查找自己的网卡:
#include <libnet.h>
#include <stdio.h>
#include <iostream> #pragma comment(lib, "libnet.lib")
#pragma comment(lib, "wsock32.lib") int main(int argc, char **argv)
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE]; /* Retrieve the device list */
if (pcap_findalldevs(&alldevs, errbuf) == -)
{
fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);
exit();
} /* Print the list */
for(d=alldevs; d; d=d->next)
{
printf("%d. %s", ++i, d->name);
if (d->description)
printf(" (%s)\n", d->description);
else
printf(" (No description available)\n");
} if(i==)
{
printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
return -;
} printf("Enter the interface number (1-%d):",i);
scanf("%d", &inum);
cin.get(); if(inum < || inum > i)
{
printf("\nInterface number out of range.\n");
/* Free the device list */
pcap_freealldevs(alldevs);
cout << "press ENTER to Exit";
cin.get();
return -;
} /* Jump to the selected adapter */
for(d=alldevs, i=; i< inum- ;d=d->next, i++); char *device = NULL;//设备名字,此时为NULL
device=d->name;
l=libnet_init(LIBNET_LINK,device,error_inf);
//。。。 。。。 return ;
}
发送ARP reply:
转载:http://blog.csdn.net/qq372895101/article/details/13769631
参考:http://bbs.csdn.net/topics/360266138
注:将"eth0"替换成上面找到的d->name;
#include <stdio.h>
#include <libnet.h>
#define MAC_ADDR_LEN 6
#define IP_ADDR_LEN 4
//向同一网络内所有机器发送ARP REPLY包,告诉他们,23.23.23.2在00:df:17:17:17:f2那里 int main(int argc, char *argv[])
{
libnet_t *l = NULL; // libnet context char *device = "eth0";
char err_buf[LIBNET_ERRBUF_SIZE];
libnet_ptag_t p_tag;
unsigned char src_mac[MAC_ADDR_LEN]//自己机器的MAC地址
= {0x00, 0xdf, 0x17, 0x17, 0x17, 0xf2};
unsigned char dest_mac[MAC_ADDR_LEN]
= {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
char *src_ip_str = "23.23.23.2";
unsigned long src_ip, dest_ip = ;
src_ip = libnet_name2addr4(l, src_ip_str, LIBNET_RESOLVE); // create libnet environment l = libnet_init(LIBNET_LINK_ADV, device, err_buf);
if(!l)
printf("libnet_init error\n"), exit();
//构造ARP数据包 p_tag = libnet_build_arp( // construct arp packet
ARPHRD_ETHER, // hardware type ethernet
ETHERTYPE_IP, // protocol type
MAC_ADDR_LEN, // mac length
IP_ADDR_LEN, // protocol length
ARPOP_REPLY, // op type
(u_int8_t*)src_mac, // source mac addr这里作用是更新目的地的ARP表 IP-MAC
(u_int8_t*)&src_ip, // source ip addr
(u_int8_t*)dest_mac, // dest mac addr
(u_int8_t*)&dest_ip, // dest ip addr
NULL, // payload
, // payload length
l, // libnet context
//0 stands to build a new one
);
if(- == p_tag)
printf("libnet_build_arp error\n"), exit();
//以太网头部 p_tag = libnet_build_ethernet( // create ethernet header
(u_int8_t*)dest_mac, // dest mac addr
(u_int8_t*)src_mac, // source mac addr这里说明你链路层的源MAC地址,如果改了可以伪装自己
ETHERTYPE_ARP, // protocol type
NULL, // payload
, // payload length
l, // libnet context
// 0 to build a new one
);
if(- == p_tag)
printf("libnet_build_ethernet error!\n"), exit();
int res;
if(- == (res = libnet_write(l)))
printf("libnet_write error!\n"), exit();
libnet_destroy(l);
return ;
}
send arp 也可以:
/*********send packets*******************************/
for(;;)
{
if((res=libnet_write(l))==-)
{
printf("libnet_write err!\n");
exit();
}
printf("arp packet has been sent\n");
sleep();
} /*********over and destroy**************************/
libnet_destroy(l);
return ;
(如果在linux下编译:gcc -o sendarp sendarp.c -lnet 执行:sudo ./sendarp)
-------------------------------------------------------------------------------------------------------------
转载:blog.csdn.net/xklxlmw/article/details/1620645
Libnet编程之arp扫描存活主机
winpcap获得本机mac和ip:http://www.cnblogs.com/xinsheng/archive/2012/04/18/2456098.html
---
经实验:
arp扫描时自己的ip和mac随便,但是发送出去的arp请求ip地址不能是255的广播地址,mac可以是全f,否则是有网关会回复arp-reply;
根据自己的ip网段从1到254定向发送arp请求,网内机器会回应一个arpreply,网关会回复多个(1或者254),本机不会回复arp。
- 交换机是否转发arp,路由器?
- 自己的网卡能够收到其发出去的arp请求?
- ip地址设为255广播地址,是否有效?
- 从1~254发送arp,如果没有回复,网关是否会将这些ip的mac指向自己?
0:网络号,255:广播,1/254:通常选做网关
网段内的主机会默认向网关发送arp请求。
经实验:
1.发送目的ip为255的广播arp时,只有网关会回复,并且将目的ip对应的mac设置成网关自己的mac
2.将目的ip设置成存活主机的ip,都没有返回。
3.pcap_next_ex()函数有3种返回值,=0是抓包超时(这个时间还不知道是在哪里设置的),>0是正常,
<0是出错(是在pcap_open_live()函数中设置的超时时间,到达这个时间之后,pcap_next_ex()函数的while循环就会退出)。
以太网、arp帧结构:http://www.cnblogs.com/yhl1234/archive/2008/03/04/1090726.html
http://bbs.csdn.net/topics/50489131
网关、网段、arp、ping:http://www.yunsec.net/a/school/wlcs/agreement/2011/0711/9068.html
arp/rarp 工作原理:http://blog.sina.com.cn/s/blog_6e80f1390100mf59.html