Why am i getting these strange packets while running my packet capture module written in c.? | Unix Linux Forums | Programming

  Go Back    


Programming Post questions about C, C++, Java, SQL, and other programming languages here.

Why am i getting these strange packets while running my packet capture module written in c.?

Programming


Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 02-11-2013
arunpushkar arunpushkar is offline
Registered User
 
Join Date: Feb 2013
Last Activity: 11 February 2013, 11:01 PM EST
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Why am i getting these strange packets while running my packet capture module written in c.?

I have made an packet capture application running on intel machine, it is capturing packets with src address- 17.0.0.0 destination ip- 66.0.0.0, source port- 0, destination port- 0, and protocol- 0 what does these packets mean ?
The code written to interpreter captured bytes is given below. Which basically locate source address, destination address, source port, destination port, and protocol from various headers from packet captured. After it is done then only TCP and UDP packets are stored into a file. so it means only those packets having protocol number 6,17 should be saved but when i go through the file the packets with protocol 0,20,255,100,8,66 are also saved more over strange IP address are also seen like.2.8.2.8, 17.0.0.0, 66.0.0.0, 0.0.0.0 etc what are these packets, am i correct in my approach.

Code:
 inline u_int32_t hash_function(const u_char *packet, int pkt_len) 
{
  u_int32_t hash=0;
  u_int8_t next_protocol;
  u_int32_t src_ip,dst_ip;  
  u_short  src_p,dst_p;       
  
  
  unsigned short ip_hdr_len;
  
      // Checking if it is a IPv4 or IPv6 packet
    struct ether_header *eptr;  /* net/ethernet.h */
    eptr = (struct ether_header *) packet;

    if (ntohs (eptr->ether_type) == ETHERTYPE_IP) // means it is IPv4 pkt
        {
            struct iphdr *ip4h = (struct iphdr *)(packet  + sizeof(struct ethhdr) );
        ip_hdr_len =ip4h->ihl*4;
        next_protocol=ip4h->protocol;
        pktFeatures.src_ip=ntohl(ip4h->saddr);
        pktFeatures.dst_ip=ntohl(ip4h->daddr);
        pktFeatures.pkt_len=pkt_len;
        switch (next_protocol) //Check the Protocol and do accordingly...
        {
        case 6:  //TCP Protocol
               {
                struct tcphdr *tcph=(struct tcphdr*)(packet + ip_hdr_len + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(tcph->th_sport);
                pktFeatures.dst_p=ntohs(tcph->th_dport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);
            }
            break;
        case 17: //UDP Protocol
            {
                struct udphdr *udph = (struct udphdr*)(packet + ip_hdr_len  + sizeof(struct ethhdr));
                pktFeatures.src_p=ntohs(udph->uh_sport);
                pktFeatures.dst_p=ntohs(udph->uh_sport);
                pktFeatures.protocol=next_protocol;
                writeBytes((char *)&pktFeatures,sizeof(struct packet_features),WRITE_TO_FILE);                 
            }
            break;
        default: //Some Other Protocol like ARP FTP etc.
            {
                printf(" * Some Other Protocol \n");
                            
            }
        }
        int rm=0;
        }/*else  if (ntohs (eptr->ether_type) == ETHERTYPE_IPV6) // means it is IPv6 pkt
            {
                
            u_int32_t *s, *d;
            struct ip6_hdr *ip6h = (struct ip6_hdr *)(packet  + sizeof(struct ethhdr) );
            ip_hdr_len=320;
            next_protocol=ip6h->ip6_un1_nxt; // is the next protocol type
            s = (u_int32_t *) &ip6h->ip6_src, d = (u_int32_t *) &ip6h->ip6_dst;
            hash=(s[0] + s[1] + s[2] + s[3] + d[0] + d[1] + d[2] + d[3]+ip6h->ip6_un1_nxt); // ip6_un1_nxt is the next protocol                                         type TCP/UDP can be extention header ? need to be catered for
             
            }else hash=0;
         */
         
 return hash;

}

Sponsored Links
    #2  
Old 02-11-2013
DGPickett DGPickett is offline Forum Advisor  
Registered User
 
Join Date: Oct 2010
Last Activity: 31 July 2014, 4:55 PM EDT
Location: Southern NJ, USA (Nord)
Posts: 4,390
Thanks: 8
Thanked 535 Times in 514 Posts
Maybe not IP packets?

Is it different if you check for ipv6 explicitly?

Last edited by DGPickett; 02-11-2013 at 02:16 PM..
Sponsored Links
    #3  
Old 02-11-2013
arunpushkar arunpushkar is offline
Registered User
 
Join Date: Feb 2013
Last Activity: 11 February 2013, 11:01 PM EST
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
I am not capturing IPv6 packets at present.Only IPv4 packets are being dealt with. i am differentiating them using

Code:
if (ntohs (eptr->ether_type) == ETHERTYPE_IP)

    #4  
Old 02-12-2013
DGPickett DGPickett is offline Forum Advisor  
Registered User
 
Join Date: Oct 2010
Last Activity: 31 July 2014, 4:55 PM EDT
Location: Southern NJ, USA (Nord)
Posts: 4,390
Thanks: 8
Thanked 535 Times in 514 Posts
Oh, right. Protocol 0 is ipv6 except that is laid out differently, I expect: List of IP protocol numbers - Wikipedia, the free encyclopedia

Junk packets? Chase the source down!
Sponsored Links
    #5  
Old 02-13-2013
expl expl is offline
Registered User
 
Join Date: Apr 2011
Last Activity: 27 April 2013, 4:30 AM EDT
Posts: 37
Thanks: 0
Thanked 11 Times in 8 Posts
I see nothing wrong with how you assign packet structures or accessing them, I think there is something wrong with how you save/display them. What is 'pktFeatures'? I guess it has to be a global variable because I do not see you defining/declaring it anywhere in the code snippet. Should not use global variables in critical parts like this because they can not be put into registers, meaning code is not going to be anywhere as fast as with local variables, also your code automatically is not thread/signal safe.
Sponsored Links
    #6  
Old 02-13-2013
DGPickett DGPickett is offline Forum Advisor  
Registered User
 
Join Date: Oct 2010
Last Activity: 31 July 2014, 4:55 PM EDT
Location: Southern NJ, USA (Nord)
Posts: 4,390
Thanks: 8
Thanked 535 Times in 514 Posts
If you telnet through, does it show right? TCP syn ack fin would be nice to have.
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
packet capture dazdseg Programming 1 07-06-2010 10:28 AM
Receiving broadcast packets using packet socket xyzt Programming 0 04-12-2010 08:45 AM
Capture packets (TcpDump) and forwarding them ziedf IP Networking 1 04-05-2010 08:26 AM
capture snmp packets in AIX meeraramanathan Infrastructure Monitoring 1 03-11-2009 03:02 AM
Capture Network Packets from AIX meeraramanathan AIX 16 01-22-2009 03:22 AM



All times are GMT -4. The time now is 12:28 AM.