Why am i getting these strange packets while running my packet capture module written in c.? Post: 302769036

Sponsored Content

Top Forums Programming Why am i getting these strange packets while running my packet capture module written in c.? Post 302769036 by arunpushkar on Monday 11th of February 2013 05:31:53 AM

02-11-2013

Registered User

Why am i getting these strange packets while running my packet capture module written in c.?

I have made an packet capture application running on intel machine, it is capturing packets with src address- 17.0.0.0 destination ip- 66.0.0.0, source port- 0, destination port- 0, and protocol- 0 what does these packets mean ?
The code written to interpreter captured bytes is given below. Which basically locate source address, destination address, source port, destination port, and protocol from various headers from packet captured. After it is done then only TCP and UDP packets are stored into a file. so it means only those packets having protocol number 6,17 should be saved but when i go through the file the packets with protocol 0,20,255,100,8,66 are also saved more over strange IP address are also seen like.2.8.2.8, 17.0.0.0, 66.0.0.0, 0.0.0.0 etc what are these packets, am i correct in my approach.

Code:

 inline u_int32_t hash_function(const u_char *packet, int pkt_len) 
{
  u_int32_t hash=0;
  u_int8_t next_protocol;
  u_int32_t src_ip,dst_ip;  
  u_short  src_p,dst_p;       
  
  
  unsigned short ip_hdr_len;
  
      // Checking if it is a IPv4 or IPv6 packet
    struct ether_header *eptr;  /* net/ethernet.h */
    eptr = (struct ether_header *) packet;

    if (ntohs (eptr->ether_type) == ETHERTYPE_IP) // means it is IPv4 pkt
        {
            struct iphdr *ip4h = (struct iphdr *)(packet  + sizeof(struct ethhdr) );
        ip_hdr_len =ip4h->ihl*4;
        next_protocol=ip4h->protocol;
        pktFeatures.src_ip=ntohl(ip4h->saddr);
        pktFeatures.dst_ip=ntohl(ip4h->daddr);
        pktFeatures.pkt_len=pkt_len;
        switch (next_protocol) //Check the Protocol and do accordingly...
        {
        case 6:  //TCP Protocol
               {
                struct tcphdr *tcph=(struct tcphdr*)(packet + ip_hdr_len + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(tcph->th_sport);
                pktFeatures.dst_p=ntohs(tcph->th_dport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);
            }
            break;
        case 17: //UDP Protocol
            {
                struct udphdr *udph = (struct udphdr*)(packet + ip_hdr_len  + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(udph->uh_sport);
                pktFeatures.dst_p=ntohs(udph->uh_sport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);                 
            }
            break;
        default: //Some Other Protocol like ARP FTP etc.
            {
                printf(" * Some Other Protocol \n");
                            
            }
        }
        int rm=0;
        }/*else  if (ntohs (eptr->ether_type) == ETHERTYPE_IPV6) // means it is IPv6 pkt
            {
                
            u_int32_t *s, *d;
            struct ip6_hdr *ip6h = (struct ip6_hdr *)(packet  + sizeof(struct ethhdr) );
            ip_hdr_len=320;
            next_protocol=ip6h->ip6_un1_nxt; // is the next protocol type
            s = (u_int32_t *) &ip6h->ip6_src, d = (u_int32_t *) &ip6h->ip6_dst;
            hash=(s[0] + s[1] + s[2] + s[3] + d[0] + d[1] + d[2] + d[3]+ip6h->ip6_un1_nxt); // ip6_un1_nxt is the next protocol                                         type TCP/UDP can be extention header ? need to be catered for
             
            }else hash=0;
         */
         
 return hash;

}

arunpushkar

View Public Profile for arunpushkar

Find all posts by arunpushkar

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to capture multicast packets using snoop

How do I use snoop command to capture multicast packets in the network?

2. AIX

Capture Network Packets from AIX

Hi, I am using smitty to create and configure a print queue. I am giving a print of a text file to the print queue created. I am using this in network. How to capture network packets of the print from AIX to the printer and printer to AIX. I tried Wireshark to capture network packets. I am...

3. Infrastructure Monitoring

capture snmp packets in AIX

Hi, I want to capture snmp packets in AIX. When i give print from AIX6.1, Printer will give its response thru' snmp. I used iptrace command like below, but it is not capturing snmp packets other packets are captured like udp, tcp.. 1. iptrace command: /usr/sbin/iptrace -a -i en0...

4. IP Networking

Capture packets (TcpDump) and forwarding them

Hi, I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are: 1- after filtering input packets, those that have not...

5. Programming

Receiving broadcast packets using packet socket

Hello I try to send DHCP RENEW packets to the network and receive the responses. I broadcast the packet and I can see that it's successfully sent using Wireshark. But I have difficulties receiving the responses.I use packet sockets to catch the packets. I can see that there are responses to my...

