使用Netfilter进行数据包分析
#include <linux/init.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
MODULE_LICENSE("GPL");
void analyzeIPHeader(struct iphdr* ip_hdr)
{
printk("***********IP Header***********\n");
printk("%30s:\t0x%02x\n", "Version",
ip_hdr->version);
printk("%30s:\t0x%02x (%u)\n", "Header Length(Bytes)",
ip_hdr->ihl,
ip_hdr->ihl);
printk("%30s:\t0x%02x\n", "Type of service",
ip_hdr->tos);
printk("%30s:\t0x%04x (%u)\n", "Total Length(Bytes)",
ip_hdr->tot_len,
ip_hdr->tot_len);
printk("%30s:\t0x%04x (%u)\n", "Identification",
ip_hdr->id,
ip_hdr->id);
printk("%30s:\t0x%04x (%u)\n", "Fragment Offset",
ip_hdr->frag_off,
ip_hdr->frag_off);
printk("%30s:\t0x%02x\n", "Time to live",
ip_hdr->ttl);
printk("%30s:\t0x%02x", "Protocol",
ip_hdr->protocol);
if (ip_hdr->protocol == 0x11)
{
printk(" [UDP]\n");
}
else if (ip_hdr->protocol == 0x06)
{
printk(" [TCP]\n");
}
else if (ip_hdr->protocol == 0x01)
{
printk(" [ICMP]\n");
}
else if (ip_hdr->protocol == 0x02)
{
printk(" [IGMP]\n");
}
printk("%30s:\t0x%04x\n", "Header Checksum (CRC)",
ip_hdr->check);
printk("%30s:\t%u:%u:%u:%u\n", "Source IP Address",
*(unsigned char*)(((unsigned char*)&ip_hdr->saddr) + 0),
*(unsigned char*)(((unsigned char*)&ip_hdr->saddr) + 1),
*(unsigned char*)(((unsigned char*)&ip_hdr->saddr) + 2),
*(unsigned char*)(((unsigned char*)&ip_hdr->saddr) + 3)
);
printk("%30s:\t%u:%u:%u:%u\n", "Destination IP Address",
*(unsigned char*)(((unsigned char*)&ip_hdr->daddr) + 0),
*(unsigned char*)(((unsigned char*)&ip_hdr->daddr) + 1),
*(unsigned char*)(((unsigned char*)&ip_hdr->daddr) + 2),
*(unsigned char*)(((unsigned char*)&ip_hdr->daddr) + 3)
);
}
unsigned int hook_func(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *sb = skb;
struct iphdr *iph ;
if (sb != NULL)
{
iph = ip_hdr(sb);
// printk("sk_buff : 0x%08x ip_hdr : 0x%08x \n", sb, iph);
if (iph != NULL)
{
// printk("ip: %d:%d\n", iph->saddr, iph->daddr);
analyzeIPHeader(iph);
}
}
return NF_ACCEPT;
}
static struct nf_hook_ops hook_ops = {
.hook = hook_func,
.hooknum = NF_INET_PRE_ROUTING,
.pf = PF_INET,
.priority = NF_IP_PRI_FIRST,
};
static int pslist_init()
{
printk("###################################################################\n");
// analyzeRegisters();
// analyzeUMANode();
// analyzeProcesses();
// analyzePhysicalPages();
// analyzeTaskPgd();
// cpuidTest();
// netanalyze();
nf_register_hook(&hook_ops);
return 0;
}
static void pslist_exit()
{
nf_unregister_hook(&hook_ops);
printk("###################################################################\n");
}
module_init(pslist_init);
module_exit(pslist_exit);
结果如下：
[ 3026.194484] ***********IP Header***********
[ 3026.194487] Version: 0x04
[ 3026.194489] Header Length(Bytes): 0x05 (5)
[ 3026.194490] Type of service: 0x00
[ 3026.194491] Total Length(Bytes): 0x7c00 (31744)
[ 3026.194492] Identification: 0xdd24 (56612)
