一.概述 上一篇arp請求使用的是鏈路層的原始套接字。icmp封裝在ip數據報裡面,所以icmp請求可以直接使用網路層的原始套接字,即socket()第一個參數是PF_INET。如下: 1 sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP); icmp報
一.概述
上一篇arp請求使用的是鏈路層的原始套接字。icmp封裝在ip數據報裡面,所以icmp請求可以直接使用網路層的原始套接字,即socket()第一個參數是PF_INET。如下:
1 sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP);
icmp報文不同的類型有不同的格式,我們以icmp回顯請求和會顯應答報文格式(即ping程式使用的報文類型)為例:
類型為8表示請求,為0表示應答。校驗和要自己計算,標識符一般為程式的進程ID號。序號自定義,一般從1開始。選項數據裡面可以放時間戳,用作計算ping一次的花費時間!
icmp報文結構定義在netinet/ip_icmp.h
1 struct icmp 2 { 3 u_int8_t icmp_type; /* type of message, see below */ 4 u_int8_t icmp_code; /* type sub code */ 5 u_int16_t icmp_cksum; /* ones complement checksum of struct */ 6 union 7 { 8 u_char ih_pptr; /* ICMP_PARAMPROB */ 9 struct in_addr ih_gwaddr; /* gateway address */ 10 struct ih_idseq /* echo datagram */ 11 { 12 u_int16_t icd_id; 13 u_int16_t icd_seq; 14 } ih_idseq; 15 u_int32_t ih_void; 16 17 /* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */ 18 struct ih_pmtu 19 { 20 u_int16_t ipm_void; 21 u_int16_t ipm_nextmtu; 22 } ih_pmtu; 23 24 struct ih_rtradv 25 { 26 u_int8_t irt_num_addrs; 27 u_int8_t irt_wpa; 28 u_int16_t irt_lifetime; 29 } ih_rtradv; 30 } icmp_hun; 31 #define icmp_pptr icmp_hun.ih_pptr 32 #define icmp_gwaddr icmp_hun.ih_gwaddr 33 #define icmp_id icmp_hun.ih_idseq.icd_id 34 #define icmp_seq icmp_hun.ih_idseq.icd_seq 35 #define icmp_void icmp_hun.ih_void 36 #define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void 37 #define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu 38 #define icmp_num_addrs icmp_hun.ih_rtradv.irt_num_addrs 39 #define icmp_wpa icmp_hun.ih_rtradv.irt_wpa 40 #define icmp_lifetime icmp_hun.ih_rtradv.irt_lifetime 41 union 42 { 43 struct 44 { 45 u_int32_t its_otime; 46 u_int32_t its_rtime; 47 u_int32_t its_ttime; 48 } id_ts; 49 struct 50 { 51 struct ip idi_ip; 52 /* options and then 64 bits of data */ 53 } id_ip; 54 struct icmp_ra_addr id_radv; 55 u_int32_t id_mask; 56 u_int8_t id_data[1]; 57 } icmp_dun; 58 #define icmp_otime icmp_dun.id_ts.its_otime 59 #define icmp_rtime icmp_dun.id_ts.its_rtime 60 #define icmp_ttime icmp_dun.id_ts.its_ttime 61 #define icmp_ip icmp_dun.id_ip.idi_ip 62 #define icmp_radv icmp_dun.id_radv 63 #define icmp_mask icmp_dun.id_mask 64 #define icmp_data icmp_dun.id_data 65 };
二.icmp請求代碼
1 /** 2 * @file icmp_request.c 3 */ 4 5 #include <stdio.h> 6 #include <stdlib.h> 7 #include <string.h> 8 #include <unistd.h> 9 #include <sys/socket.h> 10 #include <arpa/inet.h> 11 #include <netinet/in.h> 12 #include <netinet/ip_icmp.h> 13 #include <sys/time.h> 14 15 /* icmp報文長度 */ 16 #define ICMP_PACKET_LEN sizeof(struct icmp) 17 18 void err_exit(const char *err_msg) 19 { 20 perror(err_msg); 21 exit(1); 22 } 23 24 /* 校驗和 */ 25 unsigned short check_sum(unsigned short *addr, int len) 26 { 27 int nleft = len; 28 int sum = 0; 29 unsigned short *w = addr; 30 unsigned short answer = 0; 31 32 while(nleft > 1) 33 { 34 sum += *w++; 35 nleft -= 2; 36 } 37 if(nleft == 1) 38 { 39 *(unsigned char *)(&answer) = *(unsigned char *)w; 40 sum += answer; 41 } 42 43 sum = (sum >> 16) + (sum & 0xffff); 44 sum += (sum >> 16); 45 answer = ~sum; 46 47 return answer; 48 } 49 50 /* 填充icmp報文 */ 51 struct icmp *fill_icmp_packet(int icmp_type, int icmp_sequ) 52 { 53 struct icmp *icmp_packet; 54 55 icmp_packet = (struct icmp *)malloc(ICMP_PACKET_LEN); 56 icmp_packet->icmp_type = icmp_type; 57 icmp_packet->icmp_code = 0; 58 icmp_packet->icmp_cksum = 0; 59 icmp_packet->icmp_id = htons(getpid()); 60 icmp_packet->icmp_seq = htons(icmp_sequ); 61 /* 發送時間 */ 62 gettimeofday((struct timeval *)icmp_packet->icmp_data, NULL); 63 /* 校驗和 */ 