6. Programming

packet capture

can anyone tell me how can i capture the packets. i have tried ethernet software to capture them but its not doing what i want it to do it

7. Programming

Linking Linux Driver written in C with ASM module

Hi, I have got sample linux driver written in C. I got also some assembly code, compiled into .o file (using as compiler). In my Makefile I got: obj-m += someDriver.o someDriver-objs := CFile1.o CFile2.o ASMFile.o default: $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modulesUnfortunatelly I cannot...

8. UNIX for Advanced & Expert Users

How many packets can be written into Kernel sockets per second?

Hi, Its been a long time since i programmed a multithreaded application that can do Tx and Rx of datagrams over unix sockets. I well remember that though the threads were efficiently designed to be independent of each other, and was writing to different sockets, there was a limitation ,...

LEARN ABOUT NETBSD

iptest

IPTEST(1)						      General Commands Manual							 IPTEST(1)

NAME

       iptest - automatically generate packets to test IP functionality

SYNOPSIS

       iptest [ -1234567 ] [ -d <device> ] [ -g <gateway> ] [ -m <MTU> ] [ -p <pointtest> ] [ -s <source> ] <destination>

DESCRIPTION

       iptest ...

OPTIONS

       -1     Run  IP  test  group  #1.   This group of tests generates packets with the IP header fields set to invalid values given other packet
	      characteristics.	The point tests are: 1 (ip_hl < ip_len), 2 (ip_hl > ip_len), 3 (ip_v < 4), 4 (ip_v > 4), 5 (ip_len  <  packetsize,
	      long  packets),  6 (ip_len > packet size, short packets), 7 (Zero length fragments), 8 (packet > 64k after reassembly), 9 (IP offset
	      with MSB set), 10 (ttl variations).

       -2     Run IP test group #2.  This group of tests generates packets with the IP options constructed with invalid values given other  packet
	      characteristics.	The point tests are: 1 (option length > packet length), 2 (option length = 0).

       -3     Run  IP  test  group  #3.   This group of tests generates packets with the ICMP header fields set to non-standard values.  The point
	      tests are: 1 (ICMP types 0-31 & 255), 2 (type 3 & code 0 - 31), 3 (type 4 & code 0, 127, 128, 255), 4 (type 5 & code  0,	127,  128,
	      255),  5	(types	8-10,13-18  with  codes 0, 127, 128 and 255), 6 (type 12 & code 0, 127, 128, 129, 255) and 7 (type 3 & codes 9-10,
	      13-14 and 17-18 - shortened packets).

       -4     Run IP test group #4.  This group of tests generates packets with the UDP header fields set to non-standard values.  The point tests
	      are:  1  (UDP  length  >	packet	size), 2 (UDP length < packetsize), 3 (sport = 0, 1, 32767, 32768, 65535), 4 (dport = 0, 1, 32767,
	      32768, 65535) and 5 (sizeof(struct ip) <= MTU <= sizeof(struct udphdr) + sizeof(struct ip)).

       -5     Run IP test group #5.  This group of tests generates packets with the TCP header fields set to non-standard values.  The point tests
	      are:  1  (TCP  flags  variations,  all  combinations),  2  (seq  =  0,  0x7fffffff, 0x8000000, 0xa0000000, 0xffffffff),  3 (ack = 0,
	      0x7fffffff, 0x8000000, 0xa0000000, 0xffffffff), 4 (SYN packet with window of 0, 32768, 65535), 5 (set urgent pointer to  1,  0x7fff,
	      0x8000, 0xffff), 6 (data offset), 7 (sport = 0, 1, 32767, 32768, 65535) and 8 (dport = 0, 1, 32767, 32768, 65535).

       -6     Run IP test group #6.  This test generates a large number of fragments in an attempt to exhaust the network buffers used for holding
	      packets for later reassembly.  WARNING: this may crash or cause serious performance degradation to the target host.

       -7     Run IP test group #7.  This test generates 1024 random IP packets with only the IP version, checksum, length  and  IP  offset  field
	      correct.

       -d <interface>
	      Set the interface name to be the name supplied.

       -g <gateway>
	      Specify  the  hostname of the gateway through which to route packets.  This is required whenever the destination host isn't directly
	      attached to the same network as the host from which you're sending.

       -m <MTU>
	      Specify the MTU to be used when sending out packets.  This option allows you to set a fake MTU, allowing the simulation  of  network
	      interfaces with small MTU's without setting them so.

       -p <test>
	      Run a...

SEE ALSO

       ipresend(1), ipsend(1), bpf(4), ipsend(5)

DIAGNOSTICS

       Only one of the numeric test options may be given when iptest is run.

       Needs to be run as root.

BUGS

       If you find any, please send email to me at darrenr@pobox.com

																	 IPTEST(1)