Sei sulla pagina 1di 18

Assignment 1-

1 - Experiment with the following Linux Networking Commands specifying different


important flags: ifconfig, route, netstat, ping, arp, traceroute, tcpdump, xxd, host,
nslookup, dig, nmap etc.

● Ifconfig
kshitij@KshitijSharma-HP:~/Network Programs$ ifconfig
eno1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 40:b0:34:c3:c6:25 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536


inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 15706 bytes 1430099 (1.4 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 15706 bytes 1430099 (1.4 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500


inet 192.168.77.58 netmask 255.255.224.0 broadcast 192.168.95.255
inet6 fe80::b903:6c4e:5d4:dcf prefixlen 64 scopeid 0x20<link>
ether 10:f0:05:3c:69:aa txqueuelen 1000 (Ethernet)
RX packets 459297 bytes 568262168 (568.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 189130 bytes 26614313 (26.6 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

● route
kshitij@KshitijSharma-HP:~/Network Programs$ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default _gateway 0.0.0.0 UG 600 0 0 wlp3s0
link-local 0.0.0.0 255.255.0.0 U 1000 0 0 wlp3s0
192.168.64.0 0.0.0.0 255.255.224.0 U 600 0 0 wlp3s0

● netstat
kshitij@KshitijSharma-HP:~/Network Programs$ netstat -ta
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain 0.0.0.0:* LISTEN
tcp 0 0 localhost:ipp 0.0.0.0:* LISTEN
tcp 0 0 KshitijSharma-HP:33190 del03s16-in-f13.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:53084 del03s01-in-f6.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:47460 104.28.27.130:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:55300 del03s10-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:43748 del03s09-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:34156 del03s06-in-f3.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:47084 del03s15-in-f3.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:45734 sc-in-f189.1e100.:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:59728 104.31.91.96:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:34158 del03s06-in-f3.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:42934 del03s10-in-f3.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:50476 del03s13-in-f8.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:35850 del03s13-in-f4.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:35856 del03s13-in-f4.1e:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:37774 del03s05-in-f10.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:33216 del03s16-in-f13.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:57130 del03s13-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:41862 del03s15-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:55042 whatsapp-cdn-shv-:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:41884 del03s15-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:43734 del03s09-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:34950 151.101.156.133:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:46136 sa-in-f188.1e100.n:5228 ESTABLISHED
tcp 0 0 KshitijSharma-HP:55332 del03s10-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:33676 del03s01-in-f10.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:36376 del03s05-in-f14.1:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:46132 172.217.194.189:https ESTABLISHED
tcp 0 0 KshitijSharma-HP:49196 wa-in-f120.1e100.:https ESTABLISHED
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN

● ping
kshitij@KshitijSharma-HP:~/Network Programs$ ping google.com
PING google.com (172.217.160.238) 56(84) bytes of data.
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=1 ttl=55 time=4.83
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=2 ttl=55 time=6.80
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=3 ttl=55 time=7.11
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=4 ttl=55 time=5.48
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=5 ttl=55 time=5.68
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=6 ttl=55 time=6.36
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=7 ttl=55 time=4.79
ms
64 bytes from del03s09-in-f14.1e100.net (172.217.160.238): icmp_seq=8 ttl=55 time=6.61
ms
^C
--- google.com ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7010ms
rtt min/avg/max/mdev = 4.791/5.960/7.117/0.839 ms

● arp
kshitij@KshitijSharma-HP:~/Network Programs$ arp
Address HWtype HWaddress Flags Mask Iface
_gateway ether 2c:33:11:ea:92:00 C wlp3s0

● traceroute
kshitij@KshitijSharma-HP:~/Network Programs$ traceroute microsoft.com
traceroute to microsoft.com (104.215.148.63), 30 hops max, 60 byte packets
1 _gateway (192.168.43.1) 4.774 ms !N 5.321 ms !N 5.143 ms !N

● tcpdump
kshitij@KshitijSharma-HP:~/Network Programs$ sudo tcpdump -c 5 -i wlp3s0
[sudo] password for kshitij:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes
06:31:23.760230 IP KshitijSharma-HP.52922 > 239.255.255.250.1900: UDP, length 171
06:31:23.787816 IP KshitijSharma-HP.57873 > 192.168.30.104.domain: 14853+ [1au] PTR?
250.255.255.239.in-addr.arpa. (57)
06:31:23.796610 IP 192.168.30.104.domain > KshitijSharma-HP.57873: 14853 NXDomain
0/1/1 (114)
06:31:23.796731 IP KshitijSharma-HP.57873 > 192.168.30.104.domain: 14853+ PTR?
250.255.255.239.in-addr.arpa. (46)
06:31:23.810881 IP 192.168.30.104.domain > KshitijSharma-HP.57873: 14853 NXDomain
0/1/0 (103)
5 packets captured
13 packets received by filter
5 packets dropped by kernel

