<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Hello, I can't explain why in this code when I output source and destination udp port, it show me port: 1042 and 53, it should be 80 instead of 53. and no always show the same port 1042.<BR>
<BR>
Porgramming in builder c++<BR>
<BR>
..<BR>
int cont = 0;<BR>
int res = pcap_next_ex(adhandle_, &header, &pkt_data);<BR> if (res == 0) //Timeout elapsed<BR> continue;<BR> cont++;<BR> cadenaIDx = AnsiString (cont); //show the index<BR>
//Tiempo<BR> local_tv_sec = header->ts.tv_sec;<BR> ltime = localtime(&local_tv_sec);<BR> strftime(timestr, sizeof timestr, "%H:%M:%S", ltime);<BR> cadenaTIm = AnsiString(timestr) + "." + header->ts.tv_usec; //show the time<BR>
ether_header *ether;<BR> ether = (ether_header*)(pkt_data);<BR>
switch(htons(ether->h_type))<BR> {<BR> case 0x0800: //IPv4<BR> ip_header *ip;<BR> udp_header *udp;<BR> u_int ip_len;<BR>
ip = (ip_header*)(pkt_data + 14);<BR>
sprintf(macaddr1,"%d.%d.%d.%d",ip->saddr.byte1,<BR> ip->saddr.byte2,ip->saddr.byte3,ip->saddr.byte4);<BR> sprintf(macaddr2,"%d.%d.%d.%d",ip->daddr.byte1,<BR> ip->daddr.byte2,ip>daddr.byte3,ip>daddr.byte4); <BR>
cadenaIPs = macaddr1; //show IP source address<BR> cadenaIPd = macaddr2; //show IP dest address<BR><BR>
<BR>
switch (ip->proto)<BR> {<BR> case 1:<BR> cadenaPRt = "ICMP";<BR> break;<BR>
case 2:<BR> cadenaPRt = "IGMP";<BR> break;<BR>
case 4:<BR> cadenaPRt = "IP";<BR> break;<BR>
<BR> case 6:<BR> cadenaPRt = "TCP";<BR> break;<BR>
case 17:<BR> cadenaPRt = "UDP"; //show protocol<BR> ip_len = (ip->ver_ihl & 0xf) * 4; //Longitud de Ip header<BR> udp = (udp_header*)((u_char*)ip + ip_len);<BR> //udp = (udp_header*)(pkt_data+14+sizeof(ip_header));<BR> cadenaSPo = ntohs(udp->sport); //show udp source port<BR> cadenaDPo = ntohs(udp->dport); //show udp destination port<BR> break;<BR>
default:<BR> cadenaPRt = "?";<BR> break;<BR> }<BR> break;<BR> case 0x0806:<BR> cadenaPRt = "ARP";<BR> arp_header *arp;<BR> arp = (arp_header*)(pkt_data + 14);<BR> sprintf(macaddr1,"%02X-%02X-%02X-%02X-%02X-%02X",arp->src_addr[0],<BR> arp->src_addr[1],arp->src_addr[2],arp->src_addr[3],arp->src_addr[4],<BR> arp->src_addr[5]);<BR> sprintf(macaddr2,"%02X-%02X-%02X-%02X-%02X-%02X",arp->dst_addr[0],<BR> arp->dst_addr[1],arp->dst_addr[2],arp->dst_addr[3],arp->dst_addr[4],<BR> arp->dst_addr[5]);<BR> cadenaIPs = macaddr1;<BR> cadenaIPd = macaddr2;<BR>
break;<BR>
default:<BR> cadenaPRt = "otros";<BR> break;<BR> }<BR>
<BR>
the struct header that I use:<BR>
<BR>
/* Cabecera ARP */<BR>struct arp_header<BR>{<BR> u_short hardware;<BR> u_short protocol;<BR> u_char hw_addr_len;<BR> u_char proto_addr_len;<BR> u_short operation;<BR> u_char src_addr[6];<BR> u_char src_ip[4];<BR> u_char dst_addr[6];<BR> u_char dst_ip[4];<BR>};<BR>//4 bytes IP address<BR>struct ip_address<BR>{<BR> u_char byte1;<BR> u_char byte2;<BR> u_char byte3;<BR> u_char byte4;<BR>};<BR>
// 20 bytes IP Header<BR>struct ip_header<BR>{<BR> u_char ver_ihl;<BR> u_char tos; // Type of service<BR> u_short tlen; // Total length<BR> u_short identification; // Identification<BR> u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)<BR> u_char ttl; // Time to live<BR> u_char proto; // Protocol<BR> u_short crc; // Header checksum<BR> ip_address saddr; // Source address<BR> ip_address daddr; // Destination address<BR> // u_int op_pad; // Option + Padding -- NOT NEEDED!<BR>};<BR>
<BR>
struct udp_header<BR>{<BR> u_short sport; // Source port<BR> u_short dport; // Destination port<BR> u_short len; // Datagram length<BR> u_short crc; // Checksum<BR>};<BR><br /><hr />Todo ruedas: información práctica y todo el glamour del mundo del motor. <a href='http://estilo.es.msn.com/' target='_new'>MSN Estilo y Tendencias</a></body>
</html>