수다닷컴

질문 제목 :pcap 코드 관련 질문드립니다.

질문 내용 :pcap을 이용하여 처음에 SYN패킷을 하나 잡아 서버로 1~65535까지의 모든 포트에 SYN패킷을 보내 ACK,SYN패킷을 보내는 즉 응답하는 포트를 찾는 코드를 작성하였습니다.아래 코드가 메인에서 실제로 SYN패킷을 보내고 ACK,SYN패킷을 받는 코드구요.
struct pcap_pkthdr *header;
struct pcap_pkthdr *send_header;
const unsigned char *send_data;
const unsigned char *pkt_data;
int res;
while((res=pcap_next_ex(fp, &send_header, &send_data))=0){
if (res==0) continue;
break;
}
unsigned short port = 1;
unsigned short r_port[65535];
int index = 0;
bool jud = false;
pkt_data = NULL;

for(;;){
tcp_header(send_data, port);
if(port!=0){
if(pcap_sendpacket(fp, send_data,send_header-caplen)!=0)
printf(err in packet send:%s\n, pcap_geterr(fp));
port++;
}
if((res=pcap_next_ex(fp, &header, &pkt_data))=0){
if(pkt_data!=NULL && tcp_header(pkt_data)!=0){
for(int i=0;iindex;i++){
if(r_port[i]==tcp_header(pkt_data)){
jud = true;
break;
}
}
if(jud==false){
r_port[index] = tcp_header(pkt_data);
printf(%d\t, r_port[index]);
index++;
}
jud = false;
}
}

}
여기서 문제가 malformat으로 보내는 패킷이 너무 많다는 것입니다.
그 이유를 제가 찾아본 결과
pcap_sendpacket(fp, send_data,send_header-caplen)!=0
이 부분에서 send_header-caplen이 불규칙적으로 변하여 패킷이 중간에 짤려 보내졌습니다.
그래서send_header-caplen을 처음에 잡은 패킷의 길이인 66으로
pcap_sendpacket(fp, send_data,66)!=0
으로 변경으로 변경하여 보냈더니 패킷이 정상적인 길이로 모두 보내지지만
원래 ACK,SYN패킷이 와야하는 포트에서 RST,ACK패킷이 도착하거나
TCP ackedCP acked lost segment 패킷이 도착하였습니다.
뭐가 문제인지 좀 확인해 주셨으면 좋겠습니다.
아래는 각각 역할을 하는 함수들입니다.unsigned short in_checksum(unsigned short *ptr, int nbytes){
register long sum;
unsigned short oddbyte;
register short answer; sum=0;
while(nbytes1){
sum += *ptr++;
nbytes-=2;
}
if(nbytes==1){
oddbyte=0;
*((u_char*)&oddbyte)=*(u_char*)ptr;
sum+=oddbyte;
} sum = (sum16)+(sum & 0xffff);
sum = sum + (sum16);
answer = (SHORT)~sum; return(answer);
}unsigned short ip_header(const unsigned char *pkt_data){ //ip헤더 프린트 함수
struct ip_header { //ip헤더 structure
unsigned char ip_header_len:4;
unsigned char ip_version:4;
unsigned char ip_tos;
unsigned short ip_total_length;
unsigned short identification;
unsigned char ip_frag_offset:5; //frag_offset 앞 3bit
unsigned char ip_more_fragment:1; //frag 1bit씩 3개
unsigned char ip_dont_fragment:1;
unsigned char ip_reserved_zero:1;
unsigned char ip_frag_offset1; //frag_offset 뒤 8bit
unsigned char ttl;
unsigned char protocol;
unsigned short header_checksum;
unsigned int ip_srcaddr;
unsigned int ip_destaddr;
}; struct ip_header *ih; //ip헤더 structure ih
ih = (struct ip_header *)(pkt_data+14); //ih에 pkt_data에 + 이더넷헤더 14하여 연결
ih-header_checksum = 0;

ih-header_checksum = in_checksum((unsigned short *)ih, 20);
return (ntohs(ih-ip_total_length) - (ih-ip_header_len * 4));
}void tcp_header(const unsigned char *pkt_data, unsigned short port){ //tcp헤더 프린트 함수
struct tcp_header { //tcp 헤더 structure
unsigned short source_port;
unsigned short dest_port;
unsigned int seq_num;
unsigned int ack_num;
unsigned char ns:1;
unsigned char reserved_part1:3;
unsigned char data_offset:4;
unsigned char fin:1;
unsigned char syn:1;
unsigned char rst:1;
unsigned char psh:1;
unsigned char ack:1;
unsigned char urg:1;
unsigned char ecn:1;
unsigned char cwr:1;
unsigned short window_size;
unsigned short checksum;
unsigned short urg_pointer;
}; struct tcp_header *th; //tcp header structure th선언
th = (struct tcp_header *)(pkt_data+34); //th를 pkt_data+이더넷 헤더 14 + IP헤더 20을 연결
th-dest_port = htons(port);
th-checksum = 0;
unsigned short tcp_header_len = ip_header(pkt_data);

struct pseudo_header{
unsigned int source_address;
unsigned int dest_address;
unsigned char placeholder;
unsigned char protocol;
unsigned short tcp_length;
};
struct pseudo_header psh;
psh.source_address = inet_addr(192.168.123.107); //my ip
psh.dest_address = inet_addr(165.246.38.157); //server ip
psh.placeholder = 0;
psh.protocol = 6;
psh.tcp_length = htons(tcp_header_len); unsigned char *seudo;
seudo = (unsigned char *)malloc(sizeof(struct pseudo_header) + tcp_header_len);
memcpy(seudo, &psh, sizeof(struct pseudo_header));
memcpy(seudo + sizeof(struct pseudo_header), th, tcp_header_len); th-checksum = in_checksum((unsigned short *)seudo, sizeof(struct pseudo_header) + tcp_header_len);
}unsigned short tcp_header(const unsigned char *pkt_data){ //tcp헤더 프린트 함수
struct tcp_header { //tcp 헤더 structure
unsigned short source_port;
unsigned short dest_port;
unsigned int seq_num;
unsigned int ack_num;
unsigned char ns:1;
unsigned char reserved_part1:3;
unsigned char data_offset:4;
unsigned char fin:1;
unsigned char syn:1;
unsigned char rst:1;
unsigned char psh:1;
unsigned char ack:1;
unsigned char urg:1;
unsigned char ecn:1;
unsigned char cwr:1;
unsigned short window_size;
unsigned short checksum;
unsigned short urg_pointer;
}; struct tcp_header *th; //tcp header structure th선언
th = (struct tcp_header *)(pkt_data+34); //th를 pkt_data+이더넷 헤더 14 + IP헤더 20을 연결
if(th-syn==1 && th-ack==1)
return ntohs(th-source_port);
else
return 0;

}

신청하기