AI 助理
备案控制台
开发者社区 云计算 文章 正文

tcpdump工具浅析

2014-07-17 1388
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介：      搞过网络的人，一般都会用到抓包分析工具，在windows下一般就是wireshark，在linux下面一般系统自带tcpdump. 这里我们就说说tcpdump，对于它的如何使用，请看资料，本身它支持的选项并不复杂，复杂的是它支持的过滤表达式.
     搞过网络的人，一般都会用到抓包分析工具，在windows下一般就是wireshark，在linux下面一般系统自带tcpdump. 这里我们就说说tcpdump，对于它的如何使用，请看资料，本身它支持的选项并不复杂，复杂的是它支持的过滤表达式. 不论wireshark或tcpdump我觉得最重要的两点，一个就是它们的基本原理，另外就是强大的解码系统.
   可以从 http://www.tcpdump.org/#latest-release下载最新的源码，和libpcap库.
 参考代码：tcpdump4.5.1  libpcap1.5.3
    我们看tcpdump主函数代码 tcpdump.c ：

点击(此处)折叠或打开

  1. int
  2. main(int argc, char **argv)
  3. {
  4.     register int cnt, op, i;
  5.     bpf_u_int32 localnet, netmask;
  6.     register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
  7.     pcap_handler callback;
  8.     int type;
  9.     int dlt;
  10.     int new_dlt;
  11.     const char *dlt_name;
  12.     struct bpf_program fcode;
  13. #ifndef WIN32
  14.     RETSIGTYPE (*oldhandler)(int);
  15. #endif
  16.     struct print_info printinfo;
  17.     struct dump_info dumpinfo;
  18.     u_char *pcap_userdata;
  19.     char ebuf[PCAP_ERRBUF_SIZE];
  20.     char VFileLine[PATH_MAX + 1];
  21.     char *username = NULL;
  22.     char *chroot_dir = NULL;
  23.     char *ret = NULL;
  24.     char *end;
  25. #ifdef HAVE_PCAP_FINDALLDEVS
  26.     pcap_if_t *devpointer;
  27.     int devnum;
  28. #endif
  29.     int status;
  30.     FILE *VFile;
  31. #ifdef WIN32
  32.     if(wsockinit() != 0) return 1;
  33. #endif /* WIN32 */

  35.     jflag=-1;    /* not set */
  36.         gndo->ndo_Oflag=1;
  37.     gndo->ndo_Rflag=1;
  38.     gndo->ndo_dlt=-1;
  39.     gndo->ndo_default_print=ndo_default_print;
  40.     gndo->ndo_printf=tcpdump_printf;
  41.     gndo->ndo_error=ndo_error;
  42.     gndo->ndo_warning=ndo_warning;
  43.     gndo->ndo_snaplen = DEFAULT_SNAPLEN;
  44.   
  45.     cnt = -1;
  46.     device = NULL;
  47.     infile = NULL;
  48.     RFileName = NULL;
  49.     VFileName = NULL;
  50.     VFile = NULL;
  51.     WFileName = NULL;
  52.     dlt = -1;
  53.     if ((cp = strrchr(argv[0], '/')) != NULL)
  54.         program_name = cp + 1;
  55.     else
  56.         program_name = argv[0];

  58.     if (abort_on_misalignment(ebuf, sizeof(ebuf)) 0)
  59.         error("%s", ebuf);

  61. #ifdef LIBSMI
  62.     smiInit("tcpdump");
  63. #endif

  65.     while (    //  对命令参数的处理 ，解析后，会设置flags，然后针对flags做相应的处理.
  66.      (op = getopt(argc, argv, "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOp" P_FLAG "qr:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:")) != -1)
  67.         switch (op) {

  69.         case 'a':
  70.             /* compatibility for old -a */
  71.             break;

  73.         case 'A':
  74.             ++Aflag;
  75.             break;
我们还需要看一个头文件，netdissect.h里定义了一个数据结构struct netdissect_options来描述tcdpump支持的所有参数动作，每一个参数有对应的flag, 在tcpdump 的main  里面，会根据用户的传入的参数来增加相应flag 数值，最后根据这些flag数值来实现特定动作。各个参数含义请参考源代码注释

点击(此处)折叠或打开

  1. struct netdissect_options {
  2.   int ndo_aflag;        /* translate network and broadcast addresses */
  3.   int ndo_bflag;        /* print 4 byte ASes in ASDOT notation */
  4.   int ndo_eflag;        /* print ethernet header */
  5.   int ndo_fflag;        /* don't translate "foreign" IP address */
  6.   int ndo_Kflag;        /* don't check TCP checksums */
  7.   int ndo_nflag;        /* leave addresses as numbers */
  8.   int ndo_Nflag;        /* remove domains from printed host names */
  9.   int ndo_qflag;        /* quick (shorter) output */
  10.   int ndo_Rflag;        /* print sequence # field in AH/ESP*/
  11.   int ndo_sflag;        /* use the libsmi to translate OIDs */
  12.   int ndo_Sflag;        /* print raw TCP sequence numbers */
  13.   int ndo_tflag;        /* print packet arrival time */
  14.   int ndo_Uflag;        /* "unbuffered" output of dump files */
  15.   int ndo_uflag;        /* Print undecoded NFS handles */
  16.   int ndo_vflag;        /* verbose */
  17.   int ndo_xflag;        /* print packet in hex */
  18.   int ndo_Xflag;        /* print packet in hex/ascii */
  19.   int ndo_Aflag;        /* print packet only in ascii observing TAB,
  20.                  * LF, CR and SPACE as graphical chars
  21.                  */
  22.   int ndo_Bflag;        /* buffer size */
  23.   int ndo_Iflag;        /* rfmon (monitor) mode */
  24.   int ndo_Oflag; /* run filter code optimizer */
  25.   int ndo_dlt; /* if != -1, ask libpcap for the DLT it names*/
  26.   int ndo_jflag; /* packet time stamp source */
  27.   int ndo_pflag; /* don't go promiscuous */

  29.   int ndo_Cflag; /* rotate dump files after this many bytes */
  30.   int ndo_Cflag_count; /* Keep track of which file number we're writing */
  31.   int ndo_Gflag; /* rotate dump files after this many seconds */
  32.   int ndo_Gflag_count; /* number of files created with Gflag rotation */
  33.   time_t ndo_Gflag_time; /* The last time_t the dump file was rotated. */
  34.   int ndo_Wflag; /* recycle output files after this number of files */
  35.   int ndo_WflagChars;
  36.   int ndo_Hflag;        /* dissect 802.11s draft mesh standard */
  37.   int ndo_suppress_default_print; /* don't use default_print() for unknown packet types */
  38.   const char *ndo_dltname;

  40.   char *ndo_espsecret;
  41.   struct sa_list *ndo_sa_list_head; /* used by print-esp.c */
  42.   struct sa_list *ndo_sa_default;

  44.   char *ndo_sigsecret;     /* Signature verification secret key */

  46.   struct esp_algorithm *ndo_espsecret_xform; /* cache of decoded */
  47.   char *ndo_espsecret_key;

  49.   int ndo_packettype;    /* as specified by -T */

  51.   char *ndo_program_name;    /*used to generate self-identifying messages */

  53.   int32_t ndo_thiszone;    /* seconds offset from gmt to local time */

  55.   int ndo_snaplen;

  57.   /*global pointers to beginning and end of current packet (during printing) */
  58.   const u_char *ndo_packetp;
  59.   const u_char *ndo_snapend;

  61.   /* bookkeeping for ^T output */
  62.   int ndo_infodelay;

  64.   /* pointer to void function to output stuff */
  65.   void (*ndo_default_print)(netdissect_options *,
  66.            register const u_char *bp, register u_int length);
  67.   void (*ndo_info)(netdissect_options *, int verbose);

  69.   int (*ndo_printf)(netdissect_options *,
  70.          const char *fmt, ...)
  71. #ifdef __ATTRIBUTE___FORMAT_OK_FOR_FUNCTION_POINTERS
  72.          __attribute__ ((format (printf, 2, 3)))
  73. #endif
  74.          ;
  75.   void (*ndo_error)(netdissect_options *,
  76.          const char *fmt, ...)
  77. #ifdef __ATTRIBUTE___NORETURN_OK_FOR_FUNCTION_POINTERS
  78.          __attribute__ ((noreturn))
  79. #endif /* __ATTRIBUTE___NORETURN_OK_FOR_FUNCTION_POINTERS */
  80. #ifdef __ATTRIBUTE___FORMAT_OK_FOR_FUNCTION_POINTERS
  81.          __attribute__ ((format (printf, 2, 3)))
  82. #endif /* __ATTRIBUTE___FORMAT_OK_FOR_FUNCTION_POINTERS */
  83.          ;
  84.   void (*ndo_warning)(netdissect_options *,
  85.          const char *fmt, ...)
  86. #ifdef __ATTRIBUTE___FORMAT_OK_FOR_FUNCTION_POINTERS
  87.          __attribute__ ((format (printf, 2, 3)))
  88. #endif
  89.          ;
  90. }
而在tcpdum.c定义了一个全局的：

点击(此处)折叠或打开

  1. netdissect_options Gndo;
  2. netdissect_options *gndo = &Gndo;
而在interface.h 又定义了很多宏，方便gndo里参数的调用：

点击(此处)折叠或打开

  1. extern netdissect_options *gndo;

