Sponsored Content
Top Forums Programming Why am i getting these strange packets while running my packet capture module written in c.? Post 302769036 by arunpushkar on Monday 11th of February 2013 05:31:53 AM
Old 02-11-2013
Why am i getting these strange packets while running my packet capture module written in c.?

I have made an packet capture application running on intel machine, it is capturing packets with src address- 17.0.0.0 destination ip- 66.0.0.0, source port- 0, destination port- 0, and protocol- 0 what does these packets mean ?
The code written to interpreter captured bytes is given below. Which basically locate source address, destination address, source port, destination port, and protocol from various headers from packet captured. After it is done then only TCP and UDP packets are stored into a file. so it means only those packets having protocol number 6,17 should be saved but when i go through the file the packets with protocol 0,20,255,100,8,66 are also saved more over strange IP address are also seen like.2.8.2.8, 17.0.0.0, 66.0.0.0, 0.0.0.0 etc what are these packets, am i correct in my approach.
Code:
 inline u_int32_t hash_function(const u_char *packet, int pkt_len) 
{
  u_int32_t hash=0;
  u_int8_t next_protocol;
  u_int32_t src_ip,dst_ip;  
  u_short  src_p,dst_p;       
  
  
  unsigned short ip_hdr_len;
  
      // Checking if it is a IPv4 or IPv6 packet
    struct ether_header *eptr;  /* net/ethernet.h */
    eptr = (struct ether_header *) packet;

    if (ntohs (eptr->ether_type) == ETHERTYPE_IP) // means it is IPv4 pkt
        {
            struct iphdr *ip4h = (struct iphdr *)(packet  + sizeof(struct ethhdr) );
        ip_hdr_len =ip4h->ihl*4;
        next_protocol=ip4h->protocol;
        pktFeatures.src_ip=ntohl(ip4h->saddr);
        pktFeatures.dst_ip=ntohl(ip4h->daddr);
        pktFeatures.pkt_len=pkt_len;
        switch (next_protocol) //Check the Protocol and do accordingly...
        {
        case 6:  //TCP Protocol
               {
                struct tcphdr *tcph=(struct tcphdr*)(packet + ip_hdr_len + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(tcph->th_sport);
                pktFeatures.dst_p=ntohs(tcph->th_dport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);
            }
            break;
        case 17: //UDP Protocol
            {
                struct udphdr *udph = (struct udphdr*)(packet + ip_hdr_len  + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(udph->uh_sport);
                pktFeatures.dst_p=ntohs(udph->uh_sport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);                 
            }
            break;
        default: //Some Other Protocol like ARP FTP etc.
            {
                printf(" * Some Other Protocol \n");
                            
            }
        }
        int rm=0;
        }/*else  if (ntohs (eptr->ether_type) == ETHERTYPE_IPV6) // means it is IPv6 pkt
            {
                
            u_int32_t *s, *d;
            struct ip6_hdr *ip6h = (struct ip6_hdr *)(packet  + sizeof(struct ethhdr) );
            ip_hdr_len=320;
            next_protocol=ip6h->ip6_un1_nxt; // is the next protocol type
            s = (u_int32_t *) &ip6h->ip6_src, d = (u_int32_t *) &ip6h->ip6_dst;
            hash=(s[0] + s[1] + s[2] + s[3] + d[0] + d[1] + d[2] + d[3]+ip6h->ip6_un1_nxt); // ip6_un1_nxt is the next protocol                                         type TCP/UDP can be extention header ? need to be catered for
             
            }else hash=0;
         */
         
 return hash;

}

 

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to capture multicast packets using snoop

How do I use snoop command to capture multicast packets in the network? (1 Reply)
Discussion started by: caden312
1 Replies

2. AIX

Capture Network Packets from AIX

Hi, I am using smitty to create and configure a print queue. I am giving a print of a text file to the print queue created. I am using this in network. How to capture network packets of the print from AIX to the printer and printer to AIX. I tried Wireshark to capture network packets. I am... (16 Replies)
Discussion started by: meeraramanathan
16 Replies

3. Infrastructure Monitoring

capture snmp packets in AIX

Hi, I want to capture snmp packets in AIX. When i give print from AIX6.1, Printer will give its response thru' snmp. I used iptrace command like below, but it is not capturing snmp packets other packets are captured like udp, tcp.. 1. iptrace command: /usr/sbin/iptrace -a -i en0... (1 Reply)
Discussion started by: meeraramanathan
1 Replies

4. IP Networking

Capture packets (TcpDump) and forwarding them

Hi, I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are: 1- after filtering input packets, those that have not... (1 Reply)
Discussion started by: ziedf
1 Replies

