Thread: Packet data extraction

  1. #1
    Registered User
    Join Date
    Aug 2011
    Posts
    6

    Packet data extraction

    I'm doing an ethernet based project where in i receive udp packets over the network. I have to basically strip off the first 42 bytes (i.e., the ethernet, ip and udp headers) and retain the rest (which contains another header and the payload data). I have the code for the packet analyzer to capture the packets but i don't need the entire packet as mentioned above. The code is in C.
    So if anyone can help please do let me know how i can proceed. I can't use something like wireshark as there is loss of packets (tried and tested). Hence i was using another sniffer.

  2. #2
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    If you're using sendto() and recvfrom() the header information is handled automatically by the sockets library. Your application sees only the user data portion of the datagram.

  3. #3
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,659
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  4. #4
    1337
    Join Date
    Jul 2008
    Posts
    135
    Quote Originally Posted by shinpin View Post
    I'm doing an ethernet based project where in i receive udp packets over the network. I have to basically strip off the first 42 bytes (i.e., the ethernet, ip and udp headers) and retain the rest (which contains another header and the payload data). I have the code for the packet analyzer to capture the packets but i don't need the entire packet as mentioned above. The code is in C.
    So if anyone can help please do let me know how i can proceed. I can't use something like wireshark as there is loss of packets (tried and tested). Hence i was using another sniffer.
    The socket library will automatically do this for you. You do no have to strip. But from what you are saying, it seems that you are using raw sockets. Check this out http://en.wikipedia.org/wiki/User_Datagram_Protocol. You could strip out all the headers based on the number of bytes.

  5. #5
    Registered User
    Join Date
    Aug 2011
    Posts
    6
    Quote Originally Posted by CommonTater View Post
    If you're using sendto() and recvfrom() the header information is handled automatically by the sockets library. Your application sees only the user data portion of the datagram.
    hey.. no im not using the functions sendto() or rcvfrom(). I'm using a packet capture software and have downloaded its code to receive the packets. There is no packet loss and also the code doesn't have the sys/socket.h library included, and yet it works perfectly.
    I tried separately using the recvfrom() function but it gave me no output. Nothing was displayed.
    So probably i've gone wrong somewhr, pls do let me know.
    Thanks.

  6. #6
    Registered User
    Join Date
    Aug 2011
    Posts
    6
    Quote Originally Posted by valthyx View Post
    The socket library will automatically do this for you. You do no have to strip. But from what you are saying, it seems that you are using raw sockets. Check this out User Datagram Protocol - Wikipedia, the free encyclopedia. You could strip out all the headers based on the number of bytes.
    So what ur saying is that i should store the packets that i receive in a buffer and then remove the number of bytes that i need to?

  7. #7
    1337
    Join Date
    Jul 2008
    Posts
    135
    Quote Originally Posted by shinpin View Post
    So what ur saying is that i should store the packets that i receive in a buffer and then remove the number of bytes that i need to?
    That is one way. However, programmers normally use the "struct" defined in the header files for extracting the data. You could first strip the ethernet header, then ip header, then transport layer. I am not very sure where the "struct" is defined in linux, socket.h? or maybe packet.h.
    Code:
    struct ethhdr *eHeader;
    struct iphdr *ipHeader;
    struct tcphdr *tcpHeader;
    You have to include the right header before using the above headers.

  8. #8
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    Quote Originally Posted by shinpin View Post
    hey.. no im not using the functions sendto() or rcvfrom(). I'm using a packet capture software and have downloaded its code to receive the packets. There is no packet loss and also the code doesn't have the sys/socket.h library included, and yet it works perfectly.
    I tried separately using the recvfrom() function but it gave me no output. Nothing was displayed.
    So probably i've gone wrong somewhr, pls do let me know.
    Thanks.
    Try again... There's no reason to mess with raw sockets and other people's code when you have something as simple as recvfrom() to work with... The reason nothing was displayed is that recvfrom() receives the datagram into memory...if you want to see it, use printf() or puts().

  9. #9
    Registered User
    Join Date
    Aug 2011
    Posts
    6
    Quote Originally Posted by valthyx View Post
    That is one way. However, programmers normally use the "struct" defined in the header files for extracting the data. You could first strip the ethernet header, then ip header, then transport layer. I am not very sure where the "struct" is defined in linux, socket.h? or maybe packet.h.
    Code:
    struct ethhdr *eHeader;
    struct iphdr *ipHeader;
    struct tcphdr *tcpHeader;
    You have to include the right header before using the above headers.
    alrite thanks a lot.. i'll try that out

  10. #10
    Registered User
    Join Date
    Aug 2011
    Posts
    6
    Quote Originally Posted by CommonTater View Post
    Try again... There's no reason to mess with raw sockets and other people's code when you have something as simple as recvfrom() to work with... The reason nothing was displayed is that recvfrom() receives the datagram into memory...if you want to see it, use printf() or puts().
    Yes i have used printf.. This is the code.