  3. #define bflag gndo->ndo_bflag
  4. #define eflag gndo->ndo_eflag
  5. #define fflag gndo->ndo_fflag
  6. #define jflag gndo->ndo_jflag
  7. #define Kflag gndo->ndo_Kflag
  8. #define nflag gndo->ndo_nflag
  9. #define Nflag gndo->ndo_Nflag
  10. #define Oflag gndo->ndo_Oflag
  11. #define pflag gndo->ndo_pflag
  12. #define qflag gndo->ndo_qflag
  13. #define Rflag gndo->ndo_Rflag
  14. #define sflag gndo->ndo_sflag
  15. #define Sflag gndo->ndo_Sflag
  16. #define tflag gndo->ndo_tflag
  17. #define Uflag gndo->ndo_Uflag
  18. #define uflag gndo->ndo_uflag
  19. #define vflag gndo->ndo_vflag
  20. #define xflag gndo->ndo_xflag
  21. #define Xflag gndo->ndo_Xflag
  22. #define Cflag gndo->ndo_Cflag
  23. #define Gflag gndo->ndo_Gflag
  24. #define Aflag gndo->ndo_Aflag
  25. #define Bflag gndo->ndo_Bflag
  26. #define Iflag gndo->ndo_Iflag
  27. #define suppress_default_print gndo->ndo_suppress_default_print
  28. #define packettype gndo->ndo_packettype
  29. #define sigsecret gndo->ndo_sigsecret
  30. #define Wflag gndo->ndo_Wflag
  31. #define WflagChars gndo->ndo_WflagChars
  32. #define Cflag_count gndo->ndo_Cflag_count
  33. #define Gflag_count gndo->ndo_Gflag_count
  34. #define Gflag_time gndo->ndo_Gflag_time
  35. #define Hflag gndo->ndo_Hflag
  36. #define snaplen gndo->ndo_snaplen
  37. #define snapend gndo->ndo_snapend
这里不解释各个参数的使用及其调用.
如果我们要监控一个网络接口，一般我们会指定-i选项 后面是我们的接口ethX.

点击(此处)折叠或打开

  1. device = optarg;
  2.             break;
然后直接调用到：

点击(此处)折叠或打开

  1. #else
  2.         *ebuf = '\0';
  3.         pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
  4.         if (pd == NULL)
  5.             error("%s", ebuf);
  6.         else if (*ebuf)
  7.             warning("%s", ebuf);
  8. #endif /* HAVE_PCAP_CREATE */
如果没有指定接口那么会调用pcap_lookupdev函数来查询一个.比如从用户空间查询/proc/net/dev

点击(此处)折叠或打开

  1. else {
  2.         /*
  3.          * We're doing a live capture.
  4.          */
  5.         if (device == NULL) {
  6.             device = pcap_lookupdev(ebuf);
  7.             if (device == NULL)
  8.                 error("%s", ebuf);
  9.         }
它会调用libpcap库.来查找设备链表，和内核设备链表类似.本质上它查询的是/proc/net/dev


点击(此处)折叠或打开

  1. #if !defined(WIN32) && !defined(MSDOS)

  3. /*
  4.  * Return the name of a network interface attached to the system, or NULL
  5.  * if none can be found. The interface must be configured up; the
  6.  * lowest unit number is preferred; loopback is ignored.
  7.  */
  8. char *
  9. pcap_lookupdev(errbuf)
  10.     register char *errbuf;
  11. {
  12.     pcap_if_t *alldevs;
  13. /* for old BSD systems, including bsdi3 */
  14. #ifndef IF_NAMESIZE
  15. #define IF_NAMESIZE IFNAMSIZ
  16. #endif
  17.     static char device[IF_NAMESIZE + 1];
  18.     char *ret;

  20.     if (pcap_findalldevs(&alldevs, errbuf) == -1)
  21.         return (NULL);

  23.     if (alldevs == NULL || (alldevs->flags & PCAP_IF_LOOPBACK)) {
  24.         /*
  25.          * There are no devices on the list, or the first device
  26.          * on the list is a loopback device, which means there
  27.          * are no non-loopback devices on the list. This means
  28.          * we can't return any device.
  29.          *
  30.          * XXX - why not return a loopback device? If we can't
  31.          * capture on it, it won't be on the list, and if it's
  32.          * on the list, there aren't any non-loopback devices,
  33.          * so why not just supply it as the default device?
  34.          */
  35.         (void)strlcpy(errbuf, "no suitable device found",
  36.          PCAP_ERRBUF_SIZE);
  37.         ret = NULL;
  38.     } else {
  39.         /*
  40.          * Return the name of the first device on the list.
  41.          */
  42.         (void)strlcpy(device, alldevs->name, sizeof(device));
  43.         ret = device;
  44.     }

  46.     pcap_freealldevs(alldevs);
  47.     return (ret);
  48. }
处理完参数，它会调用到pcap_open_live函数

