Network programming in Linux

Capturing datagrams offline


Introduction
Getting started with libpcap

Extracting Ethernet information
Internet Protocol (IP)

Filtering captured datagrams
Capturing datagrams offline

Address Resolution Protocol (ARP)
Internet Control Message Protocol (ICMP)
Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)
Trivial File Transfer Protocol (TFTP)

Injecting datagrams with libnet
Implementing ping
Implementing traceroute

Download source code


Assume you notice major network slow downs every week on Wednesday afternoon. To identify what saturates your network, you capture network traffic the next Wednesday, sequentially using various filtering expressions in order to identify what type of datagrams clogs the network. Suppose furthermore these Wednesday traffic outbursts only last a few minutes. You may therefore not have much time to try different filters to identify these datagrams on a single Wednesday, so you may end up spending many Wednesday afternoons capturing filtered datagrams until you find the source of the problem.

A alternative would be to record all traffic on a single Wednesday afternoon outburst, then analyze repeatedly this same traffic offline with various filters. libpcap provides the required functionalities to accomplish this:

  1. Captured traffic may be logged into a raw binary file.

  2. A capture session may be linked to such log file instead of a network device, therefore reading the logged datagrams from the file as if they were captured directly from a device.

With these functionalities, traffic may be logged into a file and then "recaptured" repeatedly from this file with various BPF filters.

The next version of our sniffer, sniff08.cpp, provides both these functionalities through command line arguments: argument -l allows to log captured traffic to a specified file, and argument -i allows to read traffic from a specified log file instead of a network device. Since implementing these functionalities require multiple minor modifications to the source code, the complete content of sniff08.cpp is reviewed below but only the modifications are highlighted.

sniff08.cpp
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
237
#include <iostream>

#include <cstring>             // memset
#include <cstdlib>             // exit
#include <unistd.h>            // getopt()
#include <signal.h>            // Ctrl+C handling
#include <arpa/inet.h>         // struct in_addr

#include <pcap.h>              // libpcap

#include "datagram.h"          // Datagram
#include "ethernetframe.h"     // EthernetFrame
#include "ippacket.h"          // IPPacket

using namespace std;

pcap_t        *pcap_session = NULL;   // libpcap session handle

char          *strfilter = NULL;      // textual BPF filter
bpf_program    binfilter;             // compiled BPF filter program

pcap_dumper_t *logfile = NULL;        // file descriptor for datagram logging

// Function releasing all resources before ending program execution
void shutdown(int error_code) {
  // Close log file
  if (logfile != NULL)
    pcap_dump_close(logfile);

  // Destroy compiled BPF filter if need be
  if (strfilter != NULL)
      pcap_freecode(&binfilter);

  // Close libpcap session
  if (pcap_session != NULL)
    pcap_close(pcap_session);

  exit(error_code); // we're done!
}

// Ctrl+C interrupt handler
void bypass_sigint(int sig_no) {
  cout << endl << "*** Capture process interrupted by user..." << endl;

  shutdown(0); // we're done!
}

bool show_raw = false;  // deactivate raw display of data captured

// Callback given to pcap_loop() for processing captured datagrams
void process_packet(u_char *user, const struct pcap_pkthdr * h, const u_char * packet) {
  cout << "Grabbed " << h->caplen << " bytes (" << static_cast<int>(100.0 * h->caplen / h->len) 
       << "%) of datagram received on " << ctime((const time_t*)&h->ts.tv_sec);
       
  Datagram pkt(packet, h->caplen);        // initialized Datagram instance
  if (show_raw) cout << "---------------- Raw data -----------------" << pkt << endl;

  EthernetFrame ether = pkt.ethernet();   // get EthernetFrame instance from transported data
  cout << "---------- Ethernet frame header ----------" << endl << ether;
  
  // Display payload content according to EtherType
  switch (ether.ether_type()) {
    case EthernetFrame::et_IPv4 :         // get IPPacket instance from transported data
      IPPacket ip = ether.ip4();
      cout << "-------- IP packet header --------" << endl << ip;
  }
      
  cout << endl << flush;

  // Log datagram if required
  if (user != NULL)
    pcap_dump(user, h, packet);
}

// Sniffer's main program: add datagram logging and offline capture
int main(int argc, char *argv[]) {
  char *device = NULL;            // device to sniff
  char  argch;                    // to manage command line arguments
  char  errbuf[PCAP_ERRBUF_SIZE]; // to handle libpcap error messages
  int   siz     = 1518,           // max number of bytes captured for each datagram
        promisc = 0,              // deactive promiscuous mode
        cnt     = -1;             // capture indefinitely
  char *wlogfname = NULL,         // filename where to log captured datagrams
       *rlogfname = NULL;         // filename from which to read logged datagrams

  // Install Ctrl+C handler
  struct sigaction sa, osa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = &bypass_sigint;
  sigaction(SIGINT, &sa, &osa);

  // Process command line arguments
  while ((argch = getopt(argc, argv, "hprd:f:i:l:n:")) != EOF)
    switch (argch) {
      case 'd':           // device name
        device = optarg;
        break;

      case 'f':           // BPF filter
        strfilter = optarg;
        break;

      case 'h':           // show help info
        cout << "Usage: sniff [-d XXX -h]" << endl;
        cout << " -d XXX : device to capture from, where XXX is device name (ex: eth0)." << endl;
        cout << " -f 'filter' : filter captures according to BPF expression (ex: 'ip or arp')." << endl;
        cout << " -h : show this information." << endl;
        cout << " -i file : read datagrams from given file instead of a device." << endl;
        cout << " -l file : log captured datagrams in given file." << endl;
        cout << " -n : number of datagrams to capture." << endl;
        cout << " -p : activate promiscuous capture mode." << endl;
        cout << " -r : activate raw display of captured data." << endl;

        // Exit if only argument is -h
        if (argc == 2) return 0;
        break;

      case 'i':           // filename from which to read logged datagrams
        rlogfname = optarg;
        break;

      case 'l':           // filename where to log captured datagrams
        wlogfname = optarg;
        break;

      case 'n':           // number of datagrams to capture
        cnt = atoi(optarg);
        break;
        
      case 'p':           // active promiscuous mode
        promisc = 1;
        break;
        
      case 'r':           // active raw display of captured data
        show_raw = 1;
        break;
    }

  // Options -d and -i are mutually exclusives
  if (device != NULL && rlogfname != NULL) {
      cerr << "error - options -d and -i are mutually exclusives" << endl;
      return -7;
  }

  // Identify device to use
  if (rlogfname == NULL && device == NULL)
    if ((device = pcap_lookupdev(errbuf)) == NULL) {
      cerr << "error - " << errbuf << endl;
      return -2;
    }
  
  if (rlogfname != NULL)
    cout << "input file = " << rlogfname << endl;
  else
    cout << "device = " << device << (promisc ? " (promiscuous)" : "") << endl;

  // Extract IP information for network connected to device
  bpf_u_int32 netp,  // ip address of network
              maskp; // network mask

  // If capturing from device, display its attributes
  if (rlogfname == NULL) {
    if ((pcap_lookupnet(device, &netp, &maskp, errbuf)) == -1) {
      cerr << "error - " << errbuf << endl;
      return -3;
    }

    // Translate ip address into textual form for display
    struct  in_addr addr;
    char   *net;
    addr.s_addr = netp;
    if ((net = inet_ntoa(addr)) == NULL)
      cerr << "error - inet_ntoa() failed" << endl;
    else
      cout << "network ip = " << net << endl;

    // Translate network mask into textual form for display
    char *mask;
    addr.s_addr = maskp;
    if ((mask = inet_ntoa(addr)) == NULL)
      cerr << "error - inet_ntoa() failed" << endl;
    else
      cout << "network mask = " << mask << endl;
  }

  // Open a libpcap capture session
  if (rlogfname == NULL) {
    // Session linked to the device
    pcap_session = pcap_open_live(device, siz, promisc, 1000, errbuf);
    if (pcap_session == NULL) {
      cerr << "error - pcap_open_live() failed (" << errbuf << ")" << endl;
      return -4;
    }
  }
  else {
    // Session linked to the log file
    pcap_session = pcap_open_offline(rlogfname, errbuf);
    if (pcap_session == NULL) {
      cerr << "error - pcap_open_offline() failed (" << errbuf << ")" << endl;
      return -8;
    }
  }

  // Compile BPF filter expression into program if one provided
  if (strfilter != NULL) {
    // Compile filter expression
    if (pcap_compile(pcap_session, &binfilter, strfilter, 1, maskp) < 0) {
      cerr << "error - pcap_compile() failed (" << pcap_geterr(pcap_session) << ")" << endl;
      shutdown(-5);    // Cleanup and quit
    }

