Main Page Modules Data Structures File List Data Fields Globals Related Pages

# Interpreting the packets
[WinPcap tutorial: a step by step guide to program WinPcap]

Now that we are able to sniff and filter the traffic, we want to put our knowledge in practice with a first simple "real world" application.

In this lesson we will take the code of the previous lessons and extend it to build a more useful program; the main purpose is to show how the content of a captured packet, and in particular its protocol headers can be parsed and interpreted. The resulting application, called UDPdump, will print on the screen a summary of the UDP traffic of our network.

We choose to display the UDP protocol because it's simpler than TCP, so it's more immediate from a didactic perspective. Let's give a look at the code.

    /*
     * Copyright (c) 1999 - 2003
     * NetGroup, Politecnico di Torino (Italy)
     * All rights reserved.
     *
     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
     * are met:
     *
     * 1. Redistributions of source code must retain the above copyright
     * notice, this list of conditions and the following disclaimer.
     * 2. Redistributions in binary form must reproduce the above copyright
     * notice, this list of conditions and the following disclaimer in the
     * documentation and/or other materials provided with the distribution.
     * 3. Neither the name of the Politecnico di Torino nor the names of its
     * contributors may be used to endorse or promote products derived from
     * this software without specific prior written permission.
     *
     * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
     * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
     * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
     * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
     * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     *
     */

    #include "pcap.h"

    /* 4 bytes IP address */
    typedef struct ip_address{
        u_char byte1;
        u_char byte2;
        u_char byte3;
        u_char byte4;
    }ip_address;

    /* IPv4 header */
    typedef struct ip_header{
        u_char  ver_ihl;        // Version (4 bits) + Internet header length (4 bits)
        u_char  tos;            // Type of service
        u_short tlen;           // Total length
        u_short identification; // Identification
        u_short flags_fo;       // Flags (3 bits) + Fragment offset (13 bits)
        u_char  ttl;            // Time to live
        u_char  proto;          // Protocol
        u_short crc;            // Header checksum
        ip_address  saddr;      // Source address
        ip_address  daddr;      // Destination address
        u_int   op_pad;         // Option + Padding
    }ip_header;

    /* UDP header*/
    typedef struct udp_header{
        u_short sport;          // Source port
        u_short dport;          // Destination port
        u_short len;            // Datagram length
        u_short crc;            // Checksum
    }udp_header;

    /* prototype of the packet handler */
    void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

    main()
    {
    pcap_if_t *alldevs;
    pcap_if_t *d;
    int inum;
    int i=0;
    pcap_t *adhandle;
    char errbuf[PCAP_ERRBUF_SIZE];
    u_int netmask;
    char packet_filter[] = "ip and udp";
    struct bpf_program fcode;

        /* Retrieve the device list */
        if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
        {
            fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
            exit(1);
        }

        /* Print the list */
        for(d=alldevs; d; d=d->next)
        {
            printf("%d. %s", ++i, d->name);
            if (d->description)
                printf(" (%s)\n", d->description);
            else
                printf(" (No description available)\n");
        }

        if(i==0)
        {
            printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
            return -1;
        }

        printf("Enter the interface number (1-%d):",i);
        scanf("%d", &inum);

        if(inum < 1 || inum > i)
        {
            printf("\nInterface number out of range.\n");
            /* Free the device list */
            pcap_freealldevs(alldevs);
            return -1;
        }

        /* Jump to the selected adapter */
        for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);

        /* Open the adapter */
        if ( (adhandle= pcap_open(d->name,  // name of the device
                                 65536,     // portion of the packet to capture.
                                            // 65536 grants that the whole packet will be captured on all the MACs.
                                 PCAP_OPENFLAG_PROMISCUOUS,         // promiscuous mode
                                 1000,      // read timeout
                                 NULL,      // remote authentication
                                 errbuf     // error buffer
                                 ) ) == NULL)
        {
            fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n");
            /* Free the device list */
            pcap_freealldevs(alldevs);
            return -1;
        }