点击(此处)折叠或打开

  1. pcap_t *
  2. pcap_open_live(const char *source, int snaplen, int promisc, int to_ms, char *errbuf)
  3. {
  4.     pcap_t *p;
  5.     int status;

  7.     p = pcap_create(source, errbuf);
  8.     if (p == NULL)
  9.         return (NULL);
  10.     status = pcap_set_snaplen(p, snaplen);
  11.     if (status 0)
  12.         goto fail;
  13.     status = pcap_set_promisc(p, promisc);
  14.     if (status 0)
  15.         goto fail;
  16.     status = pcap_set_timeout(p, to_ms);
  17.     if (status 0)
  18.         goto fail;
  19.     /*
  20.      * Mark this as opened with pcap_open_live(), so that, for
  21.      * example, we show the full list of DLT_ values, rather
  22.      * than just the ones that are compatible with capturing
  23.      * when not in monitor mode. That allows existing applications
  24.      * to work the way they used to work, but allows new applications
  25.      * that know about the new open API to, for example, find out the
  26.      * DLT_ values that they can select without changing whether
  27.      * the adapter is in monitor mode or not.
  28.      */
  29.     p->oldstyle = 1;
  30.     status = pcap_activate(p);
  31.     if (status 0)
  32.         goto fail;
  33.     return (p);
  34. fail:
  35.     if (status == PCAP_ERROR)
  36.         snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
  37.          p->errbuf);
  38.     else if (status == PCAP_ERROR_NO_SUCH_DEVICE ||
  39.      status == PCAP_ERROR_PERM_DENIED ||
  40.      status == PCAP_ERROR_PROMISC_PERM_DENIED)
  41.         snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s (%s)", source,
  42.          pcap_statustostr(status), p->errbuf);
  43.     else
  44.         snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
  45.          pcap_statustostr(status));
  46.     pcap_close(p);
  47.     return (NULL);
  48. }
这个函数做了最重要的工作，它完成了和内核底层的通信.
我们看pcap_activate函数：

点击(此处)折叠或打开

  1. int
  2. pcap_activate(pcap_t *p)
  3. {
  4.     int status;

  6.     /*
  7.      * Catch attempts to re-activate an already-activated
  8.      * pcap_t; this should, for example, catch code that
  9.      * calls pcap_open_live() followed by pcap_activate(),
  10.      * as some code that showed up in a Stack Exchange
  11.      * question did.
  12.      */
  13.     if (pcap_check_activated(p))
  14.         return (PCAP_ERROR_ACTIVATED);
  15.     status = p->activate_op(p);
  16.     if (status >= 0)
  17.         p->activated = 1;
  18.     else {
  19.         if (p->errbuf[0] == '\0') {
  20.             /*
  21.              * No error message supplied by the activate routine;
  22.              * for the benefit of programs that don't specially
  23.              * handle errors other than PCAP_ERROR, return the
  24.              * error message corresponding to the status.
  25.              */
  26.             snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s",
  27.              pcap_statustostr(status));
  28.         }

  30.         /*
  31.          * Undo any operation pointer setting, etc. done by
  32.          * the activate operation.
  33.          */
  34.         initialize_ops(p);
  35.     }
  36.     return (status);
  37. }
这里面最主要的调用就是 p - >activate_op (p ) ;但是activate_op被初始化的是什么呢？它是调用函数pcap_create中调用pcap_create_interface里被赋值的:

点击(此处)折叠或打开

  1. pcap_t *
  2. pcap_create_interface(const char *device, char *ebuf)
  3. {
  4.     pcap_t *handle;

  6.     handle = pcap_create_common(device, ebuf, sizeof (struct pcap_linux));
  7.     if (handle == NULL)
  8.         return NULL;

  10.     handle->activate_op = pcap_activate_linux;
  11.     handle->can_set_rfmon_op = pcap_can_set_rfmon_linux;
我们看到被赋值为了pcap_activate_linux，那么它到底做了什么呢？在这个函数里它调用了一个很关键的函数activate_new

点击(此处)折叠或打开

  1. /* ===== Functions to interface to the newer kernels ================== */

  3. /*
  4.  * Try to open a packet socket using the new kernel PF_PACKET interface.
  5.  * Returns 1 on success, 0 on an error that means the new interface isn't
  6.  * present (so the old SOCK_PACKET interface should be tried), and a
  7.  * PCAP_ERROR_ value on an error that means that the old mechanism won't
  8.  * work either (so it shouldn't be tried).
  9.  */
  10. static int
  11. activate_new(pcap_t *handle)
  12. {
  13. #ifdef HAVE_PF_PACKET_SOCKETS
  14.     struct pcap_linux *handlep = handle->priv;
  15.     const char        *device = handle->opt.source;
  16.     int            is_any_device = (strcmp(device, "any") == 0);
  17.     int            sock_fd = -1, arptype;
  18. #ifdef HAVE_PACKET_AUXDATA
  19.     int            val;
  20. #endif
  21.     int            err = 0;
  22.     struct packet_mreq    mr;