[ 3026.194493] Fragment Offset: 0x0000 (0)
[ 3026.194494] Time to live: 0x40
[ 3026.194494] Protocol: 0x11 [UDP]
[ 3026.194496] Header Checksum (CRC): 0x0f3e
[ 3026.194497] Source IP Address: 10:64:1:55
[ 3026.194498] Destination IP Address: 127:0:0:1
[ 3026.439485] ***********IP Header***********
[ 3026.439489] Version: 0x04
[ 3026.439490] Header Length(Bytes): 0x05 (5)
[ 3026.439491] Type of service: 0x00
[ 3026.439492] Total Length(Bytes): 0x2800 (10240)
[ 3026.439493] Identification: 0xde24 (56868)
[ 3026.439494] Fragment Offset: 0x0000 (0)
[ 3026.439495] Time to live: 0x40
[ 3026.439496] Protocol: 0x06 [TCP]
[ 3026.439497] Header Checksum (CRC): 0x5d03
[ 3026.439499] Source IP Address: 115:239:210:151
[ 3026.439500] Destination IP Address: 127:0:0:1
[ 3026.746484] ***********IP Header***********
[ 3026.746495] Version: 0x04
[ 3026.746503] Header Length(Bytes): 0x05 (5)
[ 3026.746504] Type of service: 0x00
[ 3026.746505] Total Length(Bytes): 0x2800 (10240)
[ 3026.746506] Identification: 0xdf24 (57124)
[ 3026.746507] Fragment Offset: 0x0000 (0)
[ 3026.746508] Time to live: 0x40
[ 3026.746509] Protocol: 0x06 [TCP]
[ 3026.746510] Header Checksum (CRC): 0x7b11
[ 3026.746511] Source IP Address: 180:149:131:210
[ 3026.746513] Destination IP Address: 127:0:0:1
[ 3028.557038] ***********IP Header***********
[ 3028.557042] Version: 0x04
[ 3028.557043] Header Length(Bytes): 0x05 (5)
[ 3028.557044] Type of service: 0x00
[ 3028.557045] Total Length(Bytes): 0x2800 (10240)
[ 3028.557046] Identification: 0xe024 (57380)
[ 3028.557047] Fragment Offset: 0x0000 (0)
[ 3028.557048] Time to live: 0x40
[ 3028.557049] Protocol: 0x06 [TCP]
[ 3028.557050] Header Checksum (CRC): 0x6329
[ 3028.557052] Source IP Address: 61:160:226:222
[ 3028.557053] Destination IP Address: 127:0:0:1
[ 3028.617738] ***********IP Header***********
[ 3028.617742] Version: 0x04
[ 3028.617743] Header Length(Bytes): 0x05 (5)
[ 3028.617744] Type of service: 0x00
[ 3028.617746] Total Length(Bytes): 0x2800 (10240)
[ 3028.617747] Identification: 0xe124 (57636)
[ 3028.617748] Fragment Offset: 0x0000 (0)
[ 3028.617749] Time to live: 0x40
[ 3028.617749] Protocol: 0x06 [TCP]
[ 3028.617751] Header Checksum (CRC): 0x74ca
[ 3028.617752] Source IP Address: 58:221:68:143
[ 3028.617753] Destination IP Address: 127:0:0:1
[ 3028.624231] ***********IP Header***********
[ 3028.624234] Version: 0x04
[ 3028.624235] Header Length(Bytes): 0x05 (5)
[ 3028.624236] Type of service: 0x00
[ 3028.624237] Total Length(Bytes): 0x2800 (10240)
[ 3028.624238] Identification: 0xe224 (57892)
[ 3028.624239] Fragment Offset: 0x0000 (0)
[ 3028.624240] Time to live: 0x40
[ 3028.624241] Protocol: 0x06 [TCP]
[ 3028.624243] Header Checksum (CRC): 0x6fef
[ 3028.624244] Source IP Address: 58:216:31:152
[ 3028.624245] Destination IP Address: 127:0:0:1