        /* Check the link layer. We support only Ethernet for simplicity. */
        if(pcap_datalink(adhandle) != DLT_EN10MB)
        {
            fprintf(stderr,"\nThis program works only on Ethernet networks.\n");
            /* Free the device list */
            pcap_freealldevs(alldevs);
            return -1;
        }

        if(d->addresses != NULL)
            /* Retrieve the mask of the first address of the interface */
            netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
        else
            /* If the interface is without addresses we suppose to be in a C class network */
            netmask=0xffffff;

        //compile the filter
        if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) <0 )
        {
            fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
            /* Free the device list */
            pcap_freealldevs(alldevs);
            return -1;
        }

        //set the filter
        if (pcap_setfilter(adhandle, &fcode)<0)
        {
            fprintf(stderr,"\nError setting the filter.\n");
            /* Free the device list */
            pcap_freealldevs(alldevs);
            return -1;
        }

        printf("\nlistening on %s...\n", d->description);

        /* At this point, we don't need any more the device list. Free it */
        pcap_freealldevs(alldevs);

        /* start the capture */
        pcap_loop(adhandle, 0, packet_handler, NULL);

        return 0;
    }

    /* Callback function invoked by libpcap for every incoming packet */
    void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
    {
        struct tm *ltime;
        char timestr[16];
        ip_header *ih;
        udp_header *uh;
        u_int ip_len;
        u_short sport,dport;

        /* convert the timestamp to readable format */
        ltime=localtime(&header->ts.tv_sec);
        strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);

        /* print timestamp and length of the packet */
        printf("%s.%.6d len:%d ", timestr, header->ts.tv_usec, header->len);

        /* retireve the position of the ip header */
        ih = (ip_header *) (pkt_data +
            14); //length of ethernet header

        /* retireve the position of the udp header */
        ip_len = (ih->ver_ihl & 0xf) * 4;
        uh = (udp_header *) ((u_char*)ih + ip_len);

        /* convert from network byte order to host byte order */
        sport = ntohs( uh->sport );
        dport = ntohs( uh->dport );

        /* print ip addresses and udp ports */
        printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n",
            ih->saddr.byte1,
            ih->saddr.byte2,
            ih->saddr.byte3,
            ih->saddr.byte4,
            sport,
            ih->daddr.byte1,
            ih->daddr.byte2,
            ih->daddr.byte3,
            ih->daddr.byte4,
            dport);
    }

First of all, we set the filter "ip and udp". In this way we are sure that packet_handler() will receive only UDP packets over IPv4: this simplifies the parsing and increases the efficiency of the program.

We have also created a couple of structs that describe the IP and UDP headers. These structs are used by packet_handler() to properly locate the various header fields.

packet_handler(), although limited to a single protocol dissector (UDP over IPv4), shows how complex sniffers like tcpdump/WinDump decode the network traffic. First of all, since we aren't interested in the MAC header, we skip it. For simplicity, before starting the capture we made a check on the MAC layer with pcap_datalink(), so that UDPdump will work only on Ethernet networks. In this way we are sure that the MAC header is exactly 14 bytes.

The IP header is located just after the MAC one. We extract from it the source and destination addresses.

Reaching the UDP header is a bit more complex, because the IP header hasn't a fixed length. Therefore, we use the internet header length field to know its dimension. Once we know the location of the UDP header, we extract the source and destination ports.

The extracted values are printed on the screen, and the result is something like:

`1. {A7FD048A-5D4B-478E-B3C1-34401AC3B72F} (Xircom t 10/100 Adapter)
Enter the interface number (1-2):1
`

`listening on Xircom CardBus Ethernet 10/100 Adapter...
16:13:15.312784 len:87 130.192.31.67.2682 -> 130.192.3.21.53
16:13:15.314796 len:137 130.192.3.21.53 -> 130.192.31.67.2682
16:13:15.322101 len:78 130.192.31.67.2683 -> 130.192.3.21.53
`

In which every line represents a different packet.

<<< Previous Next >>>

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.