  24.     /*
  25.      * Open a socket with protocol family packet. If the
  26.      * "any" device was specified, we open a SOCK_DGRAM
  27.      * socket for the cooked interface, otherwise we first
  28.      * try a SOCK_RAW socket for the raw interface.
  29.      */
  30.     sock_fd = is_any_device ?
  31.         socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) :
  32.         socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
我们看到本质是建立了socket类型为PF_PACKET，SOCK_RAW ，网络类型是ETH_P_ALL.后面还有setsockopt的调用设置一些选项，它也会触发内核初始化一些东西.
就让我们看看socket系统调用的实现：
在socket.c中：

点击(此处)折叠或打开

  1. SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
  2. {
  3.     int retval;
  4.     struct socket *sock;
  5.     int flags;

  7.     /* Check the SOCK_* constants for consistency. */
  8.     BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
  9.     BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
  10.     BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
  11.     BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);

  13.     flags = type & ~SOCK_TYPE_MASK;
  14.     if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
  15.         return -EINVAL;
  16.     type &= SOCK_TYPE_MASK;

  18.     if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
  19.         flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

  21.     retval = sock_create(family, type, protocol, &sock);
  22.     if (retval 0)
  23.         goto out;

  25.     retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
  26.     if (retval 0)
  27.         goto out_release;

  29. out:
  30.     /* It may be already another descriptor 8) Not kernel problem. */
  31.     return retval;

  33. out_release:
  34.     sock_release(sock);
  35.     return retval;
  36. }
这里我们跟踪sock_create：它调用了__sock_create:

点击(此处)折叠或打开

  1. static int __sock_create(struct net *net, int family, int type, int protocol,
  2.              struct socket **res, int kern)
  3. {
  4.     int err;
  5.     struct socket *sock;
  6.     const struct net_proto_family *pf;

  8.     /*
  9.      * Check protocol is in range
  10.      */
  11.     if (family 0 || family >= NPROTO)
  12.         return -EAFNOSUPPORT;
  13.     if (type 0 || type >= SOCK_MAX)
  14.         return -EINVAL;

  16.     /* Compatibility.

  18.      This uglymoron is moved from INET layer to here to avoid
  19.      deadlock in module load.
  20.      */
  21.     if (family == PF_INET && type == SOCK_PACKET) {
  22.         static int warned;
  23.         if (!warned) {
  24.             warned = 1;
  25.             printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
  26.              current->comm);
  27.         }
  28.         family = PF_PACKET;
  29.     }

  31.     err = security_socket_create(family, type, protocol, kern);
  32.     if (err)
  33.         return err;

  35.     /*
  36.      *    Allocate the socket and allow the family to set things up. if
  37.      *    the protocol is 0, the family is instructed to select an appropriate
  38.      *    default.
  39.      */
  40.     sock = sock_alloc();
  41.     if (!sock) {
  42.         if (net_ratelimit())
  43.             printk(KERN_WARNING "socket: no more sockets\n");
  44.         return -ENFILE;    /* Not exactly a match, but its the
  45.                  closest posix thing */
  46.     }

  48.     sock->type = type;

  50. #ifdef CONFIG_MODULES
  51.     /* Attempt to load a protocol module if the find failed.
  52.      *
  53.      * 12/09/1996 Marcin: this makes REALLY only sense, if the user
  54.      * requested real, full-featured networking support upon configuration.
  55.      * Otherwise module support will
  56.      */
  57.     if (net_families[family] == NULL)
  58.         request_module("net-pf-%d", family);
  59. #endif

  61.     rcu_read_lock();
  62.     pf = rcu_dereference(net_families[family]);  //查询协议注册数组
  63.     err = -EAFNOSUPPORT;
  64.     if (!pf)
  65.         goto out_release;

  67.     /*
  68.      * We will call the ->create function, that possibly is in a loadable
  69.      * module, so we have to bump that loadable module refcnt first.
  70.      */
  71.     if (!try_module_get(pf->owner))
  72.         goto out_release;

  74.     /* Now protected by module ref count */
  75.     rcu_read_unlock();

  77.     err = pf->create(net, sock, protocol);  //调用注册协议的create函数
  78.     if (err 0)
  79.         goto out_module_put;

  81.     /*
  82.      * Now to bump the refcnt of the [loadable] module that owns this
  83.      * socket at sock_release time we decrement its refcnt.
  84.      */
  85.     if (!try_module_get(sock->ops->owner))
  86.         goto out_module_busy;

