Raw Ethernet Packet Capture

[gustavo.samour]

Hi,

I am writing a very basic raw ethernet sniffer based on what I found
in Andreas Schaufler's raw ethernet article:
http://aschauf.landshut.org/fh/linux...w/ch01s03.html

I'm trying to print the output of each ethernet frame in both
hexadecimal and character representations. I'm new at network
programming in C. Here's a code snippet:

while(1)
{

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1) {

printf("Error receiving ethernet frame...\n");

}
else {

printf("Hex:\n\n");
for (int i = 0; i < length; i++)
{
printf("%x" buffer[i]);
}

printf("\n\nChar:\n\n");
for (int i = 0; i < length; i++)
{
printf("%c" buffer[i]);
}

}

}

Most of the characters I get are shown in two digit hexadecimal
representation like this "A0". But sometimes I get something like
"FFFFFFFF" or "FFFFFFA0". Why does this happen? I also compared the
results of using the Linux wireshark sniffer and my program, and
noticed different hexadecimal values for the frames. I know wireshark
is correct, so what am I doing wrong? Any help is appreciated.

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

[user923005]

On Oct 22, 2:58 pm, [e-mail] wrote:

Hi,

I am writing a very basic raw ethernet sniffer based on what I found
in Andreas Schaufler's raw ethernet article:http://aschauf.landshut.org/fh/linux...w/ch01s03.html

I'm trying to print the output of each ethernet frame in both
hexadecimal and character representations. I'm new at network
programming in C. Here's a code snippet:

while(1)
{

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1) {

printf("Error receiving ethernet frame...\n");

}
else {

printf("Hex:\n\n");
for (int i = 0; i < length; i++)
{
printf("%x" buffer[i]);
}

printf("\n\nChar:\n\n");
for (int i = 0; i < length; i++)
{
printf("%c" buffer[i]);
}

}

}

Most of the characters I get are shown in two digit hexadecimal
representation like this "A0". But sometimes I get something like
"FFFFFFFF" or "FFFFFFA0". Why does this happen? I also compared the
results of using the Linux wireshark sniffer and my program, and
noticed different hexadecimal values for the frames. I know wireshark
is correct, so what am I doing wrong? Any help is appreciated.

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The data type of buffer is not specified, but I guess signed char.

The printf() function is a varadic function. So signed char will
promote to what by default promotions?

It would have been funnier if the poster was named 'minus'.

I guess that if you change your data type to unsigned char, it may
surprise you a bit.

[Tor Rustad]

gu************@gmail.com wrote:

[...]

Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The %X specifier expect an 'unsigned int' type, you can try e.g.

int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);
}
return n;
}

instead.

--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Tor Rustad]

Tor Rustad wrote:

gu************@gmail.com wrote:

[...]

>Note: I posted this in alt.comp.lang.c before and someone named
"mimus" said the "FFFFFFFF" behavior could be a signed/unsigned
problem. How can I tell?

The %X specifier expect an 'unsigned int' type, you can try e.g.

int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.
--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Richard Heathfield]

Tor Rustad said:

Tor Rustad wrote:

<snip>

>int write_hex(FILE *out, unsigned char *binary, size_t binary_len)
{
size_t i;
int n = 0;

for (i=0; i<binary_len; i++)
{
n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.

This can easily be fixed with +=, or the function could simply return
ferror(out) instead.

--
Richard Heathfield <http://www.cpax.org.uk>
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999

[gustavo.samour]

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...characters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
int main(void)
{

int i = 0;
int s; /*socketdescriptor*/
int frameCount = 1;
int MAX_FRAMES = 1000;

s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (s == -1) { printf("ERROR BINDING SOCKET...\n"); exit(0); }

unsigned char* buffer = (unsigned char*)malloc(ETH_FRAME_LEN); /
*Buffer for ethernet frame*/
int length = 0; /*length of the received frame*/

while(frameCount <= MAX_FRAMES){

length = recvfrom(s, buffer, ETH_FRAME_LEN, 0, NULL, NULL);

if (length == -1)
{
printf("Error while receiving ethernet frame...\n");
}
else {

printf("Frame %d (hex)\n\n", frameCount);
for(i=0; i<length; i++)
{
printf("%.2x ", buffer[i]);
}
printf("\n\n");

printf("Frame %d (char)\n\n", frameCount);
for(i=0; i<length; i++)
{
if (buffer[i] 32 && buffer[i] <= 127 )
printf("%c ", buffer[i]);
else
printf(". ");
}
printf("\n\n");

frameCount++;

