本人菜鸟,在学习wincap的时候碰到一个问题,当用pcap_sendpacket发送包的时候出现目的地址被修改为另外一个地址
环境:xp sp3 vc++6.0 wincap 3.1
程序目的是通过给本机ip发送arp包得到本机mac地址,本机只有一块网卡,用pcap_findalldevs_ex函数也就得到一个设备,地址为192.168.0.100,运行到sendpacket success就停止了,而用wireshark 1.4.0rc1抓包发现发出的数据包实际为:
ff ff ff ff ff ff 0f 0f 0f 0f 0f 0f 08 06 00 01
08 00 06 04 00 01 0f 0f 0f 0f 0f 0f 7f 00 00 02
00 00 00 00 00 00 cc cc c0 a8
本机地址从192.168.0.100 变为了204.204.192.168
不知道为什么,请高手帮忙解答,十分感激
程序如下:
#include <iostream.h>
#include <pcap.h>
#include <remote-ext.h>
#include <winsock2.h>
#pragma comment(lib,"ws2_32")
#pragma comment(lib,"wpcap")
struct arppacket
{
unsigned char eh_dst[6];
unsigned char eh_src[6];
unsigned short eh_type;
unsigned short arp_hdr;
unsigned short arp_pro;
unsigned char arp_hln;
unsigned char arp_pln;
unsigned short arp_opt;
unsigned char arp_sha[6];
unsigned long arp_spa;
unsigned char arp_tha[6];
unsigned long arp_tpa;
};
pcap_t *devpoint;
unsigned char mmac[6];
void getmac();
unsigned long myip;
void main()
{
pcap_if_t *alldevs,*d;
struct in_addr myipaddress;
int i=0;
char errbuf[PCAP_BUF_SIZE];
arppacket arppk;
arppk.eh_type=htons(0x0806);
arppk.arp_hdr=htons(0x1);
arppk.arp_pro=htons(0x0800);
arppk.arp_hln=0x6;
arppk.arp_pln=0x4;
pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf);
for(d=alldevs;d;d=d->next)
cout<<++i<<"."<<d->name<<endl;
myip=((struct sockaddr_in *)alldevs->addresses->addr)->sin_addr.S_un.S_addr;
myipaddress.S_un.S_addr=myip;
cout<<"my ip address:"<<inet_ntoa(myipaddress)<<endl;
if((devpoint=pcap_open_live (alldevs->name, 65536, 1, 1, errbuf))==NULL)
{cout<<"pacp_open error"<<endl;
pcap_freealldevs(alldevs);}
else
{ cout<<"pacp_open success"<<endl;}
getmac();
cout<<"MAC:";
for(i=0;i<6;i++)
cout<<mmac[i]<<":";
return;
}
void getmac()
{
int i,k;
arppacket marppk;
pcap_pkthdr *pkt_header;
u_char *pkt_data;
unsigned char sendbuf[42];
marppk.arp_opt=htons(0x0001);
marppk.eh_type=htons(0x0806);
marppk.arp_hdr=htons(0x0001);
marppk.arp_pro=htons(0x0800);
marppk.arp_hln=6;
marppk.arp_pln=4;
for(i=0;i<6;i++)
{
marppk.arp_sha[i]=0x0f;
marppk.eh_dst[i]=0xff;
marppk.eh_src[i]=0x0f;
marppk.arp_tha[i]=0x00;
}
marppk.arp_spa=inet_addr("127.0.0.2");
marppk.arp_tpa=myip;
memset(sendbuf,0,sizeof(sendbuf));
memcpy(sendbuf,&marppk,sizeof(marppk));
if((i=pcap_sendpacket(devpoint, sendbuf, 42))==0)
cout<<"sendpacket success"<<endl;
else
cout<<"sendpacket error"<<endl;
while((k=pcap_next_ex(devpoint,&pkt_header,(const u_char**)&pkt_data))>=0)
{
if(*(unsigned short *)(pkt_data+12)==htons(0x0806)&&*(unsigned short*)(pkt_data+20)==htons(0x0002)&&*(unsigned long*)(pkt_data+38)==inet_addr("127.0.0.2"))
{
for(i=0;i<6;i++)
{
mmac[i]=*(unsigned char*)(pkt_data+22+i);
}
break;
}
}
return;
}
[培训]科锐逆向工程师培训第53期2025年7月8日开班!