  88.     /*
  89.      * Now that we're done with the ->create function, the [loadable]
  90.      * module can have its refcnt decremented
  91.      */
  92.     module_put(pf->owner);
  93.     err = security_socket_post_create(sock, family, type, protocol, kern);  //内核的一个安全权限检查，这里我们不深入分析.
  94.     if (err)
  95.         goto out_sock_release;
  96.     *res = sock;

  98.     return 0;

  100. out_module_busy:
  101.     err = -EAFNOSUPPORT;
  102. out_module_put:
  103.     sock->ops = NULL;
  104.     module_put(pf->owner);
  105. out_sock_release:
  106.     sock_release(sock);
  107.     return err;

  109. out_release:
  110.     rcu_read_unlock();
  111.     goto out_sock_release;
  112. }
这里查询net_families，找到内核注册的协议，并调用create函数

点击(此处)折叠或打开

  1. err = pf->create(net, sock, protocol);
我们看看PF_PACKET的注册，在函数af_packet.c中

点击(此处)折叠或打开

  1. static int __init packet_init(void)
  2. {
  3.     int rc = proto_register(&packet_proto, 0);

  5.     if (rc != 0)
  6.         goto out;

  8.     sock_register(&packet_family_ops);
  9.     register_pernet_subsys(&packet_net_ops);
  10.     register_netdevice_notifier(&packet_netdev_notifier);
  11. out:
  12.     return rc;
  13. }
packet_proto：

点击(此处)折叠或打开

  1. static struct proto packet_proto = {
  2.     .name     = "PACKET",
  3.     .owner     = THIS_MODULE,
  4.     .obj_size = sizeof(struct packet_sock),
  5. };
这里关键的是sock_register(&packet_family_ops);的注册

点击(此处)折叠或打开

  1. static struct net_proto_family packet_family_ops = {
  2.     .family =    PF_PACKET,
  3.     .create =    packet_create,
  4.     .owner    =    THIS_MODULE,
  5. };
上面调用的create函数就在这里.即packet_create函数：

点击(此处)折叠或打开

  1. /*
  2.  *    Create a packet of type SOCK_PACKET.
  3.  */

  5. static int packet_create(struct net *net, struct socket *sock, int protocol)
  6. {
  7.     struct sock *sk;
  8.     struct packet_sock *po;
  9.     __be16 proto = (__force __be16)protocol; /* weird, but documented */
  10.     int err;

  12.     if (!capable(CAP_NET_RAW))
  13.         return -EPERM;
  14.     if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
  15.      sock->type != SOCK_PACKET)
  16.         return -ESOCKTNOSUPPORT;

  18.     sock->state = SS_UNCONNECTED;

  20.     err = -ENOBUFS;
  21.     sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto);
  22.     if (sk == NULL)
  23.         goto out;

  25.     sock->ops = &packet_ops;
  26.     if (sock->type == SOCK_PACKET)
  27.         sock->ops = &packet_ops_spkt;

  29.     sock_init_data(sock, sk);

  31.     po = pkt_sk(sk);
  32.     sk->sk_family = PF_PACKET;
  33.     po->num = proto;

  35.     sk->sk_destruct = packet_sock_destruct;
  36.     sk_refcnt_debug_inc(sk);

  38.     /*
  39.      *    Attach a protocol block
  40.      */

  42.     spin_lock_init(&po->bind_lock);
  43.     mutex_init(&po->pg_vec_lock);
  44.     po->prot_hook.func = packet_rcv;

  46.     if (sock->type == SOCK_PACKET)
  47.         po->prot_hook.func = packet_rcv_spkt;

  49.     po->prot_hook.af_packet_priv = sk;

  51.     if (proto) {
  52.         po->prot_hook.type = proto;
  53.         dev_add_pack(&po->prot_hook);
  54.         sock_hold(sk);
  55.         po->running = 1;
  56.     }

  58.     write_lock_bh(&net->packet.sklist_lock);
  59.     sk_add_node(sk, &net->packet.sklist);
  60.     sock_prot_inuse_add(net, &packet_proto, 1);
  61.     write_unlock_bh(&net->packet.sklist_lock);
  62.     return 0;
  63. out:
  64.     return err;
  65. }
其实pf_packet是一个特殊的协议，socket，是内核专门用来嗅探数据报文的，方便调试用.
它对sock的ops重新初始化：

点击(此处)折叠或打开

  1. sock->ops = &packet_ops;

点击(此处)折叠或打开

  1. static const struct proto_ops packet_ops = {
  2.     .family =    PF_PACKET,
  3.     .owner =    THIS_MODULE,
  4.     .release =    packet_release,
  5.     .bind =        packet_bind,
  6.     .connect =    sock_no_connect,
  7.     .socketpair =    sock_no_socketpair,
  8.     .accept =    sock_no_accept,
  9.     .getname =    packet_getname,
  10.     .poll =        packet_poll,
  11.     .ioctl =    packet_ioctl,
  12.     .listen =    sock_no_listen,
  13.     .shutdown =    sock_no_shutdown,
  14.     .setsockopt =    packet_setsockopt,
  15.     .getsockopt =    packet_getsockopt,
  16.     .sendmsg =    packet_sendmsg,
  17.     .recvmsg =    packet_recvmsg,
  18.     .mmap =        packet_mmap,
  19.     .sendpage =    sock_no_sendpage,
  20. }
并初始化特殊操作函数：

点击(此处)折叠或打开

  1. po->prot_hook.func = packet_rcv;

  3.     if (sock->type == SOCK_PACKET)
  4.         po->prot_hook.func = packet_rcv_spkt;
在create的时候默认是packet_rcv函数，然后调用协议注册函数dev_add_pack：

点击(此处)折叠或打开

  1. if (proto) {
  2.         po->prot_hook.type = proto;
  3.         dev_add_pack(&po->prot_hook);
  4.         sock_hold(sk);
  5.         po->running = 1;
  6.     }
然而我们知道这个socket的协议类型是ETH_P_ALL,我们之前在帧的接收和发送的时候讲过，它会注册到ptype_all的链表.嗅探器会用到.
这里我们在回顾一下：
在报文接收的时候在dev.c netif_recevice_skb中：

点击(此处)折叠或打开

  1. list_for_each_entry_rcu(ptype, &ptype_all, list) {
  2.         if (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
  3.          ptype->dev == orig_dev) {
  4.             if (pt_prev)
  5.                 ret = deliver_skb(skb, pt_prev, orig_dev);
  6.             pt_prev = ptype;
  7.         }
  8.     }
它就会查询注册的协议，调用处理函数，这里是packet_rcv
而发送的时候是在dev_hard_start_xmit中调用dev_queue_xmit_nit

点击(此处)折叠或打开

  1. int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
  2.             struct netdev_queue *txq)
  3. {
  4.     const struct net_device_ops *ops = dev->netdev_ops;
  5.     int rc;

  7.     if (likely(!skb->next)) {
  8.         if (!list_empty(&ptype_all))
  9.             dev_queue_xmit_nit(skb, dev);

点击(此处)折叠或打开

  1. /*
  2.  *    Support routine. Sends outgoing frames to any network
  3.  *    taps currently in use.
  4.  */

  6. static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
  7. {
  8.     struct packet_type *ptype;

  10. #ifdef CONFIG_NET_CLS_ACT
  11.     if (!(skb->tstamp.tv64 && (G_TC_FROM(skb->tc_verd) & AT_INGRESS)))
  12.         net_timestamp(skb);
  13. #else
  14.     net_timestamp(skb);
  15. #endif

  17.     rcu_read_lock();
  18.     list_for_each_entry_rcu(ptype, &ptype_all, list) {
  19.         /* Never send packets back to the socket
  20.          * they originated from - MvS (miquels@drinkel.ow.org)
  21.          */
  22.         if ((ptype->dev == dev || !ptype->dev) &&
  23.          (ptype->af_packet_priv == NULL ||
  24.          (struct sock *)ptype->af_packet_priv != skb->sk)) {
  25.             struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
  26.             if (!skb2)
  27.                 break;

  29.             /* skb->nh should be correctly
  30.              set by sender, so that the second statement is
  31.              just protection against buggy protocols.
  32.              */
  33.             skb_reset_mac_header(skb2);

  35.             if (skb_network_header(skb2) skb2->data ||
  36.              skb2->network_header > skb2->tail) {
  37.                 if (net_ratelimit())
  38.                     printk(KERN_CRIT "protocol %04x is "
  39.                      "buggy, dev %s\n",
  40.                      skb2->protocol, dev->name);
  41.                 skb_reset_network_header(skb2);
  42.             }

  44.             skb2->transport_header = skb2->network_header;
  45.             skb2->pkt_type = PACKET_OUTGOING;
  46.             ptype->func(skb2, skb->dev, ptype, skb->dev);
  47.         }
  48.     }
  49.     rcu_read_unlock();
  50. }
把报文复制一份，然后调用packet_rcv传递给上层.
当然在调用setsockopt时即调用packet_setsockopt函数，会根据flags重新初始化接收处理函数：
packet_set_ring它会处理包更高效：