[ 3030.353175] ***********IP Header***********
[ 3030.353179] Version: 0x04
[ 3030.353180] Header Length(Bytes): 0x05 (5)
[ 3030.353181] Type of service: 0x00
[ 3030.353182] Total Length(Bytes): 0x2800 (10240)
[ 3030.353183] Identification: 0xe324 (58148)
[ 3030.353184] Fragment Offset: 0x0000 (0)
[ 3030.353185] Time to live: 0x40
[ 3030.353186] Protocol: 0x06 [TCP]
[ 3030.353187] Header Checksum (CRC): 0x6203
[ 3030.353188] Source IP Address: 115:239:210:141
[ 3030.353190] Destination IP Address: 127:0:0:1
[ 3030.353785] ***********IP Header***********
[ 3030.353787] Version: 0x04
[ 3030.353788] Header Length(Bytes): 0x05 (5)
[ 3030.353788] Type of service: 0x00
[ 3030.353790] Total Length(Bytes): 0x2800 (10240)
[ 3030.353790] Identification: 0xe424 (58404)
[ 3030.353791] Fragment Offset: 0x0000 (0)
[ 3030.353792] Time to live: 0x40
[ 3030.353793] Protocol: 0x06 [TCP]
[ 3030.353794] Header Checksum (CRC): 0x6103
[ 3030.353795] Source IP Address: 115:239:210:141
[ 3030.353797] Destination IP Address: 127:0:0:1
[ 3030.354357] ***********IP Header***********
[ 3030.354358] Version: 0x04
[ 3030.354359] Header Length(Bytes): 0x05 (5)
[ 3030.354360] Type of service: 0x00
[ 3030.354361] Total Length(Bytes): 0x2800 (10240)
[ 3030.354362] Identification: 0xe524 (58660)
[ 3030.354363] Fragment Offset: 0x0000 (0)
[ 3030.354364] Time to live: 0x40
[ 3030.354365] Protocol: 0x06 [TCP]
[ 3030.354366] Header Checksum (CRC): 0x6003
[ 3030.354367] Source IP Address: 115:239:210:141
[ 3030.354368] Destination IP Address: 127:0:0:1
[ 3030.682150] ***********IP Header***********
[ 3030.682154] Version: 0x04
[ 3030.682155] Header Length(Bytes): 0x05 (5)
[ 3030.682157] Type of service: 0x00
[ 3030.682158] Total Length(Bytes): 0x2800 (10240)
[ 3030.682159] Identification: 0xe624 (58916)
[ 3030.682160] Fragment Offset: 0x0000 (0)
[ 3030.682160] Time to live: 0x40
[ 3030.682161] Protocol: 0x06 [TCP]
[ 3030.682163] Header Checksum (CRC): 0x5f03
[ 3030.682164] Source IP Address: 115:239:210:141
[ 3030.682165] Destination IP Address: 127:0:0:1
[ 3035.425863] ###################################################################
为什么通过netfilter截获的sk_buff结构，无法通过其next域获取到整个的sk_buff列表？
这是因为，sk_buff列表是由网络接口层(以太网层)维护的，当有新的网络包传送过来，网卡会向CPU发出中断请求，CPU执行中断服务例程，将网卡上的内容读入到每个CPU特定的sk_buff列表中，这个列表就是我们所说的sk_buff列表。
为了尽快地执行完中断服务例程的Top Half，一旦将sk_buff保存到队列中，就马上返回。
上层的网络层可以根据需要从队列中拿出sk_buff进行处理，如果是发往本机的，就交给上层协议继续处理，如果是转发的，就再处理一下TTL，然后交给以太网层转发出去。
对于本机发往其他机器的sk_buff，通过各层协议，最终加入到CPU的sk_buff队列，然后交给以太网层传送出去。
通过上图可见，Netfilter处于的位置，都是在以太网层上面的，因此这时截获的sk_buff都是与队列无关，因此next域都是NULL。
否则的话，这应该也算是一个漏洞，因为相当于Netfilter就可以控制所有类型的sk_buff了，而不单单是它请求处理的类型。
使用Netfilter进行数据包分析的更多相关文章
- 《Wireshark数据包分析实战》 - http背后，tcp/ip抓包分析
作为网络开发人员,使用fiddler无疑是最好的选择,方便易用功能强. 但是什么作为爱学习的同学,是不应该止步于http协议的,学习wireshark则可以满足这方面的需求.wireshark作为抓取 ...
