Sniffer

//sniffer.c
//To compile : gcc -o sniffer sniffer.c
//To run : ./sniffer [interface-name]


#include
#include
#include
#include
#include
#include
#include
#include#include
#include


/* default snap length (maximum bytes per packet to capture) */
#define SNAP_LEN 1518


/* ethernet headers are always exactly 14 bytes [1] */
#defineSIZE_ETHERNET 14


/* Ethernet addresses are 6 bytes */
#define ETHER_ADDR_LEN 6


/* Ethernet header */
struct sniff_ethernet {

u_char ether_dhost[ETHER_ADDR_LEN]; /* destinationhost address */

u_char ether_shost[ETHER_ADDR_LEN]; /* source host address */

u_short ether_type; /* IP? ARP? RARP? etc */
};


/* IP header */struct sniff_ip {

u_char ip_vhl; /* version > 2 */

u_char ip_tos; /* type of service */

u_short ip_len; /* total length*/

u_short ip_id; /* identification */

u_short ip_off; /* fragment offset field */

#define IP_RF 0x8000 /* reserved fragmentflag */

#define IP_DF 0x4000 /* dont fragment flag */

#define IP_MF 0x2000 /* more fragments flag */

#define IP_OFFMASK 0x1fff /* maskfor fragmenting bits */

u_char ip_ttl; /* time to live */

u_char ip_p; /* protocol */

u_short ip_sum; /* checksum*/

struct in_addr ip_src,ip_dst; /* source and dest address */
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)/* TCP header */
typedef u_int tcp_seq;


struct sniff_tcp {

u_short th_sport; /* source port */

u_short th_dport; /* destination port */...