c++pcapwinpcap

Display IP Address with dots from in_addr struct


My teacher gave me a task to read pcap file in C++ and display some informations about every message. Using some old resources I managed to read the pcap file, however I have problems with accessing IP header etc.

I have ip_src object which is instance of in_addr struct, doing cout << "IP: "<< ip->ip_src.s_addr << endl; displays IP: 167772170.

Somewhere I found inet_ntoa function, but it gives me an error: unresolved external symbol _imp_inet_ntoa@4 referenced in function _main while using as: cout << "IP: "<< inet_ntoa(ip->ip_src) << endl;, but the Visual Studio detects this function and is giving an advice of what type the argument should be.

My whole code:

#define _WINSOCK_DEPRECATED_NO_WARNINGS
#include <iostream>
#include <string>
#include <winsock2.h>
#include "pcap.h"

/* Ethernet addresses are 6 bytes */
#define ETHER_ADDR_LEN  6

/* Ethernet header */
struct sniff_ethernet {
    u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
    u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
    u_short ether_type; /* IP? ARP? RARP? etc */
};

/* IP header */
struct sniff_ip {
    u_char ip_vhl;      /* version << 4 | header length >> 2 */
    u_char ip_tos;      /* type of service */
    u_short ip_len;     /* total length */
    u_short ip_id;      /* identification */
    u_short ip_off;     /* fragment offset field */
#define IP_RF 0x8000        /* reserved fragment flag */
#define IP_DF 0x4000        /* dont fragment flag */
#define IP_MF 0x2000        /* more fragments flag */
#define IP_OFFMASK 0x1fff   /* mask for fragmenting bits */
    u_char ip_ttl;      /* time to live */
    u_char ip_p;        /* protocol */
    u_short ip_sum;     /* checksum */
    struct in_addr ip_src, ip_dst; /* source and dest address */
};
#define IP_HL(ip)       (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip)        (((ip)->ip_vhl) >> 4)

/* TCP header */
typedef u_int tcp_seq;

struct sniff_tcp {
    u_short th_sport;   /* source port */
    u_short th_dport;   /* destination port */
    tcp_seq th_seq;     /* sequence number */
    tcp_seq th_ack;     /* acknowledgement number */
    u_char th_offx2;    /* data offset, rsvd */
#define TH_OFF(th)  (((th)->th_offx2 & 0xf0) >> 4)
    u_char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
    u_short th_win;     /* window */
    u_short th_sum;     /* checksum */
    u_short th_urp;     /* urgent pointer */
};

#define SIZE_ETHERNET 14

const struct sniff_ethernet *ethernet; /* The ethernet header */
const struct sniff_ip *ip; /* The IP header */
const struct sniff_tcp *tcp; /* The TCP header */
const char *payload; /* Packet payload */

u_int size_ip;
u_int size_tcp;

using namespace std;

int main() {
    string file = "C:\\Users\\Adrian\\source\\repos\\pcap\\pcap\\register.pcap";
    char errbuff[PCAP_ERRBUF_SIZE];

    pcap_t * pcap = pcap_open_offline(file.c_str(), errbuff);
    struct pcap_pkthdr *header;
    const u_char * packet;

    u_int packetCount = 0;
    while (int returnValue = pcap_next_ex(pcap, &header, &packet) >= 0) {
        printf("Packet # %i\n", ++packetCount);
        printf("Packet size: %ld bytes\n", header->len);
        printf("Epoch Time: %ld:%ld seconds\n", header->ts.tv_sec, header->ts.tv_usec);
        ethernet = (struct sniff_ethernet*)(packet);
        ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
        size_ip = IP_HL(ip) * 4;
        if (size_ip < 20) {
            printf("   * Invalid IP header length: %u bytes\n", size_ip);
            system("pause");
            return 0;
        }
        tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
        size_tcp = TH_OFF(tcp) * 4;
        if (size_tcp < 20) {
            printf("   * Invalid TCP header length: %u bytes\n", size_tcp);
            system("pause");
            return 0;
        }
        cout << "IP: "<< inet_ntoa(ip->ip_src) << endl;
    }
    printf("\n\n");
    system("pause");
    return 0;
}

Solution

  • you have already the binary address IPv4, you simply could split the address with: IP: 167772170

    unsigned int ip_v4_addr = 1677772170;
    
    printf("IP-Address: %u.%u.%u.%u\n", ip_v4_addr >> 24, (ip_v4_addr >> 16) & 0xff, \
       (ip_v4_addr >> 8) & 0xff, ip_v4_addr & 0xff );