点击(此处)折叠或打开

  1. po->prot_hook.func = (po->rx_ring.pg_vec) ?
  2.                         tpacket_rcv : packet_rcv;
判断之后，重新调用dev_add_pack注册，在实际中会变成tpacket_rcv函数.至于为什么，原因这里就不分析了.
在实际应用中我们可以看一个例子：
# cat /proc/net/ptype 
Type Device      Function
0800          ip_rcv+0x0/0x510
0011          llc_rcv+0x0/0x3cc
8863          pppoe_disc_rcv+0x0/0x200
0004          llc_rcv+0x0/0x3cc
8864          pppoe_rcv+0x0/0x240
0806          arp_rcv+0x0/0x16c
88d9 br0      packet_rcv+0x0/0x20
886c br0      packet_rcv+0x0/0x20
86dd          ipv6_rcv+0x0/0x68c
# 
# 
# 
# tcpdump -i eth2 &
# tcpdump: WARNING: eth2: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
#  
# cat /proc/net/ptype 
Type Device      Function
ALL  eth2     tpacket_rcv+0x0/0x20
0800          ip_rcv+0x0/0x510
0011          llc_rcv+0x0/0x3cc
8863          pppoe_disc_rcv+0x0/0x200
0004          llc_rcv+0x0/0x3cc
8864          pppoe_rcv+0x0/0x240
0806          arp_rcv+0x0/0x16c
88d9 br0      packet_rcv+0x0/0x20
886c br0      packet_rcv+0x0/0x20
86dd          ipv6_rcv+0x0/0x68c
# 
我们会发现是tpacket_rcv函数.这需要注意一下.
这里的原因来自libpcap调用的时候的
setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,(void *) &req, sizeof(req))
这个PACKET_RX_RING的标志！它触发了内核的新初始化.

然后我们回到tcpdump的主函数，最后会调用pcap_loop来无限处理报文.
在内核调用接收报文函数的时候里面会有一个run_filter，它就是报文过滤规则，这里不多说，需要专门来分析.包括过滤规则和解码的以后分析吧



















关键词：
TCPDUMP工具
云之大者
目录
相关文章
泡沫o0
|
8月前
|
运维 网络协议 安全
【Shell 命令集合 网络通讯 】Linux 网络抓包工具 tcpdump命令 使用指南
【Shell 命令集合 网络通讯 】Linux 网络抓包工具 tcpdump命令 使用指南
泡沫o0
254 0
ling218
|
8月前
|
机器学习/深度学习 网络协议 安全
网络抓包工具 - tcpdump
【1月更文挑战第1天】
ling218
271 4
爱因诗贤
|
网络协议 算法 Linux
TCP 协议报文格式&tcpdump抓包工具
之前文章介绍过 wireshark 抓包工具的 捕获过滤器 和 显示过滤器，而 捕获过滤器 使用的 BPF 过滤语法可以在 tcpdump 中使用，tcpdump 可以在 Linux 服务端使用，熟悉和了解 tcpdump 抓包工具的使用，可以帮助分析服务端数据报文的情况。
爱因诗贤
275 0
java冯坚持
|
3月前
|
Web App开发 网络协议 数据可视化
tcpdump 和 wireshark 抓包工具 ，介绍、安装、命令使用。 详解三次握手、四次挥手。两个结合使用，会更好分析报文
这篇文章详细介绍了网络抓包工具tcpdump和Wireshark的使用，包括安装、命令选项、过滤器语法，以及如何通过分析TCP的三次握手和四次挥手来理解网络通信细节。
java冯坚持
869 1
欢喜躲在眉梢里
|
6月前
|
网络协议 Linux Windows
计算机网络抓包工具——tcpdump详解
计算机网络抓包工具——tcpdump详解
欢喜躲在眉梢里
487 0
李振良_阿良
|
8月前
|
机器学习/深度学习 运维 网络协议
运维工程师必会工具(Nmap和TCPdump)
运维工程师必会工具(Nmap和TCPdump)
李振良_阿良
92 0
vnjohn
|
机器学习/深度学习 监控 网络协议
浅谈 TCP 握手/数据传输/挥手过程以及 tcpdump 抓包工具使用
浅谈 TCP 握手/数据传输/挥手过程以及 tcpdump 抓包工具使用
vnjohn
343 0
wljslmz
|
缓存 监控 网络协议
2022年最受工程师欢迎的10款抓包工具有哪些？不止Wireshark和Tcpdump哦！
网络嗅探器在日常工作中经常使用，通常情况下，我们叫做“抓包工具”，不管是软件开发、还是网络工程师，抓包解决一些问题已经称为最正常不过的操作。
wljslmz
1321 0
2022年最受工程师欢迎的10款抓包工具有哪些？不止Wireshark和Tcpdump哦！
liuyunshengsir
|
Unix Linux
tcpdump 抓包工具的使用《openstack 网络》
tcpdump 抓包工具的使用《openstack 网络》
liuyunshengsir
264 0
与你一起星光下漫步
|
网络协议
使用tcpdump工具与对tcp协议的理解
使用tcpdump工具与对tcp协议的理解
与你一起星光下漫步
364 0