c - 未收到 ARP 请求，wireshark 无法读取 arp header

Question

我目前正在编写一个发送 arp 请求的小程序，该程序似乎可以工作，因为 wireshark 捕获了数据包，但有一些奇怪的地方；首先，目标主机没有收到数据包(我没有收到任何响应，甚至在目标上运行 wireshark 也没有显示任何内容)，其次，数据包似乎包含与程序插入数据包本身的信息不同的信息。我更好地解释了自己:数据包应该有带有目标 mac 地址、源 mac 地址和协议(protocol)类型的以太网 header ，然后是 arp header 。 wireshark 无法识别 arp header ，它也显示了一些不同的东西而不是以太网 header ，我不明白为什么。有人可以帮帮我吗？

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <net/ethernet.h>
#include <netpacket/packet.h>
#include <ifaddrs.h>

#define TRUE 1

/* in the arp header structure defined in the linux header files access to certain fields is prohibited 
 * so we define our own ARP packet with all the fields needed to send an ARP spoofed packet */
struct arp_packet{
    unsigned char h_dest[ETH_ALEN];     /* destination ETH address (MAC address) */     
    unsigned char h_source[ETH_ALEN];   /* source ETH address (MAC address) */
    unsigned short h_proto;         /* packet protocol: ETH_P_ARP */
    unsigned short ar_hrd;          /* format of hardware address: ARPHDR_ETHER */
    unsigned short ar_proto;        /* format of protocol address: ETH_P_IP */
    unsigned char ar_hlen;          /* length of hardware address: 6 */
    unsigned char ar_plen;          /* length of protocol address: 4 */
    unsigned short ar_op;           /* type of ARP packet: ARPOP_REQUEST */
    unsigned char ar_senderHaddr[ETH_ALEN]; /* sender MAC address */
    unsigned char ar_senderIP[4];       /* sender IP address */
    unsigned char ar_targetHaddr[ETH_ALEN]; /* target MAC address */
    unsigned char ar_targetIP[4];       /* target IP address */
};

void mac_parser(char *mac_address, unsigned char *dest);

int main(int argc, char **argv){
    /* for the following structure we need to fill the following fields 
     * sll_family: PF_PACKET
     * sll_addr: MAC address of receiver
     * sll_halen: ETHER_ADDR_LEN
     * sll_ifindex: interface index number */
    struct sockaddr_ll ll1 = {0}, ll2 = {0};
    /* socket descriptor */
    int fd;
    /* structure for ioctl */
    struct ifreq ifr = {0};
    /* structure for getifaddrs */
    struct ifaddrs *ifaddr, *ifa;
    /* arp packets */
    struct arp_packet A;
    /* ip addresses */
    struct in_addr A_ip, B_ip;
    struct hostent *host;

    if(argc < 3){
        fprintf(stderr, "Usage: %s <IP address of host A> <MAC of host A> <IP address of host B> <MAC address of host B>\n", argv[0]);
        exit(1);
    }
    /* access the data link layer with PF_PACKET */
    if((fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ARP))) == -1){
        fprintf(stderr, "%s\n", strerror(errno));
        exit(2);
    }
    /* get a valid interface to use */
    if(getifaddrs(&ifaddr) == -1){
        fprintf(stderr, "%s\n", strerror(errno));
        exit(3);
    }
    for(ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next){
        if(ifa->ifa_flags & IFF_UP){
            if(ifa->ifa_flags & IFF_RUNNING){
                if(strcmp(ifa->ifa_name, "lo")){
                    strcpy(ifr.ifr_name, ifa->ifa_name);
                    break;
                }
            }
        }
    }
    /* get the interface index number */
    if(ioctl(fd, SIOCGIFINDEX, &ifr) == -1){
        fprintf(stderr, "%s\n", strerror(errno));
        exit(4);
    }
    /* Put ip addresses in the network format */
    if((host = gethostbyname(argv[1])) == NULL){
        fprintf(stderr, "%s\n", strerror(errno));
        exit(5);
    }
    A_ip = *(struct in_addr *)host->h_addr;
    printf("%s - %s\n", argv[1], inet_ntoa(A_ip));
    if((host = gethostbyname(argv[3])) == NULL){
        fprintf(stderr, "%s\n", strerror(errno));
        exit(6);
    }
    B_ip = *(struct in_addr *)host->h_addr;
    /* fill lls structures */
    ll1.sll_family = PF_PACKET;
    ll1.sll_halen = ETHER_ADDR_LEN;
    ll1.sll_ifindex = ifr.ifr_ifindex;
    mac_parser(argv[2], ll1.sll_addr);
    /* fill arp_packets */
    memcpy(A.h_dest, ll1.sll_addr, ETH_ALEN);
    mac_parser(argv[4], ll2.sll_addr);
    memcpy(A.h_source, ll2.sll_addr, ETH_ALEN);
    A.h_proto = htons(ETH_P_ARP);
    A.ar_hrd = htons(ARPHRD_ETHER);
    A.ar_proto = htons(ETH_P_IP);
    A.ar_hlen = 6;
    A.ar_plen = 4;
    A.ar_op = htons(ARPOP_REQUEST);
    memcpy(A.ar_senderHaddr, A.h_source, ETH_ALEN);
    memcpy(A.ar_targetHaddr, A.h_dest, ETH_ALEN);
    memcpy(A.ar_senderIP, &B_ip, 4);
    memcpy(A.ar_targetIP, &A_ip, 4);
    A.pool = 0;
    /* send packets in a loop */
    while(TRUE){
        if(sendto(fd, &A, sizeof(A), 0, (struct sockaddr *)&ll1, sizeof(ll1)) == -1){
            fprintf(stderr, "%s\n", strerror(errno));
            exit(6);
        }
        sleep(1);
    }
    return 0;
}

void mac_parser(char *mac_address, unsigned char *dest){

    unsigned transition;
    int i = 0;
    char *token = strtok(mac_address, ":");

    while(token){
        sscanf(token, "%x", &transition);
        dest[i] = (unsigned char)transition;
        token = strtok(NULL, ":");
        i++;
    }
}

这是wireshark截图

Answer 1

将线路上数据包的“数据”部分与 ARP 数据包示例进行比较，您可以验证所有必要的字节实际上都已就位。问题发生在帧的以太网 header 中，其中协议(protocol)标识符是 0x0000 而不是 0x0806。这就是为什么 Wireshark 甚至不尝试将数据包解码为 ARP，而是将其显示为原始数据。

看起来您错过了 ll1 的部分初始化。添加此行似乎可以解决问题:

ll1.sll_protocol = htons(ETH_P_ARP);