64 icmp_packet->icmp_cksum = check_sum((unsigned short *)icmp_packet, ICMP_PACKET_LEN); 65 66 return icmp_packet; 67 } 68 69 /* 發送icmp請求 */ 70 void icmp_request(const char *dst_ip, int icmp_type, int icmp_sequ) 71 { 72 struct sockaddr_in dst_addr; 73 struct icmp *icmp_packet; 74 int sockfd, ret_len; 75 char buf[ICMP_PACKET_LEN]; 76 77 /* 請求的地址 */ 78 bzero(&dst_addr, sizeof(struct sockaddr_in)); 79 dst_addr.sin_family = AF_INET; 80 dst_addr.sin_addr.s_addr = inet_addr(dst_ip); 81 82 if ((sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1) 83 err_exit("sockfd()"); 84 85 /* icmp包 */ 86 icmp_packet = fill_icmp_packet(icmp_type, icmp_sequ); 87 memcpy(buf, icmp_packet, ICMP_PACKET_LEN); 88 89 /* 發送請求 */ 90 ret_len = sendto(sockfd, buf, ICMP_PACKET_LEN, 0, (struct sockaddr *)&dst_addr, sizeof(struct sockaddr_in)); 91 if (ret_len > 0) 92 printf("sendto() ok!!!\n"); 93 94 close(sockfd); 95 } 96 97 int main(int argc, const char *argv[]) 98 { 99 if (argc != 2) 100 { 101 printf("usage:%s dst_ip\n", argv[0]); 102 exit(1); 103 } 104 105 /* 發送icmp請求 */ 106 icmp_request(argv[1], 8, 1); 107 108 return 0; 109 }
流程:命令行接收icmp請求的目標IP,106行發送請求,指定icmp類型是8,序列號是1。然後通過目標IP地址創建網路地址結構,接著創建ICMP類型的原始套接字,填充icmp報文,並把發送時間填到icmp的數據結構。
三.icmp接收代碼
1 /** 2 * @file icmp_recv.c 3 */ 4 5 #include <stdio.h> 6 #include <stdlib.h> 7 #include <string.h> 8 #include <unistd.h> 9 #include <sys/time.h> 10 #include <sys/socket.h> 11 #include <arpa/inet.h> 12 #include <netinet/in.h> 13 #include <netinet/ip.h> 14 #include <netinet/ip_icmp.h> 15 16 /* IP首部長度 */ 17 #define IP_HEADER_LEN sizeof(struct ip) 18 /* icmp報文長度 */ 19 #define ICMP_PACKET_LEN sizeof(struct icmp) 20 /* IP + ICMP長度 */ 21 #define IP_ICMP_PACKET_LEN IP_HEADER_LEN + ICMP_PACKET_LEN 22 23 void err_exit(const char *err_msg) 24 { 25 perror(err_msg); 26 exit(1); 27 } 28 29 /* 計算發送時間與接收時間的毫秒差 */ 30 float time_interval(struct timeval *recv_time, struct timeval *send_time) 31 { 32 float msec = 0; 33 34 /* 如果接收的時間微妙小於發送的微妙 */ 35 if (recv_time->tv_usec < send_time->tv_usec) 36 { 37 recv_time->tv_sec -= 1; 38 recv_time->tv_usec += 1000000; 39 } 40 msec = (recv_time->tv_sec - send_time->tv_sec) * 1000.0 + (recv_time->tv_usec - send_time->tv_usec) / 1000.0; 41 42 return msec; 43 } 44 45 int main(void) 46 { 47 struct ip *ip_header; 48 struct icmp *icmp_packet; 49 char buf[IP_ICMP_PACKET_LEN]; 50 struct timeval *recv_timeval, *send_timeval; 51 int sockfd, ret_len; 52 53 if ((sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1) 54 err_exit("sockfd()"); 55 56 recv_timeval = malloc(sizeof(struct timeval)); 57 while (1) 58 { 59 ret_len = recv(sockfd, buf, IP_ICMP_PACKET_LEN, 0); 60 if (ret_len > 0) 61 { 62 /* 接收時間 */ 63 gettimeofday(recv_timeval, NULL); 64 /* 取出ip首部 */ 65 /* 取出icmp報文 */ 66 ip_header = (struct ip *)buf; 67 icmp_packet = (struct icmp *)(buf + IP_HEADER_LEN); 68 /* 取出發送時間 */ 69 send_timeval = (struct timeval *)icmp_packet->icmp_data; 70 printf("===============================\n"); 71 printf("from ip:%s\n", inet_ntoa(ip_header->ip_src)); 72 printf("icmp_type:%d\n", icmp_packet->icmp_type); 73 printf("icmp_code:%d\n", icmp_packet->icmp_code); 74 printf("time interval:%.3fms\n", time_interval(recv_timeval, send_timeval)); 75 } 76 } 77 78 free(recv_timeval); 79 close(sockfd); 80 return 0; 81 }
流程:創建ICMP類型的原始套接字後直接接收。首先獲取接收時間,然後依次取出ip首部,icmp報文,再取出icmp的請求時間。從ip首部獲取源ip地址,從icmp報文獲取該報文的類型,代碼號,通過發送時間和接收時間計算毫秒差!
四.實驗
1.打開wireshark一起觀察。以root運行icmp_recv,再運行icmp_request
可以看到icmp的類型是0,代碼也是0。響應時間跟我們的程式差不多。
2.現在我們請求一個不可達的ip地址
主機不可達時,返回的icmp報文類型是3,代碼是1。報文結構不同,取出的發送時間是不正常的,所以這裡計算的時間間隔也不正常。wireshark裡面的結果是,本機自動廣播了一個arp請求,但沒有機器回答本機。
部分icmp類型: