Packet # 3 Packet size: 207 bytes Epoch Time: 1348895319:643720 seconds src port: 15578 dest port: 20480 src address: 192.168.5.162 dest address: 192.168.5.162 seq number: 2490081174 ack number: 3087786723 Packet # 4 Packet size: 66 bytes Epoch Time: 1348895320:127547 seconds src port: 20480 dest port: 15578 src address: 128.8.126.92 dest address: 128.8.126.92 seq number: 3087786723 ack number: 560766870 Packet # 5 Packet size: 1514 bytes Epoch Time: 1348895320:129417 seconds src port: 20480 dest port: 15578 src address: 128.8.126.92 dest address: 128.8.126.92 seq number: 3087786723 ack number: 560766870 

即使我使用src和dst ip地址，ip地址也是一样的。 seq数和ack数似乎太大了。 任何人都可以看到导致我的问题的原因以及如何解决它。 提前致谢。

Answer 1

1. 你确定转储中只有IP数据包吗？
2. 值以网络字节顺序排列。 您需要使用ntohl和ntohs来转换它们。
3. inet_ntoa使用静态缓冲区，以便后续调用覆盖该值（因此匹配的源和目标地址）。