added snap supprt

diff --git a/hdw-sniff.c b/hdw-sniff.c
index fc67686..f17c826 100644 (file)
--- a/hdw-sniff.c
+++ b/hdw-sniff.c
@@ -13,6 +13,8 @@
 #include <arpa/inet.h>
 #include <pcap.h>
 #include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 #include <unistd.h>
 #include <sys/ioctl.h>
 
@@ -27,6 +29,9 @@
 
 #include "hdw-sniff.h" /* my functions */
 
+/* global variables */
+int file_fd=0;
+
 int main(int argc, char *argv[]) {
 
        char pcap_error[PCAP_ERRBUF_SIZE];
@@ -35,7 +40,6 @@ int main(int argc, char *argv[]) {
        fd_set pcap_fd_set;
        struct timeval fd_set_tv;
        char sys_call[30];
-       FILE *logfile;
        struct info_struct my_info_struct;
        
        /* parse the arguments */
@@ -48,7 +52,7 @@ int main(int argc, char *argv[]) {
                printf("no logfile specified, writing to stdout ...\n");
        } 
        else {
-               if((logfile=fopen(argv[3],"w"))!=NULL) {
+               if((file_fd=open(argv[3],O_RDWR))!=0) {
                        printf("writing to logfile %s ...\n",argv[3]);
                }
                else {
@@ -120,9 +124,10 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
                        const u_char *package) {
        
        /* local variables */
-       char tmp_buf[20];
+       char tmp_buf[20],crypted_snap[6];
        struct linux_wlan_ng_prism_hdr *prism_hdr;
        struct ieee802_11_hdr *w_hdr;
+       struct snaphdr *snap_hdr;
        struct ethhdr *e_hdr;
        struct iphdr *ip_hdr;
        struct info_struct *my_info_struct;
@@ -193,7 +198,7 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
                strcpy(tmp_buf,"deauthentification");
        else strcpy(tmp_buf,"impossible situation \%) - go mail the author.");
        }
-       else strcpy(tmp_buf,"control & monitor frame types not supported yet");
+       else strcpy(tmp_buf,"control & data frame type not supported yet");
        /* print out frame type */
        printf("=> %s\n",tmp_buf);
        
@@ -204,20 +209,57 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
        }
 
        /* ieee802.3 */
+       /* we need smaller w_hdr for non distributed frames */
+       if((w_hdr->frame_ctl & (1<<8)) & (w_hdr->frame_ctl & (1<<9))) {
+               printf("=> distributed packet !!!!11\n");
+       } else w_o-=(sizeof(struct snaphdr)-sizeof(unsigned short));
+
        /* ethernet */
        if((strncmp(my_info_struct->dev,"eth",3)==0) | 
                ((w_hdr->frame_ctl & IEEE802_11_FTYPE_DATA)>0)) {
-       printf("ethernet: (%d bytes)\n",e_o);
-       e_hdr=(struct ethhdr *)(package+p_o+w_o);
-       /* what types ? */
-       printf("type = ");
-       printf("%x  ",ntohs(e_hdr->h_proto));
-       printf("dest_addr = ");
-       for(i=0;i<ETH_ALEN;i++)
-       printf("%x%s",*(e_hdr->h_dest+i),((i==ETH_ALEN-1)?" ":":"));
-       printf(" src_addr = ");
-       for(i=0;i<ETH_ALEN;i++)
-       printf("%x%s",*(e_hdr->h_source+i),((i==ETH_ALEN-1)?"\n":":"));
+
+       if(!(w_hdr->frame_ctl & IEEE802_11_FTYPE_DATA)) {
+               printf("ethernet: (%d bytes)\n",e_o);
+               e_hdr=(struct ethhdr *)(package+p_o+w_o);
+               /* what types ? */
+               printf("type = ");
+               printf("%x  ",ntohs(e_hdr->h_proto));
+               printf("dest_addr = ");
+               for(i=0;i<ETH_ALEN;i++)
+               printf("%x%s",*(e_hdr->h_dest+i),((i==ETH_ALEN-1)?" ":":"));
+               printf(" src_addr = ");
+               for(i=0;i<ETH_ALEN;i++) printf("%x%s",*(e_hdr->h_source+i),
+                                               ((i==ETH_ALEN-1)?"\n":":"));
+       } 
+       else {
+               snap_hdr=(struct snaphdr *)(package+p_o+w_o);
+               if(snap_hdr->snap[0]==0xaa &
+                  snap_hdr->snap[1]==0xaa &
+                  snap_hdr->snap[2]==0x03 &
+                  snap_hdr->snap[3]==0x00 &
+                  snap_hdr->snap[4]==0x00 &
+                  snap_hdr->snap[5]==0x00) {
+                       printf("- no encryption!\n");
+                       if(snap_hdr->proto==ntohs(ETH_P_IP)) {
+                               /* we want ip header to get parsed */
+                               e_hdr->h_proto=htons(ETH_P_IP);
+                               e_o=sizeof(struct snaphdr);
+                       }
+               }
+               else {
+                       printf("- crypted packet!\n");
+                       /* print crypted snap - write into file */
+                       printf("snap: (aa aa 03 00 00 00) ");
+                       for(i=0;i<6;i++) {
+                               printf("%x ",snap_hdr->snap[i]);
+                               if(file_fd>0) write(file_fd,snap_hdr->snap+i,1);
+                       }
+                       printf("\n");
+                       // write(file_fd,'\n',1);
+                       /* dont look at ipheader */
+                       e_hdr->h_proto=htons(0);
+               }
+       }
 
                /* IP ? */
        if(ntohs(e_hdr->h_proto)==ETH_P_IP) {

diff --git a/hdw-sniff.h b/hdw-sniff.h
index fbea5d5..6dc06b9 100644 (file)
--- a/hdw-sniff.h
+++ b/hdw-sniff.h
@@ -4,13 +4,19 @@
 void pcap_process(u_char *count,const struct pcap_pkthdr *pcap_header,
                        const u_char *package);
 
+/* snap header struct */
+struct snaphdr {
+               unsigned char snap[6];  /* the six magic snap chars */
+               unsigned short proto;   /* protocol type */
+} __attribute__ ((packed));
+
 /* info struct */
 struct info_struct {
                 int count;      /* count packages */
                 char dev[10];   /* device */
                 char mmode;     /* monitor type ... and later more */
                int channel;    /* current freq channel */
-        };
+};
 
 /* hop_chanel function */
 int hop_channel(struct info_struct *info,int foo_fd);