}

}

close(s);

}

[santosh]

gu************@gmail.com wrote:

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...characters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>

<snip rest>

I think this might be the point where it might be fruitful to take your
problem over to a UNIX or Linux group like <news:comp.unix.programmer>,
<news:comp.os.linux.development.apps>,
<news:comp.os.linux.development.system>,
<news:comp.os.linux.networking>
etc.

[gustavo.samour]

On 22 oct, 17:26, santosh <[e-mail]:

[e-mail] wrote:

You guys were right. I was using a signed char. I changed it to
unsigned char and I noticed the following change:

the "ffffffff" or "ffffffa0" now appear as "ff" and "a0" respectively.
I also noticed I was trying to print some unprintable characters using
printf("%c", thechar)...characters like the frame header (silly me).
So thanks! It worked.

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark? Here's my code:

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>

<snip rest>

I think this might be the point where it might be fruitful to take your
problem over to a UNIX or Linux group like <news:comp.unix.programmer>,
<news:comp.os.linux.development.apps>,
<news:comp.os.linux.development.system>,
<news:comp.os.linux.networking>
etc.

Good idea, thanks Santosh!

[Tor Rustad]

Richard Heathfield wrote:

Tor Rustad said:

[...]

>> n = fprintf(out, "%02X", binary[i]);

I forgot to put in some error check here for n<0, also the 'n' return
value is rather misleading, since it typically doesn't return the total
length printed.

This can easily be fixed with +=,

Yes, which left on purpose as an exercise to OP. :)

or the function could simply return
ferror(out) instead.

In the general case (even if not relevant here), I think the n<0 check
is needed, since I don't expect ferror() to catch fprintf() encoding errors.

--
Tor <torust [at] online [dot] no>

"Technical skill is mastery of complexity, while creativity is mastery
of simplicity"

[Richard Heathfield]

Tor Rustad said:

Richard Heathfield wrote:

>>
This can easily be fixed [...]

Yes, which left on purpose as an exercise to OP. :)

Whoops! Sorry, Tor.

--
Richard Heathfield <http://www.cpax.org.uk>
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999

[gustavo.samour]

Thanks to everyone who posted! You pointed me in the right direction
with the unsigned/signed char issue... I felt like such a newbie
haha... As for the Wireshark issue:

But now I noticed some odd behavior. I'm sending some raw ethernet
packets from a Windows machine and sniffing them in my linux box. When
I only run my C program, those packets are not received for some
reason. But when I run both my program and the Wireshark capture
SIMULTANEOUSLY, I DO receive those packets coming from my Windows
machine. Any ideas? Is there some sort of flag I'm not setting in my
code that gets set in Wireshark?

Turns out, I wasn't far off.. there WAS a "flag" I wasn't setting.
It's called "promiscuous mode". By default, Network cards are not in
promiscuous mode which means they don't allow certain packets thru
(packets where the destination is not its MAC address or something
like that). When this mode is set, the network interface gets ALL
traffic, even packets not meant for it. So promiscuous mode was the
key. To set this mode in linux go to your shell and type a command
similar to this one:

>ifconfig eth0 promisc

Be sure to replace "eth0" with your own network interface in case it's
"wlan0" or something else. To remove promiscuous mode, type:

>ifconfig eth0 -promisc

Thanks again for all your help!

[gustavo.samour]

To set promiscuous mode within your C code, add code similar to the
following:

struct ifreq ethreq;
strncpy(ethreq.ifr_name,"eth0",IFNAMSIZ);
ioctl(sock, SIOCGIFFLAGS, &ethreq);
ethreq.ifr_flags |= IFF_PROMISC;
ioctl(sock, SIOCSIFFLAGS, &ethreq);

This snippet is taken from:

http://www.linuxjournal.com/article/4659