    Code:
    int main()
    {
            int sock;
            int addr_len, bytes_read;
            char recv_data[1024];
            struct sockaddr_in server_addr , client_addr;
    
    
            if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
                perror("Socket");
                exit(1);
            }
    
            server_addr.sin_family = AF_INET;
            server_addr.sin_port = htons(5000);
            server_addr.sin_addr.s_addr = INADDR_ANY;
            bzero(&(server_addr.sin_zero),8);
    
    
            if (bind(sock,(struct sockaddr *)&server_addr,
                sizeof(struct sockaddr)) == -1)
            {
                perror("Bind");
                exit(1);
            }
    
            addr_len = sizeof(struct sockaddr);
    		
    	printf("\nUDPServer Waiting for client on port 5000");
            fflush(stdout);
    
    	while (1)
    	{
    
              bytes_read = recvfrom(sock,recv_data,1024,0,
    	                    (struct sockaddr *)&client_addr, &addr_len);
    	  
    
    	  recv_data[bytes_read] = '\0';
    
              printf("\n(%s , %d) said : ",inet_ntoa(client_addr.sin_addr),
                                           ntohs(client_addr.sin_port));
              printf("%s", recv_data);
    	  fflush(stdout);
    
            }
            return 0;
    }

  11. #11
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    So what's the problem with that? Is there something in there that's not working?

  12. #12
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,659
    Well apart from the potential buffer overflow and underflow issues.

    Code:
              bytes_read = recvfrom(sock,recv_data,sizeof(recv_data)-1,0,  // prevent overflow
                            (struct sockaddr *)&client_addr, &addr_len);
          
          if ( bytes_read <= 0 ) break; // prevent underflow
          recv_data[bytes_read] = '\0';
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  13. #13
    Registered User
    Join Date
    Aug 2011
    Posts
    6
    Quote Originally Posted by CommonTater View Post
    So what's the problem with that? Is there something in there that's not working?
    okay i just figured out something. this packet capture mechanism does not use the regular BSD sockets. It uses the library libpcap, and some ring-buffering mechanism. So i don't think i can use something like recvfrom() and other socket stuff..

    So i just want to strip off the first 42 bytes and retain the rest. how could i do that? if u have any code samples that i could see or any other inputs, that would really help..
    I cant use any other way to capture the packets as there is a lot of packet slip. This mechanism is very efficient that way since i'm hardly facing any such loss..
    Thanks in advance

  14. #14
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    Quote Originally Posted by shinpin View Post
    okay i just figured out something. this packet capture mechanism does not use the regular BSD sockets. It uses the library libpcap, and some ring-buffering mechanism. So i don't think i can use something like recvfrom() and other socket stuff..

    So i just want to strip off the first 42 bytes and retain the rest. how could i do that? if u have any code samples that i could see or any other inputs, that would really help..
    I cant use any other way to capture the packets as there is a lot of packet slip. This mechanism is very efficient that way since i'm hardly facing any such loss..
    Thanks in advance
    So in other words you're trying to read packets that aren't yours to read?

  15. #15
    spurious conceit MK27's Avatar
    Join Date
    Jul 2008
    Location
    segmentation fault
    Posts
    8,300
    Quote Originally Posted by CommonTater View Post
    So in other words you're trying to read packets that aren't yours to read?
    That's what libpcap is for, in a sense. However, if that "sense" is to imply this is nothing but mischief, then keep in mind there are many more commonplace and legitimate reasons to do this than there are mischievous ones (and you don't have to bother writing your own prog for that anyway). After all, the network layer is built on top of this (the data-link layer) and that's programmed by somebody...and it can present issues and complications which require observation or resolution on that data-link lower level.

    @shinpin: If there is a good reason for you to be using pcap to do this (such as that's the assignment), then fine. But don't confuse it with the higher level "socket" layer or try to use socket API stuff with it. Have you seen this yet?

    Programming with pcap

    A good intro/tutorial about using libpcap.

    However, if there the reason you are using this pcap based thing is because you thought that was the best idea, think again. Use the socket API!
    Last edited by MK27; 08-09-2011 at 07:42 AM.
    C programming resources:
    GNU C Function and Macro Index -- glibc reference manual
    The C Book -- nice online learner guide
    Current ISO draft standard
    CCAN -- new CPAN like open source library repository
    3 (different) GNU debugger tutorials: #1 -- #2 -- #3
    cpwiki -- our wiki on sourceforge

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. WinPCap - Packet data containing strings?
    By Glorfindel in forum C Programming
    Replies: 11
    Last Post: 02-11-2009, 03:34 PM
  2. packet data
    By l2u in forum Networking/Device Communication
    Replies: 16
    Last Post: 01-22-2007, 11:46 AM
  3. extraction of the C/C++ help
    By altu99999 in forum C Programming
    Replies: 2
    Last Post: 09-19-2005, 12:56 PM
  4. packet data format check
    By gooddevil in forum Networking/Device Communication
    Replies: 1
    Last Post: 05-12-2004, 01:26 PM
  5. Data extraction from file
    By peterxor in forum C++ Programming
    Replies: 2
    Last Post: 10-11-2003, 04:44 PM