● xxd
kshitij@KshitijSharma-HP:~/Network Programs$ xxd -s 0x20 test.cpp
00000020: 6365 2073 7464 3b0a 696e 7420 6d61 696e ce std;.int main
00000030: 2829 7b0a 636f 7574 3c3c 2248 656c 6c6f (){.cout<<"Hello
00000040: 204b 7368 6974 696a 223b 0a72 6574 7572 Kshitij";.retur
00000050: 6e20 303b 0a7d 0a n 0;.}.

● host
kshitij@KshitijSharma-HP:~/Network Programs$ host google.com
google.com has address 172.217.24.238
google.com has IPv6 address 2404:6800:4002:807::200e
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.

● nslookup
kshitij@KshitijSharma-HP:~/Network Programs$ nslookup google.com
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: google.com
Address: 172.217.24.238
Name: google.com
Address: 2404:6800:4002:807::200e

● dig
kshitij@KshitijSharma-HP:~/Network Programs$ dig google.com

; <<>> DiG 9.11.3-1ubuntu1.3-Ubuntu <<>> google.com


;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10473
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 125 IN A 172.217.24.238

;; Query time: 0 msec


;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Mon Feb 04 06:39:49 IST 2019
;; MSG SIZE rcvd: 55

● nmap
kshitij@KshitijSharma-HP:~/Network Programs$ nmap 192.168.77.58

Starting Nmap 7.60 ( https://nmap.org ) at 2019-02-04 06:40 IST


Nmap scan report for KshitijSharma-HP (192.168.77.58)
Host is up (0.000058s latency).
All 1000 scanned ports on KshitijSharma-HP (192.168.77.58) are closed

Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds


2 - Use vi editor, gcc compiler, makefile and gdb debugger in developing these
programs.

a. Write a program in C/C++ to display the Four Network parameters (IPv4 Address,
Netmask, Default Gateway, DNS Server), MAC address by using the following
commands / functionalities: system, ifconfig, STDOUT redirection, systemd-resolve
--status, nmcli device show wlp3s0.
CODE-
#include <bits/stdc++.h>
using namespace std;
int main()
{
system("nmcli device show wlp3s0 1>tmpout");
fstream file, file2;
string word, t, q, filename, filename2;
filename = "tmpout";
file.open(filename.c_str());
while (file >> word)
{
if (word == "IP4.ADDRESS[1]:")
{
file >> word;
cout << "IP address is : " << word << endl;
continue;
}
if (word == "IP4.GATEWAY:")
{
file >> word;
cout << "IP gateway is : " << word << endl;
continue;
}
if (word == "IP4.DNS[1]:")
{
file >> word;
cout << "IP4 DNS is : " << word << endl;
continue;
}
if (word == "IP4.DNS[2]:")
{
file >> word;
cout << "IP4 DNS is : " << word << endl;
continue;
}
}
system("ifconfig wlp3s0 1>tmpout2 ");
filename2 = "tmpout2";
file2.open(filename2.c_str());
while (file2 >> word)
{
if (word == "netmask")
{
file2 >> word;
cout << "NetMask: " << word << endl;
break;
}
}
return 0;
}

COMPILE AND RUN :-

kshitij@KshitijSharma-HP:~/Network Programs$ nano a1q1.cpp


kshitij@KshitijSharma-HP:~/Network Programs$ g++ -o a a1q1.cpp
kshitij@KshitijSharma-HP:~/Network Programs$ ./a
IP address is : 192.168.77.58/19
IP gateway is : 192.168.95.254
IP4 DNS is : 14.139.5.5
IP4 DNS is : 192.168.30.104
NetMask: 255.255.224.0

b. Create and handle Processes in Linux operating system. Make use of fork, sleep,
wait, exit, getpid, getppid system calls and ps, kill Linux commands

CODE :-
#include<unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <stdbool.h>
int main()
{
int status,exstat;
pid_t cid1=fork();
pid_t cid2=fork();
if(cid1>0&&cid2>0)
{
int x=waitpid(cid1,&status,0);
exstat = WEXITSTATUS(status);
bool bl=false;
bl=WIFEXITED(status);
printf(" %d %d %d\n",exstat,x,bl);
printf("Parent process\n");
printf("%d %d \n",getpid(),getppid());
}
if(cid1==0&&cid2>0)
{
printf("Child 1 process\n");
pid_t mypid = getpid();
//kill(mypid,SIGKILL);
_exit(2);
}
if(cid1>0&&cid2==0)
{
sleep(5);
printf("Child 2 process\n");
}
if(cid1==0&&cid2==0)
{
printf("Grandchild process\n");
exit( EXIT_SUCCESS );
}
}

COMPILE AND RUN :-


kshitij@KshitijSharma-HP:~/Network Programs$ nano a1q2.cpp
kshitij@KshitijSharma-HP:~/Network Programs$ g++ -o a a1q2.cpp
kshitij@KshitijSharma-HP:~/Network Programs$ ./a
Child 1 process
Grandchild process
2 22565 1
Parent process
22564 16663

c. Design and implement a simple, interactive shell program that prompts the user for
a command, parses the command, and then executes it with a child process by
looking at PATH environment variable. Implement running of command in background
also. Properly handle Ctrl-c, Ctrl-d signals.
CODE :-
#include <iostream>
#include<string.h>
#include <signal.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/wait.h>
static volatile int keepRunning = 1;
void intHandler(int dummy)
{
printf("bye");
keepRunning = 0;
}
int parse(char *line, char **argv)
{
char *token = strtok(line, " ");
argv[0] = token;
int k = 1;
while (token != NULL)
{
token = strtok(NULL, " ");
argv[k] = token;
k++;
}
argv[k] = NULL;
return k;
}
int main()
{
char line[1024];
char *argv[64];
signal(SIGINT, intHandler);
while (keepRunning)
{
printf("$");
std::cin>>line;
if (strcmp(line, "exit") == 0)
break;
else
{
int len = parse(line, argv);
if (fork() == 0)
{
if (len > 0)
{
execvp(argv[0], argv);
}
}
wait(NULL);
}
}
return 0;
}
COMPILE AND RUN :-
kshitij@KshitijSharma-HP:~/Network Programs$ nano a1q2.cpp
kshitij@KshitijSharma-HP:~/Network Programs$ g++ -o a a1q2.cpp
kshitij@KshitijSharma-HP:~/Network Programs$ ./a
$ifconfig
eno1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 40:b0:34:c3:c6:25 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536


inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 19864 bytes 1667508 (1.6 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 19864 bytes 1667508 (1.6 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500


inet 192.168.77.58 netmask 255.255.224.0 broadcast 192.168.95.255
inet6 fe80::b903:6c4e:5d4:dcf prefixlen 64 scopeid 0x20<link>
ether 10:f0:05:3c:69:aa txqueuelen 1000 (Ethernet)
RX packets 467560 bytes 571326865 (571.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 196657 bytes 28566134 (28.5 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
#include <stdio.h>
#include <stdlib.h>
#include <pcap.h> /* if this gives you an error try pcap/pcap.h */
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/if_ether.h> /* includes net/ethernet.h */

int main(int argc, char **argv)


{
int i;
char *dev;
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t* descr;
const u_char *packet;
struct pcap_pkthdr hdr; /* pcap.h */
struct ether_header *eptr; /* net/ethernet.h */

u_char *ptr; /* printing out hardware header info */

/* grab a device to peak into... */


dev = pcap_lookupdev(errbuf);

if(dev == NULL)
{
printf("%s\n",errbuf);
exit(1);
}

printf("DEV: %s\n",dev);

/* open the device for sniffing.

pcap_t *pcap_open_live(char *device,int snaplen, int prmisc,int to_ms,


char *ebuf)

snaplen - maximum size of packets to capture in bytes


promisc - set card in promiscuous mode?
to_ms - time to wait for packets in miliseconds before read
times out
errbuf - if something happens, place error string here

Note if you change "prmisc" param to anything other than zero, you will
get all packets your device sees, whether they are intendeed for you or
not!! Be sure you know the rules of the network you are running on
before you set your card in promiscuous mode!! */

descr = pcap_open_live(dev,BUFSIZ,0,-1,errbuf);

if(descr == NULL)
{
printf("pcap_open_live(): %s\n",errbuf);
exit(1);
}

/*
grab a packet from descr (yay!)
u_char *pcap_next(pcap_t *p,struct pcap_pkthdr *h)
so just pass in the descriptor we got from
our call to pcap_open_live and an allocated
struct pcap_pkthdr */

packet = pcap_next(descr,&hdr);

if(packet == NULL)
{/* dinna work *sob* */
printf("Didn't grab packet\n");
exit(1);
}

/* struct pcap_pkthdr {
struct timeval ts; time stamp
bpf_u_int32 caplen; length of portion present
bpf_u_int32; lebgth this packet (off wire)
}
*/

printf("Grabbed packet of length %d\n",hdr.len);


printf("Recieved at ..... %s\n",ctime((const time_t*)&hdr.ts.tv_sec));
printf("Ethernet address length is %d\n",ETHER_HDR_LEN);

/* lets start with the ether header... */


eptr = (struct ether_header *) packet;

/* Do a couple of checks to see what packet type we have..*/


if (ntohs (eptr->ether_type) == ETHERTYPE_IP)
{
printf("Ethernet type hex:%x dec:%d is an IP packet\n",
ntohs(eptr->ether_type),
ntohs(eptr->ether_type));
}else if (ntohs (eptr->ether_type) == ETHERTYPE_ARP)
{
printf("Ethernet type hex:%x dec:%d is an ARP packet\n",
ntohs(eptr->ether_type),
ntohs(eptr->ether_type));
}else {
printf("Ethernet type %x not IP", ntohs(eptr->ether_type));
exit(1);
}

/* copied from Steven's UNP */


ptr = eptr->ether_dhost;
i = ETHER_ADDR_LEN;
printf(" Destination Address: ");
do{
printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
}while(--i>0);
printf("\n");

ptr = eptr->ether_shost;
i = ETHER_ADDR_LEN;
printf(" Source Address: ");
do{
printf("%s%x",(i == ETHER_ADDR_LEN) ? " " : ":",*ptr++);
}while(--i>0);
printf("\n");

return 0;
}
Assignment 2

Wireshark Network Protocol Analyzer is a tool for capturing, displaying, and


analyzing
the frames, packets, and messages that are exchanged in a network. Reading
material for attempting this exercise is provided at the end of this assignment.

Part 1: Install Wireshark. Run it to capture packets. Start a web session (visit
some website after starting wireshark). Analyse the captured packets for
various information like: MAC Address, IP Address, Checksum, Port Number
and many other related information from headers of various layers. Repeat the
above for PING and TRACEROUTE linux commands
also. Learn to apply filters. Save the captured packets in a dump file in pcap
format.

OUTPUT :-
udp
/tmp/wireshark_eth0_20190209051836_IUkOtp.pcapng 149 total packets, 149 shown
123 1.053161085
10.0.2.15
172.217.167.206
UDP
74
34567 → 33489 Len=32
Frame 123: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: PcsCompu_37:c5:57 (08:00:27:37:c5:57), Dst: RealtekU_12:35:02 (52:54:00:12:35:02)
Destination: RealtekU_12:35:02 (52:54:00:12:35:02)
Address: RealtekU_12:35:02 (52:54:00:12:35:02)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory
default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: PcsCompu_37:c5:57 (08:00:27:37:c5:57)
Address: PcsCompu_37:c5:57 (08:00:27:37:c5:57)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.0.2.15, Dst: 172.217.167.206
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 60
Identification: 0x67c0 (26560)
Flags: 0x00
Fragment offset: 0
Time to live: 19
Protocol: UDP (17)
Header checksum: 0xdf3a [validation disabled]
[Header checksum status: Unverified]
Source: 10.0.2.15
Destination: 172.217.167.206
[Source GeoIP: Unknown]
[Destination GeoIP: Mountain View, CA, United States, AS15169 Google Inc., Mountain View, CA, United
States, AS15169 Google Inc., 37.419201, -122.057404]
User Datagram Protocol, Src Port: 34567, Dst Port: 33489
Source Port: 34567
Destination Port: 33489
Length: 40
Checksum: 0x60f0 [unverified]
[Checksum Status: Unverified]
[Stream index: 74]
Data (32 bytes)
0000 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f
@ABCDEFGHIJKLMNO
0010 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f
PQRSTUVWXYZ[\]^_
Data: 404142434445464748494a4b4c4d4e4f5051525354555657...
[Length: 32]

ping youtube.com
Icmp

/tmp/wireshark_eth0_20190209051341_NbwRRg.pcapng 20 total packets, 20 shown


13 3.024769163
10.0.2.15
172.217.31.14
ICMP
98
Echo (ping) request
id=0x1bbd, seq=4/1024, ttl=64 (reply in 14)
Frame 13: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0
Ethernet II, Src: PcsCompu_37:c5:57 (08:00:27:37:c5:57), Dst: RealtekU_12:35:02 (52:54:00:12:35:02)
Destination: RealtekU_12:35:02 (52:54:00:12:35:02)
Address: RealtekU_12:35:02 (52:54:00:12:35:02)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory
default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: PcsCompu_37:c5:57 (08:00:27:37:c5:57)
Address: PcsCompu_37:c5:57 (08:00:27:37:c5:57)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.0.2.15, Dst: 172.217.31.14
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 84
Identification: 0x4937 (18743)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: ICMP (1)
Header checksum: 0x197c [validation disabled]
[Header checksum status: Unverified]
Source: 10.0.2.15
Destination: 172.217.31.14
[Source GeoIP: Unknown]
[Destination GeoIP: Mountain View, CA, United States, AS15169 Google Inc., Mountain View, CA, United
States, AS15169 Google Inc., 37.419201, -122.057404]
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x8ab6 [correct]
[Checksum Status: Good]
Identifier (BE): 7101 (0x1bbd)
Identifier (LE): 48411 (0xbd1b)
Sequence number (BE): 4 (0x0004)
Sequence number (LE): 1024 (0x0400)
[Response frame: 14]
Timestamp from icmp data: Feb 9, 2019 05:13:59.000000000 EST
[Timestamp from icmp data (relative): 0.242037482 seconds]
Data (48 bytes)
0000 49 b1 03 00 00 00 00 00 10 11 12 13 14 15 16 17
I...............
0010 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27
........ !"#$%&'
0020 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37
()*+,-./01234567

Part 2: Open the pcap dump file (a binary file) using C program. Read the
PCAP file structure. Retrieve the header information from the binary file and
show it on the display.

#include <string>
#include <iostream>
#include <pcap.h>
using namespace std;
int main(int argc, char *argv[])
{string file = "ping.pcap";
pcap_t * pcap = pcap_open_offline(file.c_str(), errbuff);
const u_char *data;
u_int packetCount = 0;
while (int returnValue = pcap_next_ex(pcap, &header, &data) >= 0)
{printf("Packet # %i\n", ++packetCount);
// Show the size in bytes of the packet
printf("Packet size: %d bytes\n", header->len);
// Show a warning if the length captured is different
if (header->len != header->caplen)
printf("Warning! Capture size different than packet size: %ld
bytes\n", header->len);
// Show Epoch Time
printf("Epoch Time: %d:%d seconds\n", header->ts.tv_sec, header->ts.tv_usec);
// loop through the packet and print it as hexidecimal representations octets
// We also have a function that does this similarly below: PrintData()
for (u_int i=0; (i < header->caplen ) ; i++)
{
// Start printing on the next after every 16 octets
if ( (i % 16) == 0) printf("\n");

// Print each octet as hex (x), make sure there is always two
characters (.2).
printf("%.2x ", data[i]);
}

printf("\n\n");
}
}

Output :-
kshitij@KshitijSharma-HP:~/Desktop# g++ read_pcap.cpp -lpcap
kshitij@KshitijSharma-HP:~/Desktop# ./a.out
Packet # 1
Packet size: 90 bytes
Epoch Time: 1549821325:201578 seconds

52 54 00 12 35 02 08 00 27 37 c5 57 08 00 45 10
00 4c 02 1c 40 00 40 11 ae 9d 0a 00 02 0f d1 3a
ac 8e ca 90 00 7b 00 38 8a 21 23 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 e0 0a e4 0d 0c 03 24 23

Packet # 2
Packet size: 90 bytes
Epoch Time: 1549821325:339976 seconds

08 00 27 37 c5 57 52 54 00 12 35 02 08 00 45 00
00 4c 1e 3a 00 00 40 11 d2 8f d1 3a ac 8e 0a 00
02 0f 00 7b ca 90 00 38 f0 32 24 02 03 e9 00 00
2b 26 00 00 0a c3 55 c7 d6 62 e0 0a e3 0e b8 e1
d3 39 e0 0a e4 0d 0c 03 24 23 e0 0a e4 0d 4e c9
f9 5c e0 0a e4 0d 4e ca cd d2

Potrebbero piacerti anche