it has been a while since i used libpcap and do not recall if it has its own defines like the winapi .... try windns.h
Code:
/* fixdns.c */
#include <windns.h>
/* or equivalent pcapdns.h */
/* set your path in .cfg or ide */
#include <pcap.h>
#include <stdio.h>
#include <time.h>
#include <stdlib.h>
#include <errno.h>
#include <memory.h>
#include <ip.h>
#include <tcp.h>
#include <udp.h>
#include <dnet.h>
#define _USE_BSD
#define __FAVOR_BSD
//Callback function, it will be called everytime a package is received
void my_callback(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char* packet)
{
struct ether_header *eptr;
struct tcphdr *tcphdr;
struct udphdr *udphdr;
struct DNS_HEADER *DNS_HEADER=&DNS_HEADER;
struct QUESTION *QUESTION=&QUESTION;
struct res_sym *res_sym;
char TYPE;
struct dns *dns;
unsigned offset = 0;
time_t t;
struct tm *tstruct;
t=time(NULL);
tstruct=localtime(&t);
char timer [80];
strftime (timer,80,"%a %b %d %Y %T",tstruct);
/* Buffer needed to store the DNS packet */
struct RES_RECORD answers,auth,addit;
struct QUERY name, ques;
/* The pointer will point to the Ethernet header at the beggining of the packet */
eptr = (struct ether_header *) packet;
/* We extract the IP header, therefore we have to move the processed Ethernet header
in order to find the information we want */
struct ip *ipc;
offset += ETH_HDR_LEN;
ipc = (struct ip *)(packet + offset);
/* We check the TCP protocol, the value of "Protocol" in the IP frame is checked according to the
8 bit value */
switch (ipc->ip_p)
{
case 1:
printf ("ICMP\n");
return; //ICMP protocol
case 6:
printf ("TCP\n");
return; //TCP protocol
case 17:
printf ("UDP\n");
break; //UDP Protocol
default:
printf ("Unknown\n");
return; //Unknown protocol
}
//lenght of the ip header to be added to the ethernet header
offset += (ipc->ip_hl)*4;
udphdr = (struct udphdr *)(packet + offset);
offset += UDP_HDR_LEN;
/* pointing to the DNS */
dns = (struct DNS_HEADER *)(packet + offset);
offset += DNS_HDRLEN;
/*Printing QR Code*/
switch (DNS_HEADER->qr)
{
case 0:
printf("QR Code is Query\t");
break;
case 1:
printf("QR Code is Answer\t");
break;
}
printf("%s%18s\t%d\t%18s\t%d\t%s\n",timer,inet_ntoa(ipc->ip_src),ntohs(udphdr->source),inet_ntoa(ipc->ip_dst),ntohs(udphdr->dest));
also note that i do not have libpcap do to hd crash. oh wait yes i do....
Code:
#ifndef _COMMON_H
#define _COMMON_H
#define FORMAT_CAP 1
#define FORMAT_IVS 2
#define FORMAT_IVS2 3
#define TCPDUMP_MAGIC 0xA1B2C3D4
#define TCPDUMP_CIGAM 0xD4C3B2A1
#define IVSONLY_MAGIC "\xBF\xCA\x84\xD4"
#define IVS2_MAGIC "\xAE\x78\xD1\xFF"
#define IVS2_EXTENSION "ivs"
#define IVS2_VERSION 1
#define PCAP_VERSION_MAJOR 2
#define PCAP_VERSION_MINOR 4
#define LINKTYPE_ETHERNET 1
#define LINKTYPE_IEEE802_11 105
#define LINKTYPE_PRISM_HEADER 119
#define LINKTYPE_RADIOTAP_HDR 127
#define uchar unsigned char
#define ushort unsigned short
#define uint unsigned int
#define ulong unsigned long
#define SWAP32(x) \
x = ( ( ( x >> 24 ) & 0x000000FF ) | \
( ( x >> 8 ) & 0x0000FF00 ) | \
( ( x << 8 ) & 0x00FF0000 ) | \
( ( x << 24 ) & 0xFF000000 ) );
//BSSID const. length of 6 bytes; can be together with all the other types
#define IVS2_BSSID 0x0001
//ESSID var. length; alone, or with BSSID
#define IVS2_ESSID 0x0002
//wpa structure, const. length; alone, or with BSSID
#define IVS2_WPA 0x0004
//IV+IDX+KEYSTREAM, var. length; alone or with BSSID
#define IVS2_XOR 0x0008
/* [IV+IDX][i][l][XOR_1]..[XOR_i][weight] *
* holds i possible keystreams for the same IV with a length of l for each keystream (l max 32) *
* and an array "int weight[16]" at the end */
#define IVS2_PTW 0x0010
//unencrypted packet
#define IVS2_CLR 0x0020
struct pcap_file_header
{
uint magic;
ushort version_major;
ushort version_minor;
int thiszone;
uint sigfigs;
uint snaplen;
uint linktype;
};
struct pcap_pkthdr
{
int tv_sec;
int tv_usec;
uint caplen;
uint len;
};
struct ivs2_filehdr
{
unsigned short version;
};
struct ivs2_pkthdr
{
unsigned short flags;
unsigned short len;
};
#endif /* common.h */
have a look.... you need to go through it an make sure everything matches up.