/* 
	An example packet sniffer for Linux 2.4

	By j00n1x (c) 2003

	Greetz: #sk4z1 krew 
	Thankz: thc69x for the idea! Now we can work on that l33t stuff..

	This program requires superuser (root).

	Note:
	It uses af_inet/sock_raw and pf_packet/sock_dgram. 
	There are some caveats/features expected with Linux 2.2+ that
	may cause this program to fail on other systems.
*/

// sniffing method: af_inet/sock_raw or pf_packet/sock_dgram
// pf_packet/sock_dgram can grab all protocols (under IP)
// whereas af_inet/sock_raw can only grab specific protocols
#define USE_GRAB_ALL

// standard C include files
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// unix header files
#include <unistd.h> // for write(), close()

// BSD socket header files
#include <sys/socket.h>
#include <sys/types.h>

// resolver header files
#include <netdb.h>
#include <netinet/in.h>

// hostname to ip address conversion functions
#include <arpa/inet.h>

// raw packet files - IP
#include <netinet/ip.h>

// pf_packet files
#include <asm/types.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>

int main(int argc, char **argv)
{
	int fd; 
	char buf[1024*64];
	struct iphdr *iph;
	struct sockaddr_in to;
	char source[1024], dest[1024]; // source/dest ip address
	char *p;
	struct protoent *pent;
	char protocol[1024];

	// grab raw socket
#ifndef USE_GRAB_ALL
	fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
#else
	fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP));
#endif
	if (fd < 0) { 
		perror("socket");
		exit(1);
	}

	// setup pointers to point inside buffer
	iph = (void *) buf;

	// main loop

	while (1) {
		if (recvfrom(fd, buf, sizeof(buf), 0, NULL, NULL) < 0) {
			perror("recvfrom");
		}

		// convert our data into strings, so we can
		// print them out 'nicely'

		to.sin_addr.s_addr = iph->saddr;
		p = inet_ntoa(to.sin_addr);
		strcpy(source, p);

		to.sin_addr.s_addr = iph->daddr;
		p = inet_ntoa(to.sin_addr);
		strcpy(dest, p);

		pent = getprotobynumber(iph->protocol);
		if (!pent) {
			perror("getprotobynumber");
			strcpy(protocol, "");
		}
		else {
			strcpy(protocol, pent->p_name);
		}

		// print out details

		printf("%s -> %s\n", source, dest);
		printf("version: %d\t", iph->version);
		printf("ihl: %d\t", iph->ihl);
		printf("tos: %d\t", iph->tos);
		printf("tot_len: %d\t", ntohs(iph->tot_len));
		printf("id: %d\t", ntohs(iph->id));
		printf("frag_off: %d\n", ntohs(iph->frag_off));
		printf("ttl: %d\t", iph->ttl);
		if (pent)
			printf("protocol: %d (%s)\t", iph->protocol, protocol);
		else 
			printf("protocol: %d\t", iph->protocol);
		printf("check: %d\t", ntohs(iph->check));

		printf("\n\n");
	}

	close(fd);

	return 0;
}