5. Programming

Receiving broadcast packets using packet socket

Hello I try to send DHCP RENEW packets to the network and receive the responses. I broadcast the packet and I can see that it's successfully sent using Wireshark. But I have difficulties receiving the responses.I use packet sockets to catch the packets. I can see that there are responses to my... (0 Replies)
Discussion started by: xyzt
0 Replies

6. Programming

packet capture

can anyone tell me how can i capture the packets. i have tried ethernet software to capture them but its not doing what i want it to do it (1 Reply)
Discussion started by: dazdseg
1 Replies

7. Programming

Linking Linux Driver written in C with ASM module

Hi, I have got sample linux driver written in C. I got also some assembly code, compiled into .o file (using as compiler). In my Makefile I got: obj-m += someDriver.o someDriver-objs := CFile1.o CFile2.o ASMFile.o default: $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modulesUnfortunatelly I cannot... (0 Replies)
Discussion started by: Chrisdot
0 Replies

8. UNIX for Advanced & Expert Users

How many packets can be written into Kernel sockets per second?

Hi, Its been a long time since i programmed a multithreaded application that can do Tx and Rx of datagrams over unix sockets. I well remember that though the threads were efficiently designed to be independent of each other, and was writing to different sockets, there was a limitation ,... (0 Replies)
Discussion started by: binnyjeshan
0 Replies
IDP(4P) 																   IDP(4P)

NAME
idp - Xerox Internet Datagram Protocol SYNOPSIS
#include <sys/socket.h> #include <netns/ns.h> #include <netns/idp.h> s = socket(AF_NS, SOCK_DGRAM, 0); DESCRIPTION
IDP is a simple, unreliable datagram protocol which is used to support the SOCK_DGRAM abstraction for the Internet protocol family. IDP sockets are connectionless, and are normally used with the sendto and recvfrom calls, though the connect(2) call may also be used to fix the destination for future packets (in which case the recv(2) or read(2) and send(2) or write(2) system calls may be used). Xerox protocols are built vertically on top of IDP. Thus, IDP address formats are identical to those used by SPP. Note that the IDP port space is the same as the SPP port space (i.e. a IDP port may be "connected" to a SPP port, with certain options enabled below). In addi- tion broadcast packets may be sent (assuming the underlying network supports this) by using a reserved "broadcast address"; this address is network interface dependent. DIAGNOSTICS
A socket operation may fail with one of the following errors returned: [EISCONN] when trying to establish a connection on a socket which already has one, or when trying to send a datagram with the destina- tion address specified and the socket is already connected; [ENOTCONN] when trying to send a datagram, but no destination address is specified, and the socket hasn't been connected; [ENOBUFS] when the system runs out of memory for an internal data structure; [EADDRINUSE] when an attempt is made to create a socket with a port which has already been allocated; [EADDRNOTAVAIL] when an attempt is made to create a socket with a network address for which no network interface exists. SOCKET OPTIONS
[SO_HEADERS_ON_INPUT] When set, the first 30 bytes of any data returned from a read or recv from will be the initial 30 bytes of the IDP packet, as described by struct idp { u_short idp_sum; u_short idp_len; u_char idp_tc; u_char idp_pt; struct ns_addr idp_dna; struct ns_addr idp_sna; }; This allows the user to determine the packet type, and whether the packet was a multi-cast packet or directed specifically at the local host. When requested, gives the current state of the option, (NSP_RAWIN or 0). [SO_HEADERS_ON_OUTPUT] When set, the first 30 bytes of any data sent will be the initial 30 bytes of the IDP packet. This allows the user to determine the packet type, and whether the packet should be multi-cast packet or directed specifically at the local host. You can also misrepresent the sender of the packet. When requested, gives the current state of the option. (NSP_RAWOUT or 0). [SO_DEFAULT_HEADERS] The user provides the kernel an IDP header, from which it gleans the Packet Type. When requested, the kernel will provide an IDP header, showing the default packet type, and local and foreign addresses, if connected. [SO_ALL_PACKETS] When set, this option defeats automatic processing of Error packets, and Sequence Protocol packets. [SO_SEQNO] When requested, this returns a sequence number which is not likely to be repeated until the machine crashes or a very long time has passed. It is useful in constructing Packet Exchange Protocol packets. SEE ALSO
send(2), recv(2), intro(4N), ns(4F) 4.3 Berkeley Distribution July 30, 1985 IDP(4P)
All times are GMT -4. The time now is 04:07 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy