#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <net/ethernet.h>
#include <errno.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
int CreateRawSocket(int protocol_to_sniff) {
int rawsock;
if( (rawsock = socket(PF_PACKET,SOCK_RAW, htons(protocol_to_sniff))) == -1) {
perror("Error creating raw socket");
exit(-1);
}
return rawsock;
}
void PrintInHex(char *mesg, unsigned char *p, int len){
printf(mesg);
while(len--){
fprintf(stdout, "%.2X ", *p);
p++;
}
}
void PrintEthernetHeader(unsigned char *packet){
struct ether_header *ethernet_header;
ethernet_header = (struct ether_header *)packet;
/* First set of 6 bytes are Destination MAC */
PrintInHex("Destination MAC: ", ethernet_header->ether_dhost, 6);
fprintf(stdout, "\n");
/* Second set of 6 bytes are Source MAC */
PrintInHex("Source MAC: ", ethernet_header->ether_shost, 6);
fprintf(stdout, "\n");
if(ntohs(ethernet_header->ether_type) == ETHERTYPE_IP){
printf("Ethernet type: IP \n");
}else if(ntohs(ethernet_header->ether_type) == ETHERTYPE_ARP){
printf("Ethernet type: ARP \n");
}else{
printf("Ethernet type: unknown \n");
}
}
void PrintIpHeader(char *packet) {
struct ip *iphdr;
fprintf(stdout, "**************** Print IP Header ****************\n");
iphdr = (struct ip *)(packet + sizeof(struct ether_header));
fprintf(stdout, "IP Source: %s \n",inet_ntoa(iphdr->ip_src));
fprintf(stdout, "IP Destination %s \n",inet_ntoa(iphdr->ip_dst));
fprintf(stdout, "ttl %d \n",iphdr->ip_ttl);
fprintf(stdout, "**************** the end IP Header **************\n");
}
void PrintTcpHeader(char *packet) {
struct tcphdr *tcphdr;
tcphdr = (struct tcphdr *) (packet + sizeof(struct ether_header) + sizeof(struct ip));
printf("****************** Print TCP Header *********************** \n");
printf("source port %d \n", ntohs(tcphdr->source));
printf("destination port %d \n", ntohs(tcphdr->dest));
printf("seq: %d \n",ntohl(tcphdr->seq));
printf("ACK: %d\n",ntohl(tcphdr->ack));
printf("****************** the end TCP Header ********************* \n");
}
int PrintData(unsigned char *packet)
{
struct iphdr *ip_header;
struct tcphdr *tcp_header;
unsigned char *data;
int data_len;
ip_header = (struct iphdr*)(packet + sizeof(struct ether_header));
data = (packet + sizeof(struct ether_header) + ip_header->ihl*4 +sizeof(struct tcphdr));
data_len = ntohs(ip_header->tot_len) - ip_header->ihl*4 - sizeof(struct tcphdr);
if(data_len){
fprintf(stdout, "Data Len : %d\n", data_len);
PrintInHex("Data : ", data, data_len);
printf("\n\n");
return 1;
}else{
fprintf(stdout, "No Data in packet\n");
return 0;
}
}
int main(int argc, char **argv){
int raw;
unsigned char packet_buffer[2048];
int len;
struct sockaddr_ll packet_info;
int packet_info_size = sizeof(packet_info);
/* create the raw socket */
raw = CreateRawSocket(ETH_P_IP);
/* Start Sniffing */
while(1) {
if((len = recvfrom(raw, packet_buffer, 2048, 0, (struct sockaddr*)&packet_info, &packet_info_size)) == -1){
perror("Recv from returned -1: ");
exit(-1);
}else{
/* Packet has been received successfully !! */
PrintEthernetHeader(packet_buffer);
PrintIpHeader(packet_buffer);
PrintTcpHeader(packet_buffer);
PrintData(packet_buffer);
}
}
return 0;
}

gcc sniffer.c -o sniffer.o

./sniffer.o eth0