    // Install compiled filter
    if (pcap_setfilter(pcap_session, &binfilter) < 0) {
      cerr << "error - pcap_setfilter() failed (" << pcap_geterr(pcap_session) << ")" << endl;
      shutdown(-6);    // Cleanup and quit
    }
    
    cout << "BPF filter = " << strfilter << endl;    // display applied filter
  }

  // If need be, open file where captured datagrams are ro be logged
  if (wlogfname != NULL)
    if ((logfile = pcap_dump_open(pcap_session, wlogfname)) == NULL) {
      cerr << "error - pcap_dump_open() failed (" << pcap_geterr(pcap_session) << ")" << endl;
      shutdown(-9);    // Cleanup and quit
  }
  
  // Start capturing...
  pcap_loop(pcap_session, cnt, process_packet, (u_char *)logfile);

  // Close libpcap session
  pcap_close(pcap_session);

  shutdown(0);
}

Here are the enhancements implementing packet logging and offline capturing to our sniffer:

  • Line #022 defines a file descriptor to give access to log files.

  • Line #027 closes any opened log file upon terminating the capture session.

  • In the callback function process_packet(), line #072 logs the captured datagram if a file descriptor is provided to the callback through its user parameter.

  • Two new character array pointers are defined at line #084 in the main() program to handle filenames provided through command line arguments for offline capturing (line #119) and datagram logging (line #123).

  • The conditional block of lines starting at #141 makes sure conflicting command line arguments are not provided : capturing cannot be done simultaneously online (from a network device) and offline (from a file).

  • Conditional statements must be embedded at various places into previous code to account for offline capturing (at lines #147, #153, #163 and #188).

  • A call to pcap_open_offline() at line #198 creates a libpcap session handle for offline capture, from which datagrams are to be read (i.e. captured).

  • A call to pcap_dump_open() at line #223 creates a file descriptor for the file to which captured datagrams are to be saved (i.e. logged).

  • Finally, the call to pcap_loop() initiating the capture process at line #230 uses the callback's user parameter to pass along the file descriptor with which datagrams are to be logged. This is a good example of the use of the user parameter to pass along information to the callback function from the main() routine.

Here is an example of logging captured traffic, then subsequently analyzing logged datagrams with filtering:

%root> ./sniff08 -l traffic.log -n 3
device = eth0
network ip = 172.16.179.0
network mask = 255.255.255.0
Grabbed 73 bytes (100%) of datagram received on Wed Sep 11 11:35:50 2013
---------- Ethernet frame header ----------
destination MAC address = 00.50.56.ec.28.a3
source MAC address = 00.0c.29.19.22.3a
ether type = IPv4 [0x0800]
-------- IP packet header --------
version = IPv4
header length = 20 (IHL = 5)
type of service = 0:
total length = 59
fragment ID = 0x0000
  don't fragment = 2
  more fragments = 0
  fragment position = 0
protocol = UDP [0x11]
time to live = 64
checksum = 0x7c08
destination IP address = 172.16.179.2
source IP address = 172.16.179.134

Grabbed 60 bytes (100%) of datagram received on Wed Sep 11 11:35:50 2013
---------- Ethernet frame header ----------
destination MAC address = ff.ff.ff.ff.ff.ff
source MAC address = 00.50.56.ec.28.a3
ether type = ARP [0x0806]

Grabbed 42 bytes (100%) of datagram received on Wed Sep 11 11:35:50 2013
---------- Ethernet frame header ----------
destination MAC address = 00.50.56.ec.28.a3
source MAC address = 00.0c.29.19.22.3a
ether type = ARP [0x0806]

%root> ls
datagram.cpp          datagram.h         exceptions.h   ippacket.cpp    macaddress.h  sniff08.txt
datagramfragment.cpp  ethernetframe.cpp  ipaddress.cpp  ippacket.h      sniff08       traffic.log
datagramfragment.h    ethernetframe.h    ipaddress.h    macaddress.cpp  sniff08.cpp

%root> ./sniff08 -i traffic.log -f 'arp'
input file = traffic.log
BPF filter = arp
Grabbed 60 bytes (100%) of datagram received on Wed Sep 11 11:35:50 2013
---------- Ethernet frame header ----------
destination MAC address = ff.ff.ff.ff.ff.ff
source MAC address = 00.50.56.ec.28.a3
ether type = ARP [0x0806]

Grabbed 42 bytes (100%) of datagram received on Wed Sep 11 11:35:50 2013
---------- Ethernet frame header ----------
destination MAC address = 00.50.56.ec.28.a3
source MAC address = 00.0c.29.19.22.3a
ether type = ARP [0x0806]

%root>

The first capture session logs raw traffic into traffic.log, then the second capture session applies a filter to extract ARP datagrams previously logged.


Home  |  Previous  |  Next

 
Copyright © 2014 Marco Lavoie