Raw Ethernet Packet Capture

[gustavo.samour]

Hi,

I am writing a very basic raw ethernet sniffer based on what I found
in Andreas Schaufler's raw ethernet article:
http://aschauf.landshut.org/fh/linux...w/ch01s03.html

I'm trying to print the output of each ethernet frame in both
hexadecimal and character representations . I'm new at network
programming in C. Here's a code snippet:

while(1)
{

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1) {

printf("Error receiving ethernet frame...\n");

}
else {

printf("Hex:\n\ n");
for (int i = 0; i < length; i++)
{
printf("%x" buffer[i]);
}

printf("\n\nCha r:\n\n");
for (int i = 0; i < length; i++)
{
printf("%c" buffer[i]);
}

}

}

Most of the characters I get are shown in two digit hexadecimal
representation like this "A0". But sometimes I get something like
"FFFFFFFF" or "FFFFFFA0". Why does this happen? I also compared the
results of using the Linux wireshark sniffer and my program, and
noticed different hexadecimal values for the frames. I know wireshark
is correct, so what am I doing wrong? Any help is appreciated.

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

[user923005]

On Oct 22, 2:58 pm, gustavo.sam...@ gmail.com wrote:

Hi,

I am writing a very basic raw ethernet sniffer based on what I found
in Andreas Schaufler's raw ethernet article:http://aschauf.landshut.org/fh/linux...w/ch01s03.html

I'm trying to print the output of each ethernet frame in both
hexadecimal and character representations . I'm new at network
programming in C. Here's a code snippet:

while(1)
{

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1) {

printf("Error receiving ethernet frame...\n");

}
else {

printf("Hex:\n\ n");
for (int i = 0; i < length; i++)
{
printf("%x" buffer[i]);
}

printf("\n\nCha r:\n\n");
for (int i = 0; i < length; i++)
{
printf("%c" buffer[i]);
}

}

}

Most of the characters I get are shown in two digit hexadecimal
representation like this "A0". But sometimes I get something like
"FFFFFFFF" or "FFFFFFA0". Why does this happen? I also compared the
results of using the Linux wireshark sniffer and my program, and
noticed different hexadecimal values for the frames. I know wireshark
is correct, so what am I doing wrong? Any help is appreciated.

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The data type of buffer is not specified, but I guess signed char.

The printf() function is a varadic function. So signed char will
promote to what by default promotions?

It would have been funnier if the poster was named 'minus'.

I guess that if you change your data type to unsigned char, it may
surprise you a bit.

[Tor Rustad]

gu************@ gmail.com wrote:

[...]

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The %X specifier expect an 'unsigned int' type, you can try e.g.

int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);
}
return n;
}

instead.

--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Tor Rustad]

Tor Rustad wrote:

gu************@ gmail.com wrote:

[...]

>Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The %X specifier expect an 'unsigned int' type, you can try e.g.

int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.
--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Richard Heathfield]

Tor Rustad said:

Tor Rustad wrote:

<snip>

>int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.

This can easily be fixed with +=, or the function could simply return
ferror(out) instead.

--
Richard Heathfield <http://www.cpax.org.uk >
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999

[gustavo.samour]

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...char acters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
int main(void)
{

int i = 0;
int s; /*socketdescript or*/
int frameCount = 1;
int MAX_FRAMES = 1000;

s = socket(AF_PACKE T, SOCK_RAW, htons(ETH_P_ALL ));
if (s == -1) { printf("ERROR BINDING SOCKET...\n"); exit(0); }

unsigned char* buffer = (unsigned char*)malloc(ET H_FRAME_LEN); /
*Buffer for ethernet frame*/
int length = 0; /*length of the received frame*/

while(frameCoun t <= MAX_FRAMES){

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1)
{
printf("Error while receiving ethernet frame...\n");
}
else {

printf("Frame %d (hex)\n\n", frameCount);
for(i=0; i<length; i++)
{
printf("%.2x ", buffer[i]);
}
printf("\n\n");

printf("Frame %d (char)\n\n", frameCount);
for(i=0; i<length; i++)
{
if (buffer[i] 32 && buffer[i] <= 127 )
printf("%c ", buffer[i]);
else
printf(". ");
}
printf("\n\n");

frameCount++;

}

}

close(s);

}

[santosh]

gu************@ gmail.com wrote:

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...char acters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>

<snip rest>

I think this might be the point where it might be fruitful to take your
problem over to a UNIX or Linux group like <news:comp.unix .programmer>,
<news:comp.os.l inux.developmen t.apps>,
<news:comp.os.l inux.developmen t.system>,
<news:comp.os.l inux.networking >
etc.

[gustavo.samour]

On 22 oct, 17:26, santosh <santosh....@gm ail.comwrote:

gustavo.sam...@ gmail.com wrote:

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...char acters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>

<snip rest>

I think this might be the point where it might be fruitful to take your
problem over to a UNIX or Linux group like <news:comp.unix .programmer>,
<news:comp.os.l inux.developmen t.apps>,
<news:comp.os.l inux.developmen t.system>,
<news:comp.os.l inux.networking >
etc.

Good idea, thanks Santosh!

[Tor Rustad]

Richard Heathfield wrote:

Tor Rustad said:

[...]

>> n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.

This can easily be fixed with +=,

Yes, which left on purpose as an exercise to OP. :)

or the function could simply return
ferror(out) instead.

In the general case (even if not relevant here), I think the n<0 check
is needed, since I don't expect ferror() to catch fprintf() encoding errors.

--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Richard Heathfield]

Tor Rustad said:

Richard Heathfield wrote:

>>
This can easily be fixed [...]

Yes, which left on purpose as an exercise to OP. :)

Whoops! Sorry, Tor.

--
Richard Heathfield <http://www.cpax.org.uk >
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999