- WireShark数据包分析数据封装
WireShark数据包分析数据封装 数据封装(Data Encapsulation)是指将协议数据单元(PDU)封装在一组协议头和尾中的过程.在OSI七层参考模型中,每层主要负责与其它机器上的对等层 ...
- 可视化数据包分析工具-CapAnalysis
可视化数据包分析工具-CapAnalysis 我们知道,Xplico是一个从pcap文件中解析出IP流量数据的工具,本文介绍又一款实用工具-CapAnalysis(可视化数据包分析工具),将比Xpli ...
- snmp数据包分析
今天看了一下snmp数据包的报文格式,用wireshark抓了两个数据包来分析. 先说说snmp get-request的书报包格式吧,get-next-request,get-response,se ...
- tcprstat源码分析之tcp数据包分析
tcprstat是percona用来监测mysql响应时间的.不过对于任何运行在TCP协议上的响应时间,都可以用.本文主要做源码分析,如何使用tcprstat请大家查看博文<tcprstat分析 ...
- firebug登陆之数据包分析
登陆之数据包分析 工具: python-urllib2 | firefox+firebug或者chrome,用浏览器打开登陆页面之后,按F12键会默认打开开发者工具或者启动firebug,点击n ...
- Wireshark数据包分析(一)——使用入门
Wireshark简介: Wireshark是一款最流行和强大的开源数据包抓包与分析工具,没有之一.在SecTools安全社区里颇受欢迎,曾一度超越Metasploit.Nessus.Aircrack ...
- Wireshark工具抓包的数据包分析
Wireshark(前称Ethereal)是一个网络封包分析软件.网络封包分析软件的功能是撷取网络封包,并尽可能显示出最为详细的网络封包资料. Wireshark使用WinPCAP作为接口,直接与网卡 ...
- 网络数据包分析 网卡Offload
http://blog.nsfocus.net/network-packets-analysis-nic-offload/ 对于网络安全来说,网络传输数据包的捕获和分析是个基础工作,绿盟科技研 ...
随机推荐
- mysql left join 用法说明
left join中关于where和on条件的几个知识点: 1.多表left join是会生成一张临时表,并返回给用户 2.where条件是针对最后生成的这张临时表进行过滤,过滤掉不符合where条件 ...
- thinkphp 连接多个数据库
config配置文件 //数据库配置信息 'DB_CONFIG' => array( 'DB_TYPE' => 'mysql', // 数据库类型 'DB_HOST' => 'loc ...
- camunda授权的一些简单操作
/** * 授权操作 */public class ZccAuthorizationService { AuthorizationService authorizationService; @Befo ...
- Python面试题之下面代码会输出什么
def f(x,l=[]): for i in range(x): l.append(i*i) print l f(2) f(3,[3,2,1]) f(3) 答案: [0, 1] [3, 2, 1, ...
- 深海Django少年
orm查询,如果遇到我之前的环境报错 就可去manage.py中拷贝前四行代码到tests文件中,然后增加两行代码: import django django.setup() 或者任意新建一个py文件 ...
- android中的Serveice组件
创建 配置 Service: 1.定义一个继承了Service类的子类 2.在 AndroidManifest.xml清单文件中对开发的Service进行配置 Service和Activity很相似, ...
- 2019-9-2-win10-uwp-Markdown
title author date CreateTime categories win10 uwp Markdown lindexi 2019-09-02 12:57:38 +0800 2018-2- ...
- stat - 打印信息节点(inode)内容
SYNOPSIS(总览) stat filename [filenames ... ] DESCRIPTION(描述) stat 打印出一个信息节点的内容,它们显示为对人可读的格式的stat(2). ...
- elasticsearch启动常见问题
原文:https://blog.csdn.net/qq_22211217/article/details/80740873 一.Exception in thread "main" ...
- Linux下如何查看系统是多少位的
在Linux命令行下输入 getconf LONG_BIT 命令